The world is becoming more digital, intelligent and connected — and the driving force behind all of this are APIs, or application programming interfaces. APIs are not a new phenomenon. Developers have been using APIs as a building block for their applications and solutions for years. However, with the inception of things like agile, Internet of Things, mobile and microservices, APIs are becoming more important than ever.

“Certainly the API economy is only just beginning to emerge, and the hype around it is still growing as digital strategies and the pervasive use of the Internet of Things (IoT) unfold. An organization’s API strategy underpins its digital strategy — and is a sizable portion of it — so engaging with the API economy is an integral part of any digital strategy,” Gartner wrote in its Magic Quadrant for full life cycle API management.

RELATED CONTENT: Why should development teams choose your API management solution?

In order to effectively and successfully deploy, manage and run an API program as well as gain value from the API economy, organizations need a proper API management solution.

“APIs have been around forever. It is how all applications have interacted with other services. What has changed is as the app economy has grown, and APIs have become more prevalent in the app economy, the need for how do you secure them, manage them, set policies and control them is becoming more apparent,” said Bill Oakes, director of product marketing for CA API management. “The only way you can do that effectively, and that is the keyword is effectively, is through API management.”

Assembling a successful API management strategy
Today’s app economy is very different from the one the industry saw itself in during the early 2000s. According to CA’s Oakes, up until about 2010, the architecture used to allow things to interoperate at the enterprise level was a service-oriented architecture (SOA). When Apple introduced the App Store nine years ago, all of a sudden everyone wanted to build applications, and instead of creating huge monolithic applications they wanted to do it in a way that fit on mobile devices, Oakes explained.

“A lot of the apps you are using today used to be corporate apps that defined who got what where, when and how. Nowadays it is basically you better give me the information I need to do my job on this device. The user is in control,” Oakes said. “The whole paradigm of who is in control has shifted, and all that is due to the app economy, which is being driven by APIs. That is only going to get bigger over the next few years.”

To keep up with this evolution, the definition of API management has had to advance and expand overtime as well. Over the past 12 to 18 months there has really been an extension of what API management actually means, according to David Chiu, director of product marketing for CA API Management.

In fact, Gartner use to refer to full cycle API management as application services governance, but decided to replace this term in its 2016 Magic Quadrant to reflect the ongoing API growth.

API management has gone from being primarily about security to encompass planning, designing, implementing, publishing, operating, consuming, maintaining and retiring APIs, Chiu explained.

“Most organizations recognize that adding APIs to your enterprise introduces risks in some areas, but it also creates a lot of opportunities,” said Ian Goldsmith, vice president of Akana product management at Rogue Wave Software. “What an API management solution does is it helps you speed up your ability to take advantage of the opportunity while mitigating a lot of the risks.”

The two main risks APIs present to a business include security, and being too successful. According to Goldsmith, when you create an API that provides direct access into your systems, you have to make sure that the API is really secured. To do that, you need access control auditing, logging, traffic management, and a way to ensure you are complying with regulations.

One you publish an API, the hope is that the API will become really popular. This will drive new business, which will drive more traffic to your back-end system, according to Goldsmith. Development teams have to make sure their back-end systems are ready to handle all the traffic, so they need performance monitoring in order to understand how the API is being used, who is using them, how it can be optimized, and how to prepare for spikes and new loads. “All of these things are where a good API management platform comes in,” Goldsmith said.

According to CA’s Oakes, there are four distinct elements necessary for a good API management strategy: Alignment and usefulness, engagement and usability, scalability and evolvability, and manageability and security.

Alignment and usefulness ensure the APIs being implementing are actually the APIs the team really wants. “You have to have some kind of intelligent digital initiative where the APIs are giving you value. That means they have to be closely aligned with the objectives of the enterprise and overall strategy as well as do something for the end users,” Oakes said.

