Enterprise API deployment best practice

Enterprise API: Best Practice to create
World class API ecosystem
By
Sanjay Roy
API Ecosystem Enthusiast
A case for API management platform

Powering the API Economy
 Mobile and Cloud Computing
Have fundamentally changed the way we interact with companies we do business with. Today's
consumer and business interactions span different applications, devices and network channels.
Customers, partners and employees demand access to business services and data anytime,
anywhere or any device, from any source. API infrastructure is the key to agile and consistent
delivery of business services. Instead of building large monolithic applications, enterprises are
taking an “API First” approach to building applications. An enterprise needs an unified platform
for the delivery, management and security of APIs.
This presentation will outline different ways an Enterprise API platform can help your enterprise
deliver new business services in the new API economy

Modernize old Application interfaces
 The Challenge
Most enterprise applications were deployed before the age of mobile and cloud computing. These systems rely on
interface standard such as SOAP, XML, JMS and PL/SQL etc.
Cloud and mobile applications use lightweight, web oriented architecture, requiring interface powered by REST, JSON,
and Oauth protocols. These web oriented standards are still evolving and maturing
Backend application are often complex systems that are expensive and slow to change, and in some cases too fragile
to change
 The Solution
Utilize the API platform as an abstraction and intermediary layer to perform real-time transformation such as SOAP-to-
REST and XML-to-JSON.
Keep existing SOA (Service Oriented Architecture) interfaces as an internal interface standard to minimize changes to
back-end systems.
Let the API platform mediate interface requirements from different platform such as iOS, Android, Google.

Create Mash-Up APIs/Applications
 The Challenges
The Web is no longer just a vast information resource, it is a platform: “The Programmable Web”. Enterprises and
Services Providers make available rich APIs that you can leverage to deliver business services faster and better.
Your backend SOA services are granular and transaction centric. They need to be re-factored to create new user-
centric and device specific business application
API is the new application. You need to create new APIs quickly by combining available internal and third party
resources.
 The Solution
Use the API platform to orchestrate internal and third-party APIs to create new mash-up APIs that can power new
business services and applications. Use the API platform to re-factor backend API services and data sets to be
more user centric
Do not re-invent the wheel. Save valuable and critical enterprise time by using a robust API platform to simply the
complex process

Broker Third-Party APIs
 The Challenges
Each Open API provider, Cloud service providers and B2B partner specifies their own API protocol and security
requirement.
Existing B2B integrations are already deployed with trust relationships, certificates, and security tokens.
REST is a style, not a standard. Oauth is a loosely defined standard. Not all API coded using REST-JSON-Oauth
scheme are exactly the same
 The solution
Use the API platform to broker partner and Open APIs. Mediate both protocols and security retirements
Create Internal or customer facing APIs to abstract away differences and isolate changes from API partners.
Take API security out of the hands of your developers. Manage Third-Party API keys and tokens centrally.

Prevent Attack & Threats
 The Challenges
Cyber attacks are increasing in volume and sophistication.
Attackers are now backed by organized crime and nation states
All systems are at risk, but especially externally exposed APIs and web interfaces.
Mobile devices are inherently less secure because they run lightweight operating systems, operate over public
networks and are easily lost of stolen.
 The Solution
Use the API platform to broker partner and Open APIs. Mediate both protocols and security retirements
Create Internal or customer facing APIs to abstract away differences and isolate changes from API partners.
Take API security out of the hands of your developers. Manage Third-Party API keys and tokens centrally.
 Hacker's Heck List
 Username, Password/PIN Code, Account Number, Social Security Number
 Intellectual Property
 Personal Identifiable Information
 Organization Information
 Open ports
 Unprotected APIs
 Tokens & Non-SSL Connections

Simplify access across Business Systems
 The Challenges
Security Silos are still widely prevalent across vendor such as Oracle, IBM and Microsoft. New Cloud based services
create additional security silos.
User experience is now across multiple devices and platforms. Single-Sign-On (SSO) needs to extend to Cloud-based
services and mobile devices.
Mash-up applications and Cloud based services use third-party APIs. How can identities be propagated safely across
the network boundaries.
 The Solution
The API platform can facilitate SSO across different security silo by mediating security tokens of all types. A flexible
Security Token Service can cover different standards such as Oauth and SAML, or vendor technologies such as
Kerberos, CA and Oracle.
Securely encapsulates user identities in encrypted tokens to safeguard federation of identity across business partners.
Integrate with third-party identity providers such as Google, Facebook and Linkedin

