Director, API Architecture
WSO2 API Manager: Why, What, How,
and What's Next
Nuwan Dias
Why do you need
API Management?
Image source: blog.dailysteak.co
APIs are essential to address the problem of
app explosion
● Demand for consumption is on the rise. (easier/convenient
ways to consume information and services).
● Demand for consumption is driving digital transformation.
● Digital transformation creates opportunity for $$.
● APIs are the key to enabling digital transformation.
What do you need from an API Management
System?
1. Creating and publishing APIs.
2. API security and rate limiting.
3. Platform for discovering, searching and consuming APIs.
4. API governance and lifecycle management.
5. API analytics, specialization and evolution.
Maslow’s hierarchy of needs
Image source: verywellmind.com
What do you need from an API Management
System?
1. Creating and publishing APIs. - Physiological needs.
2. API security and rate limiting. - Safety needs.
3. Platform for discovering, searching and consuming APIs -
Love and belonging needs.
4. API governance and lifecycle management. - Esteem needs.
5. API analytics, specialization and evolution - Self actualization
needs.
Creating and
publishing APIs
Defining the contract
between the API
provider and the API
consumers - The API
developer portal.
API Design - Import Definition
API Design - Start new
API Design - Resource Definition
API Documentation
API Publishing
API Security and
Rate Limiting
Allow verified,
permitted and
controlled access into
your assets - API
Gateways.
API Gateways: The enforcement point of all
policies
API Security
● Trusted Sub-systems
○ Mutual TLS
○ Basic Authentication
● Delegated Authentication
○ OAuth2.0
● Authorization
○ OAuth2.0 Scopes
○ OIDC
○ XACML
● CORS
Authentication: OAuth2.0 Grant Types
Federated Authentication
Authorization
XACML
Rate Limiting
● Quotas: for monetization
○ By number of requests or bytes
● Fair usage policy
● Entry point control rules
● Protection from over usage
● Custom policies
API Consumption
The need for APIs to
be easily discoverable,
searchable and
consumable - The app
developer portal.
API Discovery: Registry of APIs
● Paginated listing of APIs
● Tags
● Groups
API Searching
Application Management
Consuming the API
● API documentation
● API testing
● SDKs
● Developer tooltips
API Governance and
Lifecycle
Management
Formalizing the
evolution of APIs and
assurance of
standards and
practices.
API Versioning
● Different version formats.
● Backwards compatibility and transitioning of apps to use the
latest and greatest version.
● Running multiple versions in parallel.
● Deep copy of documents and policies
● Transitioning current subscribers to latest version
● Notifying current subscribers.
Declaration and execution of custom defined
API lifecycles.
Execution of custom defined workflows for..
● API state transitions
● Developer onboarding
● Application registration
● API subscriptions
● Generation of application keys
Tooling for automation of CI/CD processes
API Analytics and
specialization
● Observing and
reacting to
abnormalities and
trends.
● Optimizing the value
chain of APIs by
specializing and
scaling.
API Analytics: Business Insights
● Business performance
● New opportunities
● Expansions
● Promotions
● EOLs
● Achievers
● Laggards
API Analytics: Operational
● Performance metrics
● Abnormalities
● Trends
● Tracing
● Debugging
● Alerting
Specialization and evolution of APIs
● Different API types
○ SOAP APIs
○ gRPC APIs
○ Websockets
○ Event streams
● API gateways evolving into microgateways
Whats Next?
How do we address
the trillion endpoints
problem?
The trillion endpoints problem
What’s Next?
● Developer first APIs and microgateways.
● Integration with service mesh technologies.
● Dynamic service discovery: etcd, consul, etc.
● Dynamic APIs: Short lived APIs that adapt and evolve or die.
● Serverless API gateways.
● API Management for event driven architectures.
● Embedded/Native API management on large scale-cloud
infrastructures.
THANK YOU
wso2.com

[WSO2Con EU 2018] WSO2 API Manager - Why, What, How, and What's Next

  • 1.
    Director, API Architecture WSO2API Manager: Why, What, How, and What's Next Nuwan Dias
  • 2.
