Contract {Collaboration} Driven Development - APIdays Interface 2020

Jul 7, 20200 likes182 views

In the API space, much of the conversation around Contract Driven Development has centered on the question “Did we build the API right?“. By using the contract as the foundation for a common understanding of the API, we can answer not only that question, but the equally important - but more elusive - “Did we build the right API?“. In /Contract/{Collaboration}/DrivenDevelopment, we will discuss how API Specifications and consumer-driven contracts can form the basis for cross-team collaboration in delivering quality services.

1
/Contract/{Collaboration}
/DrivenDevelopment|

2
2 Questions: Did I Build the API Right? … Did I Build the Right API?
Alianna Inzana
Senior Director, API Testing
| Designing APIs
| Keeping “Design” in Design-First
| Design First…but Only at First: Evolving your API
| Meet Your Contract(s): Beyond Specifications
| CDD – Collaboration Driven Development
| The Quality Contract

33
Everything…begins with language.
Language begins with listening.
- Jeanette Winterson|

4
How Do You Build an API?
+
+
Challenges of Design First Approach

5
Bridging the Gap between Design and Development
Motivation for Change
│ Consumers become frustrated with out-
of-date documentation
│ API Discovery opportunities are curtailed
– resulting in duplicated work
│ Inconsistent Developer Experience –
practices, styles, DX
5

66
Recognizing the need is the
primary condition for design.
- Charles Eames|

88
A design isn’t finished until
somebody is using it.
- Brenda Laurel|

9
API Virtualization
| Deploy a virtual API based off a draft of
the spec plus some generated or
referenced data.
| Simulate API behavior and responses,
and even the performance of the future
service.
| Why is Virtualization Important?
| Net effects of broad and diverse
feedback is quality, clarity of
purpose…and improved stakeholder
engagement – keys to API adoption.
| ….did I build the right API?
Virtual

1111
Great architecture is a collaboration among a
lot of people over a long period of time.
- Joshua Prince-Ramus|

12
Design First…but Only at First: Evolving Your API
│ Deployed API and Specification are out of sync
│ Therefore: API Design does not drive development
…V+++=
V1+++

13
Driving Development using Design First
1 Propose change
2 See failing tests
3 Write passing code
4
Create pull request,
merge to master
5 CI/CD Publish and mark
default using Registry API
…V+++

14
Specification Validation: Producer Contract Test
| Why is it important?
• Check, can be easily automated
• Devs know if anything has been added
to the spec ( build pipeline test will fail
because spec is updated)
| ….Did I Build the API Right?
| Run Producer Contract Tests with each
PR, before any build is promoted
| Keep API build in conformance with
documentation, easier to iterate on API

1515
How well we communicate is determined
not by how well we say things, but
how well we are understood.
— Andrew Grove
|

16
│ Consumers USE your APIs
│ Consumer interactions can get hidden in
the telemetry
│ Consumers cause security problems
│ In some architectural patterns –
Consumers are entirely anonymous…until
something breaks.
│ Consumers implement your API incorrectly,
or too thoroughly, or outdated versions
Into the Unknown: API Consumers

18
Mapping your Audience
At NetFlix:
│ + 1 Billion calls per day, each API call
fans out to ~6 calls to backend services
At Amazon:
│ Website calls 100-150 services to get
data used to build a single webpage

1919
The single biggest problem in communication
is the illusion that it has taken place.
— George Bernard Shaw|

20
Consumer-Driven Contract Testing
Virtual
1. Structure of a Response
2. Error Handling
3. Event Type/Payload
4. Rate Limiting
5. Content Distribution

21
Quality Is Experienced Throughout the API Lifecycle
Design Build Test Secure Deploy Monitor
Quality
The act of designing should be an ongoing collaboration which is facilitated by the specification as teams iterate

2222
Good design begins with honesty,
asks tough questions,
comes from collaboration
and from trusting your intuition.
—Freeman Thomas
|

2323
Thank You
Alianna Inzana
Senior Director, API Testing
@AInzana
linkedin.com/in/aliannainzana

This document discusses the need for reconstructing API specifications from runtime traffic without source code access. It provides an overview of existing open source solutions and their limitations. It then introduces APIClarity, an open source tool that monitors API traffic using a service mesh to automatically generate OpenAPI specifications, allows users to review and approve specifications, and detects differences between specifications and runtime behavior. The document demonstrates APIClarity using a sample application and discusses plans for additional features.

apidays LIVE New York 2021 - API Security & AI by Deb Roy, Accentureapidays

This document discusses the importance of API security and how AI can be used to augment API security. It notes that cyber threats are evolving quickly and becoming more sophisticated. API usage has increased access points for potential hackers. The document then outlines how the Accenture APIQ platform uses AI and machine learning for automated API assessment and security. It analyzes API configurations and behavior patterns to provide insights, detect anomalies, monitor APIs, and provide real-time remediation to protect digital assets.

apidays LIVE Hong Kong 2021 - Event-driven APIs & Schema governance for Apach...apidays

apidays LIVE Hong Kong 2021 - API Ecosystem & Data Interchange August 25 & 26, 2021 Event-driven APIs & Schema governance for Apache Kafka Hugo Guerrero, APIs & Messaging Developer Advocate at Red Hat ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

apidays LIVE Paris - Potential of API integrations, common traps and advices ...apidays

apidays LIVE Paris 2021 - Deliver real-time data to customer using Streaming ...apidays

