Welcome!

Microservices Expo Authors: Carmen Gonzalez, Elizabeth White, Liz McMillan, Yeshim Deniz, Reinhard Brandstädter

Related Topics: @CloudExpo, Java IoT, Microservices Expo, Linux Containers, Containers Expo Blog, @BigDataExpo

@CloudExpo: Article

APIs: A Soup to Nuts Analysis

Your APIs are doorways into your business systems

APIs are transforming businesses to extend the reach of their information systems and data. In technical terms, APIs are rather finite, allowing two software applications to exchange data and execute procedures. Yet their business impact is so great that API management requires a far from finite thought process. A "soup to nuts" approach is needed to help companies determine how to achieve the most business success with APIs.

An API enables applications to access back-end systems using lightweight, standards-based protocols such as REST and JSON. For example, if you were in food distribution, the actual business of soup and nuts, you could develop an API that lets mobile app developers tap directly into your ERP system. They could build consumer apps for recipes that showed ingredients that you had in stock. Grocery stores could build apps that gave their shoppers bulk discounts on large orders and so forth. The API extends your food distribution business into customer realms where you've never played before. This is fantastic. But it also presents a number of challenges to the management of the business.

An API Is a Product
Whether you like it or not, your API is basically a software product. It should be managed like one. As external parties connect with your API, they will reasonably expect the kind of professional communication and seamless updates that they would find with any web-based software business. If you are a mobile app developer who is accustomed to tapping into Amazon.com's API or any number of comparable interfaces, you will expect the same kind of experience when you connect with a corporate API.

Perhaps more significantly, the API represents an investment of resources. As such, it should serve a well-thought-out and thorough business strategy just like any software product. This means managing its lifecycle. The software lifecycle starts with planning, continues through development and operation, and ends with retirement and replacement. Ideally each phase of the lifecycle should be managed and monitored for optimal results. Certainly better API lifecycle management will foster more satisfied developers and partner communities.

Planning and Building Your APIs
Sometimes an API just is. Someone in the IT department created it for some reason that has since been forgotten, and there it is. It may or may not be great, but you have it. Should you use it "as is" or wait? This is more common than you might imagine. If you are approaching your APIs as if they were products, you would wait and work through a plan first. You have to get together with business and technology stakeholders and determine the business purpose of the APIs that you will be building. Now, this begs the question: Who exactly is this "you" we are referring to? That is one of your first planning challenges. Who is going to own the API business products that will extend the business into new spheres? So first you have to figure out who owns the API, and often it will be a collection of people that represent different parts of a business. Then the next planning task is to understand the cost/benefit outcomes for the business and intended users.

Chances are there will be more than one API developed and within each API there will be a host of different features to be developed. You will have to devise a priority for the rollout of new features. For instance, with the recipe app, the first release of the API might include simple searching and browsing. The second release might enable users to order products for delivery. The third release could let users pay for orders with credits cards and so forth. Not all of these features can be perfected at once.

Once the API is up, the organization has to be in place to support it. It is necessary to think through the empty seats that might need to be filled so that users of your API will feel as if they are connected to a responsive, living business. For example, if you are planning to invite developers from Europe to connect with your API, you need to have a technical point of contact for them as well as documentation that will be meaningful to them, perhaps translated into different languages. You will have to structure your business to support and manage the API.

Running the API: Protect, Secure, Manage
Your APIs are doorways into your business systems. That's great, but it is also a bit scary. APIs need strong, coherent security and management. If you have a handful of APIs, you will be able to stay on top of their availability, security and provisioning by hand. As your API program grows and it will if you are doing it right, you will likely find that using an API platform becomes a best practice - simply because it can take care of the serious work of API management. Effectively running an API through a platform involves the following:

  • Support non-functional requirements - These include message protocol handling, security policy, authentication and authorization, etc.
  • Manage provisioning and access control for apps - This means the selective provisioning of API access. Corporate APIs are not like their consumer counterparts where you want millions of users. With a corporate API, controlled access is where the users are the most valuable, not the most numerous. The API platform should enable selective provisioning that is still highly automated and light in terms of administrative load. Unfettered usage can bring a host of problems. Traffic and load management can get strained. Worse is the possible need to add extra server instances of costly business software just to satisfy API-driven demand. If the increased load is not generating revenue, satisfying it with more instances will be a waste of money.
  • Monetization and control - An API might be a profit center itself. For example, a food distribution company API could be monetized from selling access to data about sales trends in the food industry. This scenario requires the ability to license access to the API.
  • Provide API monitoring - APIs are just like any other piece of enterprise IT that is monitored for its system health, response times, and availability. In some cases, uptime may not be a big issue. However when your customers and partners are connecting to an API, you will want to know whether it is up, down, or running slowly. The API platform should provide monitoring functionality as well as failover for APIs that go down.

Sharing Your APIs: Publish, Support, Syndicate
APIs succeed when they are shared. The API platform can help create a marketplace where developers can discover your APIs and request permission to use them. The marketplace can be internal to your company or set up for external relationships. Whether it is a developer portal or something comparable, the platform should provide the below sharing functionality:

  • Enable you to interact with and recognize your API developers. In some cases, this process can be set up on a self-service basis to allow it to scale without a major resource investment on your part.
  • Facilitate the creation of great documentation about your API and how to use it.
  • Make testing against your API as easy as possible.
  • Monetize your API to assist in future cost benefit analysis.

Analyze Your API Program: Measure, Report, Iterate
Measurement of program results is in the DNA of most good IT managers. The API platform can help make this process as simple as possible. You will likely want to measure and report on the success of your program across the whole API lifecycle. Lifecycle and results are usually linked. For instance, if you see adoption of the recipe API rise as new features are added and new versions are introduced, that is an important finding to determine the payoff of earlier investments in the program and guide future direction. The right API measuring tools can help you drive improvement back into the planning stage. It is a never-ending cycle.

The Platform Approach to API Lifecycle Management
The execution of an API program that manages APIs like products across their full lifecycles requires a combination of organization and technology. The technology alone cannot make it happen. The organization cannot do it alone without the proper tools. In our experience working with many large enterprises, the best practice is to match the API owners with a platform approach to lifecycle management. The platform can be a complete offering, such as our own SOA Software API Management Solution, or it can be built in a variety of other ways. What's important is to recognize that the people, process and platform need to work together to effect comprehensive API lifecycle management. This will ensure the success of the API program.

Lifecycle Management
Ideally lifecycle management will be baked into the structure of the platform tooling, allowing for automated approvals and workflow for each stage of the API lifecycle. This means having the ability to align work streams related to API lifecycle, such as costing, product management, documentation and legal. People involved in running the API program can thus work together efficiently. The API development capability itself should have API modeling, templates, versioning and change management, and impact analysis. These features serve the goal of managing the full API lifecycle without an untenable resource investment.

Gateway
API management typically works using a proxy that can be managed and monitored more easily than the API itself. For multiple APIs, the best approach is a "gateway" or collective proxy with added integration and mediation capabilities including:

  • Process Composition/Orchestration.
  • Security, including AU/AZ, attack prevention, and protecting your systems from abuse.
  • Caching and paging.
  • Supporting multiple mobile app platforms.
  • Managing quality of service (QoS).

Community
Exposing APIs to your systems involves building a community. Developers whom you don't know will be writing code to access your data through APIs. For the process to work, they need to feel as if they are connecting with real people. This can be achieved in part with self-service and automation and actual human involvement. A developer portal is essential for the following functions:

  • Self-service community to promote innovation and lower support costs.
  • Interactive documentation to increase adoption and encourage experimentation with your APIs.
  • App provisioning so you can gain visibility and control over the apps that are hitting your APIs.
  • Integrated testing to speed up learning.
  • Analytics to provide feedback and measure success.