Protect Data and Safeguard privacy
 The Challenges
Enable access to sensitive data via web, Cloud and mobile devices, for only user with appropriate access rights
Meet stringent compliance and privacy requirements to ensure proper control and monitoring of data security
Legacy backend systems cannot enforce data security policies due to lack of attribute/role/claim based access control
 The Solution
Leverage the API platform to monitor for sensitive data in he header, message, or attachment in all cloud and mobile
traffic.
Redact sensitive data on-the-wire in accordance with need-to-know policies
Implement audit, monitoring and alerts to detect non-compliance situations for remediation.

Simplify Oauth Implementation
 The Challenges
Oauth is rapidly becoming the default authorization protocol for all Cloud and mobile platforms, supported by major
Cloud service providers.
Consumers want to log in to services using their existing social and business identities from Google, Facebook, and
PayPal.
Existing identify and access management platforms have poor to no Oauth Support
 The Solution
Leverage the API platform to provide consistent Oauth implementation across all Open APIs.
Deploy Security Token Services (STS) to mediate existing tokens/Cookies/Certificates used in the backend
applications.
Leverage Oauth and JSON web tokens to simplify legacy access management technologies.

Create Targeted service offering
 The Challenges
One-size-fits-all is no longer an option. Customer and partners have choices and the barrier to switch is lower then
ever
Business services must be differentiated and targeted. Customer buy only what they need and whenever they need it.
Good user experience is mandatory. User expects application interactions to be optimized for the device and platform
of their choice.
 The Solution
Build APIs that are optimized for different platforms, channels and application types, but leverage the same backend
services
Use the API platform to control service delivery and offer differentiated services by service level and options
Monitor and analyze API usage to measure service adoption and identify business opportunities

Monitor, Track and Debug Transactions
 The Challenges
Monitor and track every API call and transaction. Raise alert when exception are detected
Quickly debug exceptions to keep business flowing and meet service level agreements.
Perform testing and monitor system response in real-time.
 The Solution
Leverage the API platform to track and record every transaction for auditing and debugging.
Make available drill-down information to quickly perform Root Cause Analysis (RCA). Capture drill-down data in
accordance with policy steps.
Enable real-time monitoring to diagnose system performance and transaction issues.

Ensure Quality of Service
 The Challenges
While cloud and mobile services are mainstream, there are still considerable concern about reliability, security and
performance.
Services that become unavailable or slow can result in loss of business and damage to the brand
APIs can go down from not only malicious attacks, but also from “friendly fire” from poorly designed API clients.
 The Solution
Measure and monitor quality of service (QoS) at the point of service delivery. The API platform can monitor quality of
service and raise alert.
The API platform can take real-time preventive or corrective actions to uphold quality of service, including traffic routing
and throttling, as well as provisioning additional API server bandwidth.
Service quality data collected by the API platform can help the enterprise analyze API usage pattern and trends, thus
helping to improve infrastructure planning and sizing.

Enforce Contract and SLA Term
 The Challenges
Differentiated service offerings can be a powerful go-to-market strategy. How do you enforce the terms of the
contract/service level agreement?
Freemium is a powerful sales model for Cloud based services. How do you ensure free customers do not overpower
your Cloud delivery infrastructure and cause service deterioration for paying customers.
Short-term promotions can be a powerful tool to let customers try new services or higher level of services. Can you
Cloud delivery platform keep pace with marketing programs
 The Solution
Use the API platform to enforce quota and meter usage of services, whether it is usage over a specific time period,
concurrent connections, or number of allowable devices
Use configurable policies to manage quota and thresholds. Delegate management of quota variables to the business
users through simple web interfaces.
Provide different options to take when a quota is reached or neared. Should the request be blocked or slowed, or just
generate an alert.