    Why do youneed API Management? Image source: blog.dailysteak.co
  • 3.
    APIs are essentialto address the problem of app explosion ● Demand for consumption is on the rise. (easier/convenient ways to consume information and services). ● Demand for consumption is driving digital transformation. ● Digital transformation creates opportunity for $$. ● APIs are the key to enabling digital transformation.
  • 4.
    What do youneed from an API Management System? 1. Creating and publishing APIs. 2. API security and rate limiting. 3. Platform for discovering, searching and consuming APIs. 4. API governance and lifecycle management. 5. API analytics, specialization and evolution.
  • 5.
    Maslow’s hierarchy ofneeds Image source: verywellmind.com
  • 6.
    What do youneed from an API Management System? 1. Creating and publishing APIs. - Physiological needs. 2. API security and rate limiting. - Safety needs. 3. Platform for discovering, searching and consuming APIs - Love and belonging needs. 4. API governance and lifecycle management. - Esteem needs. 5. API analytics, specialization and evolution - Self actualization needs.
  • 7.
    Creating and publishing APIs Definingthe contract between the API provider and the API consumers - The API developer portal.
  • 8.
    API Design -Import Definition
  • 9.
    API Design -Start new
  • 10.
    API Design -Resource Definition
  • 11.
  • 12.
  • 13.
    API Security and RateLimiting Allow verified, permitted and controlled access into your assets - API Gateways.
  • 14.
    API Gateways: Theenforcement point of all policies
  • 15.
    API Security ● TrustedSub-systems ○ Mutual TLS ○ Basic Authentication ● Delegated Authentication ○ OAuth2.0 ● Authorization ○ OAuth2.0 Scopes ○ OIDC ○ XACML ● CORS
  • 16.
  • 17.
  • 18.
  • 19.
    Rate Limiting ● Quotas:for monetization ○ By number of requests or bytes ● Fair usage policy ● Entry point control rules ● Protection from over usage ● Custom policies
  • 20.
    API Consumption The needfor APIs to be easily discoverable, searchable and consumable - The app developer portal.
  • 21.
    API Discovery: Registryof APIs ● Paginated listing of APIs ● Tags ● Groups
  • 22.
  • 23.
  • 24.
    Consuming the API ●API documentation ● API testing ● SDKs ● Developer tooltips
  • 25.
    API Governance and Lifecycle Management Formalizingthe evolution of APIs and assurance of standards and practices.
  • 26.
    API Versioning ● Differentversion formats. ● Backwards compatibility and transitioning of apps to use the latest and greatest version. ● Running multiple versions in parallel. ● Deep copy of documents and policies ● Transitioning current subscribers to latest version ● Notifying current subscribers.
  • 27.
    Declaration and executionof custom defined API lifecycles.
  • 28.
    Execution of customdefined workflows for.. ● API state transitions ● Developer onboarding ● Application registration ● API subscriptions ● Generation of application keys
  • 29.
    Tooling for automationof CI/CD processes
  • 30.
    API Analytics and specialization ●Observing and reacting to abnormalities and trends. ● Optimizing the value chain of APIs by specializing and scaling.
  • 31.
    API Analytics: BusinessInsights ● Business performance ● New opportunities ● Expansions ● Promotions ● EOLs ● Achievers ● Laggards
  • 32.
    API Analytics: Operational ●Performance metrics ● Abnormalities ● Trends ● Tracing ● Debugging ● Alerting
  • 33.
    Specialization and evolutionof APIs ● Different API types ○ SOAP APIs ○ gRPC APIs ○ Websockets ○ Event streams ● API gateways evolving into microgateways
  • 34.
    Whats Next? How dowe address the trillion endpoints problem?
  • 35.
  • 36.
    What’s Next? ● Developerfirst APIs and microgateways. ● Integration with service mesh technologies. ● Dynamic service discovery: etcd, consul, etc. ● Dynamic APIs: Short lived APIs that adapt and evolve or die. ● Serverless API gateways. ● API Management for event driven architectures. ● Embedded/Native API management on large scale-cloud infrastructures.
  • 37.