Engagement and usability get partners and developers to integrate APIs into their solution. “This means you have to have a developer program. You have to have design principles for not only the API, but also the design and developer experience,” Oakes said. In addition, the program should include documentation on how the API works as well as code generation tools and code samples.

Scalability and evolvability involves future-proofing your work, according to Oakes. APIs will continue to change and adapt overtime to meet change and demands, and a API management strategy should ensure you are on the right path, he explained.

And finally, manageability and security is perhaps the most important element to any good strategy, according to Oakes. “To really secure and manage your API platform, you have to have API analytics and monitoring. You have to have a security and identity model in place, and you need a management platform,” Oakes said.

In addition to those four elements, Rogue Wave’s Goldsmith explained an API management solution should include a gateway and a developer portal. A gateway sits in front of your APIs to provide a secure interface that users can access and make proxy API calls. The developer portal provides a place where API developers can go build and create documentation against their APIs as well as find APIs and request access to browsers. “And then as a thread running through all of that is the ability for both the app developers and the API developers to view traffic, look at logs, understand patterns, and provide analysis around the use of the API and how a developer apps are using it. All of that comes together because it is collected by the gateway and displayed to the developers via the portal,” said Goldsmith.

Other best practices include understanding the scenarios you expect to drive your APIs through, and understand the technologies that are going to be at play, according to Goldsmith.

Goldsmith also noted APIs don’t require organizations to purchase an API management solution per se, but without one it would be very difficult to encompass all of the necessary capabilities.

“It doesn’t make any sense to try to build those capabilities natively into your applications because you will have to duplicate them again and again for every single API you build. Buying an API management solution that deliver all those capabilities helps the organization take advantage of that as a centralized service of the enterprise,” he said.

What happens when you don’t have a good API management strategy in place
Last year, the application Pokémon Go took the mobile industry by storm. With its geolocation knowledge, augmented reality features and popular concept, it changed how mobile games are expected to behave. But while it was all fun and games for the players, the company Niantic faced some difficulty on the API side. Niantic used APIs to allow users to go and hunt Pokémon in their locations. According to CA’s Oakes, the company tried to hide the API, but did not secure it or put any type of policy engine in front of it. The problem with this is that people on the Internet are smart and they were able to very quickly reverse engineer the API and basically cheat the system to find the most desired characters. “What that did is put massive load on Niantic’s servers, which in turn created user experience issues and caused individual systems to crash all because they didn’t protect the API or didn’t put anything in place to make sure that didn’t happen,” said Oakes. “The whole idea of how do you make sure that endpoints are really who they are, and the right users on the right devices get access to the right data is only effective and possible through API management.”

Driving forces behind APIs
There are three classes API development fits into, according to Rogue Wave’s Goldsmith. They include:

  • Internal application integration: The next generation of service oriented architecture. This area encapsulates microservices to an extent.
  • B2B: Or partner enablement. “If you need to find a way to help onboard partners more rapidly, or allow partners to more rapidly use your technologies, APIs are a great solution,” said Goldsmith.
  • External development: External development is what people tend to think of as the more traditional API space. Here you publish a set of APIs for anyone to use, and people create innovative and new solutions around your core capabilities using APIs.

According to CA’s Oakes, while the mobile and IoT trends will continue to move the API industry forward, the hottest trend right now is microservices because everyone is trying to roll out high quality and secure solutions quickly.

CA’s Chiu explained the mobile and IoT wave actually goes hand in hand with microservices because organizations are trying to cut down the effort it takes to create integrations, and make them secure and scalable. Organizations are modernizing their systems using microservices and APIs to become more agile, Chiu explained. “Organizations are taking their monolithic applications, their conventional SOA services, and breaking them down into smaller, more agile microservices. They are doing that because once the applications are broken down, it becomes easier to align with their agile initiatives,” he said. “There are a variety of reasons why there is a modernization trend going on, but the best practice everyone is doing is using API management and microservices to transition the life of an architecture into something that is more applicable for today’s apps, IoT projects and mobility.”

A full guide to API management tools is available here.