Audit, Measure Usage & Compliance
 The Challenges
Perform quantitative analysis to understand the usage behaviors of business services.
Measure and report on quality of service and compliance to Service Level Agreements (SLA).
Capture end-to-end audit data across different access points to meet compliance requirements.
 The Solution
Use the API platform to audit any required information at any point in the transaction, across all web, Mobile, API and
B2B access points.
Use an API server to measure service response at the point of service delivery. Attest to SLA compliance with real
data
Provide business level analytics to business users on what services are being used, who are using the service, when
the service are being used, and how the services are being accessed

Manage API Lifecycle
 The Challenges
API is the new application, thus rigorous lifecycle management practice must be applied.
An API's lifecycle is independent from the underlying applications. APIs often change more frequently than application
to keep pace with business requirements and client platforms.
Migration of APIs and policies between development, testing, staging, to sandbox and production environments are
handled by different teams and subject to rigorous data center change management policies
 The Solution
Leverage the API platform to centrally manage all API artifacts, including version, change logs, meta-data, policies,
and environment variables.
Use the API server to create API and policy packages to facilitate promotion and migration process.
Support distributed development of APIs and policies, but manage API lifecycles via a centralized platform.

Simplify API Adoption
 The Challenges
More often than not, backend APIs have name that are too long, too cryptic, too ambiguous.
Most backend APIs and Web Services were designed for a few B2B integration developers, not for a broader
community of developer
Existing APIs are likely designed with many options. Not all option should be exposed externally, especially for Open
APIs.
 The Solution
Use the API platform to rewrite APIs with short, easy-to-remember, and intuitive names.
Restrict API options to only what is relevant for each API developer Community.
Deploy different version of APIs, each optimized for specific business scenarios and developer communities.

Enable Community Developer Sel-Service
 The Challenges
Encourage open community developers to explore your APIs to create new customer touch points and sources of
revenue
Optimize developer experience and provide instant satisfaction with access to API resources.
Let community developer experiment with your APIs simply and efficiently
 The Solution
Deploy developer API portal to recruit community developers and enable self-service to your API resources.
Use the API server to ensure the API adoption experience is highly positive, with good API performance, availability,
security and ease-of-use.
Set up a sandbox environment where community developers can self register new applications, acquire authentication
credential, and test APIs using pre-populated test data

Super charge Internal Development
 The Challenges
Create a “hacking” culture for internal development teams to spur technology and business innovation.
Enable developers to simple access to backend capabilities that are ready for mash-up and experimentation.
Provide developers with technology that can meet the latest Cloud and mobile platform requirements.
 The Solution
Deploy internal developer portals to enable access to core business capabilities and promote collaboration.
Use the API server to package backend services and data into granular API packages that can serve as building
blocks to innovate business services.
Use the API platform to provide all required supportive services such as security, lifecycle management, and testing,
so developer spend more time on innovation and less time on re-inventing the wheel.

Manage API client Lifecycle
 The Challenges
Not all API clients are created equal. Clients can range from public mobile apps, to partner B2B systems, to internal
applications.
API client lifecycle needs to be carefully managed from on-boarding, to production, to end-of-life.
API client access and service level need to be controlled in accordance with policy and business terms.
 The Solution
Use the API platform as an API client registry, including organization, user, application, and device entities
Define authentication, authorization, and service level policies for each class of API clients.
Define lifecycle events and automate transitions between lifecycle stages. This ensures the appropriate level of access
and support is provided to each API client throughout its lifecycle

Automate Partner/Application Promotion
 The Challenges
Onboarding a partner can be a lengthy process that involves many non-IT related steps.
Once a community developer is ready to become a partner, a process must be initiated and followed to complete the
onboarding/promotion process.
Onboarding processes are typically implemented in CRM applications such as Salesforce.com and Siebel.
 The Solution
Use the API platform to automate the initiation of promotion and onboarding process.
Configure the API server to call the CRM APIs to initiate the task flow and provide the necessary data. Extract process
updates and report progress on the partner portal.
Once the CRM process is completed, automate the transition of the new partner and application from the open
sandbox environment to production environment.

Enterprise API deployment best practice

Recommended

More Related Content

What's hot (20)

Viewers also liked (13)

Similar to Enterprise API deployment best practice (20)

Recently uploaded (20)

Enterprise API deployment best practice