This document discusses streaming APIs for delivering real-time data to customers. It covers the API lifecycle, defines streaming APIs, describes common streaming API architectures and implementations, and discusses security and governance considerations for streaming APIs. The presentation provides examples of how streaming APIs can be used to deliver real-time updates from data sources like databases and applications to clients.

apidays LIVE Paris 2021 - 5 Learnings Shaping Our View on the Future of APIs ...apidays

apidays LIVE Paris - Succeeding with API Programs by Kiran Nadgirapidays

apidays LIVE Paris 2021 - Addressing OWASP API Security Top 10 by Isabelle Ma...apidays

API breaches are increasing, with over 350 reported publicly since October 2018. The top causes are lack of input validation, rate limiting, data/exception leakage, and authorization and authentication issues. These map to the OWASP API Security Top 10 risks. API-centric architectures expand the attack surface. To address this, security needs to be considered at design time through the API contract, which defines data constraints, authorization policies, logging, and rate limiting. Following best practices like this helps avoid vulnerabilities that are costly to fix later.

API Strategy in CloudPavanPardeshi1

Designed a framework for “API Strategy in the cloud” which explains challenges of API, current trending API management platforms and the role of API management in delivering successful API programs. The report provides the strategy for building API which mainly focuses on the API maturity models, business values, business strategy: Alignment and Usefulness, engagement and usability, scalability and evolvability, manageability and security of APIs.

apidays LIVE Australia 2021 - SEEK: Establishing a new API integration platfo...apidays

APIdays Helsinki 2019 - API Management Trends 2019 with Janne Nieminen, Digiaapidays

Mobile - Your API Security Blindspot by David Stewart, Approovapidays

INTERFACE, by apidays - Aligning teams and strategies behind API investment ...apidays

apidays LIVE New York 2021 - API Automation For DevOps at Scale by Rod Cope, ...apidays

apidays LIVE LONDON - Protecting financial-grade APIs - Getting the right API...apidays

apidays LIVE Australia 2021 - Modernising development using API First & Lesso...apidays

Building an API Security StrategySmartBear

apidays LIVE LONDON - Discovering API Version differences with ease by Jaap B...apidays

APIdays Singapore 2019 - SDKs and Code Samples - The Cornerstone of API Devel...apidays

The document discusses how SDKs and code samples are cornerstones of API developer experience. It notes that decades ago, developers had to work with machine code directly, but now have access to higher-level languages, SDKs and code samples to more easily access and build on APIs. The document advocates that API providers should focus on automating the creation of dynamic code samples and SDKs to remove redundant work for developers and provide a premium developer experience.

Is Your API Being Abused – And Would You Even Notice If It Was?Nordic APIs

APIs are a wonderful thing and bring many benefits, but by their very nature they are also a window into how your business operates. If someone can exploit your system for gain, they will. This presentation will give multiple real examples of API abuse in the wild, via methods such as data scraping, service misuse/cheating, unauthorized aggregation and fake account creation. How is it done, how are existing API controls bypassed, and what are the business implications? The audience will learn that API abusers are inventive and they use smart tools. The audience will also learn who some of these API abusers are, and may be surprised by the result. (Spoiler: they can be your customers!) Finally, some guidance will be given around what additional access controls can be put in place to ensure API based businesses continue to prosper.

apidays LIVE Australia 2020 - Evaluating the usability of security APIs by Dr...apidays

apidays LIVE Hong Kong - The Business of APIs by Jed Ngapidays

The document discusses lessons from building the world's largest API marketplace. It summarizes that (1) API businesses are more valuable than software/SaaS businesses, (2) APIs have become a new business model as REST APIs surpassed SOAP APIs, and (3) the growth of public APIs will continue but providers risk being trapped in a "digital ocean". It also notes that developer experience needs to improve as API discovery, access, and management are challenging due to the number and diversity of APIs.

apidays LIVE Jakarta - Better API DX with a CLI by Phil Nash, Twilioapidays

Pain Points In API Development? They’re EverywhereNordic APIs

There’s an inherent tension for organizations doing API development: how to keep both your API developers as well as your infrastructure happy, at the same time. Decoupling front-end and back-end development allows parallel development, and helps keep your front-end, middle-end, and back-end efforts working asynchronously. This speeds progress, but requires far more – and far better – collaboration to be successful. Even an independent developer working with APIs requires good collaboration tools. In this talk, Abhinav Asthana will provide tips on how to improve in API development using collaboration tools like executable API descriptions, API mock servers, and documentation. He will include specific examples of how companies (such as VMware, Coursera, and AMC Theatres) have used collaboration to attain more agile development, to onboard developers, and to ensure input from all participants/stakeholders.

Refining Your API Design - Architecture and Modeling Learning EventLaunchAny

APIs are a conversation that involves everyone, from developers to end-users and even machine-to-machine. Yet, we can miss the mark when designing an API that delivers on the desired outcomes of the end user. In this talk, James discusses the factors that ensure an API delivers value to the end user. He will explore some techniques on refining your API design before it goes live. He will also explore the challenges of microservices and why they may not be what you think they are. Along the way, we will discuss techniques that can accelerate the API design and delivery process.

More Related Content

What's hot (20)