Getting There
You have your soup. You want the nuts. There is a path to dessert. However all this requires a mature and profitable API program. Our recommendation is to think about what you want to accomplish with APIs from the vantage points of productization and lifecycle. Building APIs puts you into the business of creating software products. While you may not see the API as a product, it is one. And, like any software product, it needs to be managed across its entire lifecycle. From planning through running and sharing, the API has to be monitored and secured. The work of managing it needs to be handled efficiently so that the program can be financially and strategically beneficial to the business. The best practice to ensure all of these outcomes is to use an API management platform to automate the handling of all of your APIs as they progress across their lifecycles. That will get you the nuts. The alternative is to go nuts, and that's not what anyone wants.

More Stories By Alistair Farquharson, CTO, SOA Software

Alistair Farquharson is a visionary industry veteran focused on using disruptive technologies to drive business growth and improve efficiency and agility within organizations. As the CTO of SOA Software Alistair is helping to shape and mature the enterprise API and SOA industry. Alistair is responsible for product strategy and development for this leading Enterprise API and SOA Governance company. He spends a great deal of time and energy shaping customer and industry direction with regular conference keynote appearances, discussions with customers, and even the occasional foray into writing code. Alistair has been at the forefront of many technology waves from enterprise web architecture, through web services and SOA, and now into APIs. His expertise spans a wide range of technologies and businesses, and he brings a unique global focus to everything he does.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@MicroservicesExpo Stories
Join us at Cloud Expo | @ThingsExpo 2016 – June 7-9 at the Javits Center in New York City and November 1-3 at the Santa Clara Convention Center in Santa Clara, CA – and deliver your unique message in a way that is striking and unforgettable by taking advantage of SYS-CON's unmatched high-impact, result-driven event / media packages.
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
18th Cloud Expo, taking place June 7-9, 2016, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises are using some...
SoftLayer operates a global cloud infrastructure platform built for Internet scale. With a global footprint of data centers and network points of presence, SoftLayer provides infrastructure as a service to leading-edge customers ranging from Web startups to global enterprises. SoftLayer's modular architecture, full-featured API, and sophisticated automation provide unparalleled performance and control. Its flexible unified platform seamlessly spans physical and virtual devices linked via a world...
SYS-CON Events announced today that BMC Software has been named "Siver Sponsor" of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. BMC is a global leader in innovative software solutions that help businesses transform into digital enterprises for the ultimate competitive advantage. BMC Digital Enterprise Management is a set of innovative IT solutions designed to make digital business fast, seamless, and optimized from mainframe to mo...
SYS-CON Events announced today that Tintri Inc., a leading producer of VM-aware storage (VAS) for virtualization and cloud environments, will exhibit at the 18th International CloudExpo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that Isomorphic Software will exhibit at SYS-CON's [email protected] at Cloud Expo New York, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Isomorphic Software provides the SmartClient HTML5/AJAX platform, the most advanced technology for building rich, high-productivity enterprise web applications for any device. SmartClient couples the industry’s broadest, deepest UI component set with a java server framework to deliver an end-...
SYS-CON Events announced today the Docker Meets Kubernetes – Intro into the Kubernetes World, being held June 9, 2016, in conjunction with 18th Cloud Expo | @ThingsExpo, at the Javits Center in New York, NY. Register for 'Docker Meets Kubernetes Workshop' Here! This workshop led by Sebastian Scheele, co-founder of Loodse, introduces participants to Kubernetes (container orchestration). Through a combination of instructor-led presentations, demonstrations, and hands-on labs, participants learn ...
Just last week a senior Hybris consultant shared the story of a customer engagement on which he was working. This customer had problems, serious problems. We’re talking about response times far beyond the most liberal acceptable standard. They were unable to solve the issue in their eCommerce platform – specifically Hybris. Although the eCommerce project was delivered by a system integrator / implementation partner, the vendor still gets involved when things go really wrong. After all, the vendo...
