To call a VK API method you need to make POST or GET request to the specified URL using HTTPS protocol:

https://api.vk.com/method/METHOD_NAME?PARAMETERS&access_token=ACCESS_TOKEN

METHOD_NAME — method name from the list of API functions, 
PARAMETERS — parameters of the corresponding API method, 
ACCESS_TOKEN — access key received after successful application authorization. 

https://api.vk.com/method/getProfiles?uid=66748&access_token=533bacf01e11f55b536a565b57531ac114461ae8736d6506a3

In reply to such a request you will receive a reply in JSON format. 

To receive a reply in XML format you need to add format extension after the method name: METHOD_NAME.xml 

https://api.vk.com/method/getProfiles.xml?uid=66748&access_token=533bacf01e11f55b536a565b57531ac114461ae8736d6506a3

For API cross-domain requests you may use JSONP protocol. For this you need to connect a script with request src=url to the document by adding a callback parameter to the request with the name of the function which will be called when the result is received. 

var script = document.createElement('SCRIPT');

script.src = "https://api.vk.com/method/getProfiles?uid=66748&access_token=533bacf...&callback=callbackFunc";

document.getElementsByTagName("head")[0].appendChild(script);

function callbackFunc(result) {
  alert(result);
}

You can also make requests without HTTPS, using a special signature. 

Parameters can be transmitted both with GET and POST methods. If you need to send a lot of data (more than 2 kb), use POST method.

Each method has its own set of supported parameters but there are some common ones:

• lang – determines the language for the data to be displayed on. For example country and city names. If you use a non-cyrillic language, cyrillic symbols will be transtiterated automatically. en – English, ru – Russian, uk – Ukrainian, be – Belorussian, es – Spanish, fi – finnish, de – German, it – Italian. Numeric format from account.getInfo is supported as well.
• v – marks the used API version. Using this parameter may change different methods' reply formats. For the moment actual API version is 5.21. This parameter should be sent with all API requests.
• https – 1 – allows to get https links for photos and other media. 0 – methods return http links (default). Keep in mind that this parameter works only if you send requests to API through https.
• test_mode=1 – allows to send requests from a native app without switching it on for all users.

Moreover you may send request without https using the special scheme.

There can be maximum 3 requests to API methods per second from a client.

Maximum amount of server requests depends on the app's users amount.
If an app has less than 10 000 users, 5 requests per second, up to 100 000 – 8 requests, up to 1 000 000 – 20 requests, 1 000 000+ – 35 requests.

If one of this limits is exceeded, the server will return following error: 'Too many requests per second'.

If your app's logic implies many requests in a row, check the execute method.

Except the frequency limits there are quantitative limits on calling the methods of the same type. By obvious reasons we don't provide the exact limits info.

On excess of a quantitative limit access to a particular method will require captcha (see captcha_error). After that it may be temporarily limited (in this case the server doesn't answer on particular method's requests but easily processes any other requests).