Choosing The Right Api MGMT White Paper
Choosing The Right Api MGMT White Paper
Choosing The Right Api MGMT White Paper
But no matter what type of API an enterprise wants to expose, it will need an API Management
solution that can address some basic functional areas:
• API Lifecycle Management—Enterprises need a way to ensure API updates do not break when
they upgrade/version APIs or move between environments, geographies, datacenters and the
cloud.
• API Governance—Enterprises need a way to control and track the broader operational
character of how APIs get exposed to different partners and developers, through policy
characteristics like metering, SLA, availability and performance.
• API Monetization—For some enterprises, publishing APIs is not enough. APIs also represent a
new revenue opportunity. Different API Management solutions enable monetization to different
degrees.
For enterprises, addressing these functional requirements is non-negotiable. However, along with
these functional requirements, an enterprise will expect its API Management solution to deliver
certain operational characteristics relevant to its unique IT experience.
• Solution Security—Since API Management solutions get deployed in the DMZ, enterprises will
also need robust IT-class API solutions that can meet a range of security requirements, from
penetration protection to PCI compliance to FIPS to HSM support for API key security.
This white paper examines these different functional and operational requirements, to give
IT managers, Web managers and enterprise architects key information for selecting an API
Management solution.
4 • WHITE PAPER • CHOOSING THE RIGHT API MANAGEMENT SOLUTION FOR THE ENTERPRISE USER broadcom.com
• Support different “resource” authorization schemes including federated ones like OAuth and SAML
For enterprises this challenge is compounded by the need to integrate with existing identity
infrastructure. Therefore, the overarching goal is to achieve both flexibility and integration. In policy
there should be an ability to support different kinds of access tokens and even move from one kind
of developer API key to another, without touching code. The solution should be able to support
a wide range of OAuth and OpenID Connect schemes (given these are the standards for mobile
security and APIs) but also handle a variety of OAuth styles like HMAC and combinations with
enterprise standards like SAML. Of course, the API Management solution also needs to work with
pre-existing identity investments from companies like Oracle, IBM, CA and RSA.
However, API security doesn’t stop at access control. APIs provide the programmatic window
into your data. For that reason, an enterprise-class API Management solution will need to give the
enterprise architect or security administrator fine-grained control over what data get exposed,
how this information is kept confidential and how its transmission can be guaranteed against
interception or tampering.
Lastly, API security rests on the integrity of both the API and the data/functionality it exposes. This
requires an ability to ensure APIs are not compromised by attack, denial of service or misuse. A
good API Management solution will equip its operator with a wealth of threat protection controls
that will assure the availability and fidelity of the API and the communications it enables.
A fully-functional API Management solution should also be able to accommodate multiple versions
in production simultaneously, either to accommodate older clients or to accommodate different
access technologies like SOAP, REST and JSON.
However, a lifecycle management framework that can only accommodate localized development
will not meet the needs of most modern enterprises. With the growing importance of the cloud,
both public and private, enterprises will require an API Management solution that can span testing
and production in the cloud. This will require an ability to isolate API developers from the vagaries
of network idiosyncrasies and topology.
API Governance
Governance is a broad term often used to capture a wide range of management, process and
visibility requirements. It defines the terms and conditions under which an API is exposed to one
or more consumers. While “governance” encompasses security and lifecycle concepts, it also
articulates various SLA, monitoring and reporting requirements. Furthermore, in the case of API
Management solutions, it is relevant to the broader imperative of enabling differentiated terms and
conditions for sharing API data and functionality to different consumers based on their identity,
capability, subscription level or other transactional context that can be defined in policy.
Effective API governance is all about flexibility. The technology for controlling how APIs get shared
should follow the preferences and processes of the enterprise and not the other way around. This
means that an API Management solution should be configurable around any SLA, security, log
or other control using policy. Policy is at the heart of flexibility and assures consistency from one
implementation to the next. API Management solutions that constrain administrators to course-
grained controls without a full policy IDE limit what can be governed and how it can be controlled.
Deployment Flexibility
Most enterprises have an en existing infrastructure designed to complement the way they do
business. As the enterprise moves towards an API Management solution, they should evaluate
solutions that “plug in” to their existing environment. Architecture teams should be able to manage
this solution as an extension of their infrastructure, rather than as a separate environment.
For more information on this level of integration, please read “An Architectect’s Guide for Extending
your ESB/SOA Environment to Mobile, Cloud, and IoT Solution Brief”.
• Support different classes of external developers (e.g. the publisher should be able to attribute
different rights to partner developers and public developers).
• Provide various self-service capabilities (e.g. subscription levels and rate plans).