SYS-CON Events announced today that AppNeta, the leader in performance insight for business-critical web applications, will exhibit and present at SYS-CON's @DevOpsSummit at Cloud Expo New York, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. AppNeta is the only application performance monitoring (APM) company to provide solutions for all applications – applications you develop internally, business-critical SaaS applications you use and the networks that deli...
SYS-CON Events announced today that EastBanc Technologies will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. EastBanc Technologies has been working at the frontier of technology since 1999. Today, the firm provides full-lifecycle software development delivering flexible technology solutions that seamlessly integrate with existing systems – whether on premise or cloud. EastBanc Technologies partners with p...
The initial debate is over: Any enterprise with a serious commitment to IT is migrating to the cloud. But things are not so simple. There is a complex mix of on-premises, colocated, and public-cloud deployments. In this power panel at 18th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists will look at the present state of cloud from the C-level view, and how great companies and rock star executives can use cloud computing to meet their most ambitious and disruptive business ...
Many banks and financial institutions are experimenting with containers in development environments, but when will they move into production? Containers are seen as the key to achieving the ultimate in information technology flexibility and agility. Containers work on both public and private clouds, and make it easy to build and deploy applications. The challenge for regulated industries is the cost and complexity of container security compliance. VM security compliance is already challenging, ...
Agile teams report the lowest rate of measuring non-functional requirements. What does this mean for the evolution of quality in this era of Continuous Everything? To explore how the rise of SDLC acceleration trends such as Agile, DevOps, and Continuous Delivery are impacting software quality, Parasoft conducted a survey about measuring and monitoring non-functional requirements (NFRs). Here's a glimpse at what we discovered and what it means for the evolution of quality in this era of Continuo...
Last week I had the pleasure of speaking on a panel at Sapphire Ventures Next-Gen Tech Stack Forum in San Francisco. Obviously, I was excited to join the discussion, but as a participant the event crystallized not only where the larger software development market is relative to microservices, container technologies (like Docker), continuous integration and deployment; but also provided insight into where DevOps is heading in the coming years.
In the rush to compete in the digital age, a successful digital transformation is essential, but many organizations are setting themselves up for failure. There’s a common misconception that the process is just about technology, but it’s not. It’s about your business. It shouldn’t be treated as an isolated IT project; it should be driven by business needs with the committed involvement of a range of stakeholders.
You might already know them from theagileadmin.com, but let me introduce you to two of the leading minds in the Rugged DevOps movement: James Wickett and Ernest Mueller. Both James and Ernest are active leaders in the DevOps space, in addition to helping organize events such as DevOpsDays Austinand LASCON. Our conversation covered a lot of bases from the founding of Rugged DevOps to aligning organizational silos to lessons learned from W. Edwards Demings.
As AT&Ts VP of Domain 2.0 architecture writes one aspect of their Domain 2.0 strategy is a goal to embrace a Microservices Application Architecture. One page 9 they describe how these envisage them fitting into the ECOMP architecture: "The initial steps of the recipes include a homing and placement task using constraints specified in the requests. ‘Homing and Placement' are micro-services involving orchestration, inventory, and controllers responsible for infrastructure, network, and applicati...
Application development and delivery methods have undergone radical changes in recent years to improve scalability and resiliency. Container images are the new build and deployment artifacts that are used to ship and run software. While startups have long been comfortable experimenting with and embracing new technologies, even large enterprises are now re-architecting their software systems so that they can benefit from container-enabled micro services architectures. With the launch of DC/OS, w...
SYS-CON Events announced today that Alert Logic, Inc., the leading provider of Security-as-a-Service solutions for the cloud, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Alert Logic, Inc., provides Security-as-a-Service for on-premises, cloud, and hybrid infrastructures, delivering deep security insight and continuous protection for customers at a lower cost than traditional security solutions. Ful...