Private APIs, sometimes also referred to as internal APIs, are intended to be used by the company's developers and contractors. Often a part of a service-oriented architecture (SOA) initiative, private APIs are meant to streamline internal development by enabling different departments or business units to access each other's data efficiently and effectively.
In contrast, public APIs, also known as external APIs, are exposed to consumers from outside the company. In their most extreme manifestation, as open APIs, they can be freely consumed by anyone. But in any case, they require tighter management and great documentation, so they could be used by engineers outside the company.
It's important to note that private APIs that can be accessed over the internet, are not really private after all, in the strict sense of the word. Take for example ACME's B2C API used only by ACME mobile apps (developed in-house by ACME engineers). You may be tempted to call this a private API, but since the traffic to this API arrives from the internet ('outside the company'), this API is not really private, simply undocumented. Hackers attack such APIs on a daily basis, by intercepting the traffic, and by reverse engineering mobile apps to see which APIs they interact with.