• Give developers visibility into their API usage and key performance metrics (e.g. response time).
• Allow developers to share best practices through community features (e.g. a forum)
• Provide easily consumable mobile APIs (including for OAuth and OpenID ConnecT)
Since different enterprises will come to API publishing with different experiences and priorities, a
one-size-fits-all API portal approach will be no more attractive than a one-size-fits-all API security,
lifecycle and governance framework. For this reason, many enterprises will want to consider a
decomposable API portal.
This could mean a white-label portal that can be customized to suit a particular developer
engagement strategy. It could also mean an API portal that can be consumed as discrete
components by a pre-existing enterprise developer portal. Again, flexibility is the watchword.
API Monetization
Related to the idea of developer enablement is the concept of monetization. While many
enterprises will want to foster adoption by allowing free access to their Web and mobile APIs,
others will want to offer pay-per-use options for higher tiers of access. Again, there is no single
right way of approaching the monetization problem. Some options are:
• A “freemium” model where usage below a certain threshold of data transmission or client
requests is free
• Charging for specific levels of service guarantee or for priority over free users
Regardless of which approach is taken, the API Management solution should be sophisticated
enough to give an enterprise flexibility in how it sets up its revenue criteria. The solution should
be able to:
• Provide advanced SLA and Class of Service capabilities, allowing for traffic prioritization
• Compose virtual pay-only APIs that could be isolated for paying customers, without coding
7 • WHITE PAPER • PROTECTING YOUR APIS AGAINST ATTACK AND HIJACK broadcom.com
Solution Manageability
Unlike a typical startup, which may run its entire production Web site from a single Amazon
instance or small hosted provider, an enterprise will typically have varied development and
production environments.
For example, an enterprise may have:
Therefore, manageability will be central to any selection decision. Considerations like how you
manage clusters of API gateways, how you load balance geographically, how you operate in a
lights-out datacenter environment and how you handle peak loads will take priority over other
features. Again, not all API Management solutions are designed to cater to the specific needs
of the enterprise, so care should be taken in evaluating how various solutions support cluster
management, fail-over, load bursting, disaster recovery and other operational management
factors before embarking on a particular path.
8 • WHITE PAPER • PROTECTING YOUR APIS AGAINST ATTACK AND HIJACK broadcom.com
Solution Reliability
Once an enterprise decides to embark on an API publishing program, it will effectively become
a service provider to its API consumers. These consumers will come to rely on the enterprise
and expect continuous uptime. In this context, an enterprise will inevitably place a considerable
premium on reliability when selecting its API Management solution. The enterprise will look for
solutions where redundancy is built in and risk of downtime has been extremely minimized, if
not eliminated. Enterprises looking at API Management solutions may want to consider those
solutions that can:
• Meet the kind of high availability, redundant configuration that would guarantee continuous uptime
Conclusions
No two enterprises have exactly the same needs or environment. Therefore, there will never be
a one-size-fits- all API Management solution. However, all enterprises share a common need for
excellence in functional capability and operation. For most organizations endeavoring to start
publishing APIs externally, this will translate into a desire for a flexible, policy-driven, full lifecycle
API Management solution that can meet the production rigor of a dial-tone class service provider.
Functionally, it will require an API Management solution that can meet a variety of security pre-
requisites, accommodate common development lifecycles, be governable through policy, enable
developer onboarding, foster developer engagement and support the option of monetization.
Operationally, the API Management solution should be secure, manageable and reliable.
Learn More
Layer7 welcomes your questions, comments and general feedback.
For more information please visit Layer7.
About Broadcom
Broadcom Inc. (NASDAQ: AVGO) is a global technology leader that designs, develops and supplies a broad
range of semiconductor and infrastructure software solutions. Broadcom’s category-leading product portfolio
serves critical markets including data center, networking, enterprise software, broadband, wireless, storage
and industrial. Our solutions include data center networking and storage, enterprise and mainframe software
focused on automation, monitoring and security, smartphone components, telecoms and factory automation.
For more information, go to www.broadcom.com.
Broadcom, the pulse logo, Connecting everything, CA Technologies, the CA technologies logo, and Automic are among the trademarks of
Broadcom and/or its affiliates in the United States, certain other countries, and/or the EU.
The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. For more information, please visit www.broadcom.com. Broadcom
reserves the right to make changes without further notice to any products or data herein to improve reliability, function, or design.
Information furnished by Broadcom is believed to be accurate and reliable. However, Broadcom does not assume any liability arising out of
the application or use of this information, nor the application or use of any product or circuit described herein, neither does it convey any
license under its patent rights nor the rights of others. 0719