API Management Demystified

Editor's Notes

• #13: The single API + developer community is a project to write a good API (which we assume to be the same as a single App, which might be high), and a single person to support the community full time at a loaded cost of $150K, which is enough to get started, and certainly to support the first 10 apps. It could be more depending, but that’s beyond the complexity of this conversation.
• #15: Make sure to introduce the idea of 2 perspectives – provider and consumer. The provider needs to make sure his trains can run, and that stray animals don’t get in the way. The consumers need to make sure their horses don’t break their legs on these strange tracks!
• #16: http://blog.programmableweb.com/2013/01/07/api-consumers-want-reliability-documentation-and-community/
• #18: http://blog.programmableweb.com/2013/01/07/api-consumers-want-reliability-documentation-and-community/
• #19: Version disruption (need mediation)SLA (is your provider delivering in a way that lets you meet your needs? If not, what can you do?)What if provider changes terms and puts you out of business? (small company acquired, or Twitter example; need GRC for developer best practices)What are other employees in the org doing? (are we using 2 different sets of weather data, for example? Are we paying twice for the same information? Are we building higher level libraries twice, differently?)Are we conforming to internal standards around data, security, performance?
• #22: http://bit.ly/APItrifecta
• #24: Capabilities in 3 buckets:API PortalAPI providers set up a portal for their APIs to attract and on-board external app developers. It allows client app developers to search the APIs they need, read up on the documentation and get notifications on APIs they use.API GatewayAllows API managers to secure and mediate traffic between the API consumers and back-end servers. Also allows monitoring of API traffic to collect metrics for tasks such as performance dashboards and invoicing.API LifecycleAllows API developers to manage the entire process of designing, developing, deploying, versioning and retiring APIs. This is a critical piece for implementing a sustainable API strategy.
• #26: In addition to API capabilities, it is also important to consider the operational aspects of an API management solution.Obviously you need something that will scale elastically with the peaks and valleys of the demand. Mobility a huge driver for APIs and #1 reason why it is hard to predict demand.You also need your solution to support high availability. API’s are essentially a globally available resource and adoption of your API is dependent on a highly reliable operation.Another thing that sometimes get easily overlooked is the ease of ensuring smooth operations. How easy it is to do daily housekeeping tasks such as taking timely backups, cleaning up log files and even automating some of these tasks using scripts.Operational governance is another key aspect. Who has the rights to provision and de-provision APIs? What is the criteria for doing so? What is the process of changing authentication mechanism for APIs? What is the security model and what are the rights based on roles?Consider deployment options for API management – what combination of cloud, on-premise and hybrid – works for your organization – it is probably easiest to think in terms of API capabilities we discussed and where they can be deployment. For instance is the monitoring piece of your API gateway deployed on-premise or in the cloud. There’s no one right answer but your API management solution need to support a good mix of options.Finally also consider if it makes sense to have a separate solution for both internal and external APIs.
• #29: In this example client app developers perform full text search. The results are displayed in a Google type layout. They can narrow down searches using keywords. Developers can then select a group of APIs and perform actions such as, setting up a watch, marking them as their favorite, and/or requesting access.
• #30: Or another example where your API portal may provide app developers a selection of graphical widgets to track their personal KPIs. For instance, what API’s are most used by mobile applications or what kind of apps are other developers are building using a specific API or what are the most popular APIs.Next let’s look at some API gateway examples.
• #31: This example shows how an API Gateway may implementtraffic management policies. API managers can shape the incoming traffic to a granular level. They can apply throttling limit across a segment of API consumers or across all consumers. They can decide to shut down the API request when violations happen or simply issue a warning to the user and log notifications.
• #32: In this example of an API gateway, you see how it makes it easy to apply a combination of monitoring and security policies. API managers simply check all the policies from a list of pre-populated options that they need to apply consistently to API invocations.Ok a couple of more examples for API lifecycle management.
• #33: In this example of an API lifecycle there are four states that an API goes thro – proposed, approved, in production and retired. The example shows how it is possible to define transitions from one state to another, and what checks may be performed at the gate before the transition is completed. Again a great way for API developers to ensure that the APIs exposed meet the standards and the goals of the API strategy.
• #34: In this final example, this API lifecycle capability let’s you graphically analyze the impact of changes to the WarehouseInformation API. It shows that the Mobile CRM and Employee Portal applications are using the API. And it shows that this API is related to the Warehouse Inventory Process and uses the canonical definition of an employee.Now there are a number of reasons why organizations may implement APIs. Some organizations use APIs to unlock the business value of their unique data. Whereas others use APIs to better enable partners and increase their reach. Finally many are using APIs as the means to mobilize their enterprise applications. I have hand-picked a couple of our customers to illustrate how diverse business drivers to do APIs can be.
• #36: EPA’s data standards branch (DSB) has implemented Reusable Component Services or RCS which is an umbrella registry serving as a clearinghouse for all kinds of reusable components regardless of where they reside. Why? DSB has been repeatedly approached by Exchange Network partners and EPA programs for access to various services and reusable components to support their information management needs. RCS serves as the vehicle for this outreach and discovery. The services provide a one-stop place to discover components of many different types, hosted and/or managed by many different organizations. RCS that contains over a 1000 assets and federates data for a dozen different registries and sources. For developing new applications using environmental data RCS provisions API’s that are used by EPA programs, public mobile apps, web sites and data.gov. Developers can go to EPA’s site called Developer Central where they can search for the appropriate API. For instance
• #37: Envirofacts API is a centralized data warehouse which provides access to several EPA environmental databases. Envirofacts has developed a RESTful data service API to all of its internal data holdings.  
• #38: Based on EPA’s data, EPA now has a collection of 100+ “Green Apps”. You can find apps by mobile platform and by topic, or suggest a new app. EPA hosted a developer challenge in summer of 2011 to encourage developers to create green apps.
• #39: This is one of the top 3 logistics company in the world. It believes that freight shipping should be just as easy as shipping documents around the world. This company hosts an API that is used by procurement and logistics officers to access over 140 services across different types of freight – sea, air, road and rail. Examples of such services include shipment tracking and border toll calculation. The company is now planning a self-service portal to expose the APIs to customers and partners who can use is to onboard applications and to collaborate. Under the covers the API is powered by virtualized services that are securely exposed to external consumers. A small group of experts manage the operational aspects of hosting the API including provisioning and deprovisioning of services. The system allows business owners of services to track consumption and usage of those APIs.
• #40: wM Gateway: Inspects the headers• For DoS checks (global or by consumer)• Does basic firewall checks• Message Size Limit Checks• OAuth2 app to service validation (in 9.0)Cross-Origin Resource Sharing (CORS) is a W3C spec that allows cross-domain communication from the browser.