Download - API Governance in the Enterprise
![Page 1: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/1.jpg)
©2016 Apigee Corp. All Rights Reserved.
API Governance in the EnterpriseRobert Broeckelmann, LevvelDino Chiesa, Apigee
![Page 2: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/2.jpg)
©2016 Apigee Corp. All Rights Reserved.
Slideshareslideshare.com/apigee
Apigee Communityhttps://community.apigee.com
YouTubeyoutube.com/apigee
![Page 3: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/3.jpg)
Presentation TitleAPI Governance In The Enterprise
Robert C. Broeckelmann Jr.
![Page 4: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/4.jpg)
DISCLAIMERS• What we present here is one of numerous possible ways
to use Apigee technology. Your situation and requirements will probably differ.
• As always, test things in a non-production environment prior to using anything in production.
• We are not responsible for spontaneous combustion of the known universe or any other undesirable outcomes associated with using what is discussed here.
4
![Page 5: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/5.jpg)
AGENDA
• What is API Management?• API Management--The Full Stack• API Management Solution Architecture• What Is API Governance?• One Organization’s Requirements• API Lifecycle Management• API Governance Ties Into...• Lessons Learned• Questions
5
![Page 6: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/6.jpg)
WHAT IS API MANAGEMENT?
Allows an organized approach to using APIs to open up an organization or system’s data so that
it can be utilized by other parts of the organization or third-parties in new and useful
ways.
6
![Page 7: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/7.jpg)
WHAT IS API MANAGEMENT?
From a business perspective, API Management is a revolution; from a technical perspective, it is an
evolution of the earlier Service Oriented Architecture (SOA) paradigm.
7
![Page 8: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/8.jpg)
WHAT IS API MANAGEMENT?
Spans B2E, B2C, B2B User SpacesSpans Mobile, Integration, Identity, Security
concerns.
8
![Page 9: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/9.jpg)
WHAT IS API MANAGEMENT?• The process of publishing, promoting, and overseeing APIs
in a secure, scalable environment• Ensuring that developers and partners are productive• Managing, securing, and mediating your API traffic• Allowing an organization to grow their API program to
meet increasing demands• Enabling the monetization of APIs• The intersection of technology, business, organization, and
integration concerns
9
![Page 10: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/10.jpg)
THE API MANAGEMENT ”FULL STACK”
10
Data Modeling Interface Modeling
API Management Solution
Management Portal
Developer Portal
API Gateway
Registry & Repository
Identity Stack
Application Infrastructure
Mon
itorin
g
User Repositor
y
Federation
UserProvisioni
ng
Application
FirewallReverse
Proxy
DevO
ps
Logging
![Page 11: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/11.jpg)
API MANAGEMENT SOLUTION ARCHITECTURE
11
![Page 12: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/12.jpg)
WHAT IS API GOVERNANCE?
API Governance is also part of API Management…
… probably the most important part.
12
![Page 13: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/13.jpg)
WHAT IS API GOVERNANCE?Governance is not a bad thing; though, your experiences with it would, probably,
make you disagree.
In fact, for anything to be truly adopted by the enterprise, it must have adequate and functional governance.
The trick is to strike the right balance. Self-service and automation is the key to making the governance process(es) workable.
13
![Page 14: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/14.jpg)
WHAT IS API GOVERNANCE?
Allows for a policy driven approach (vs. ad hoc) to enforcement; not just runtime, but
throughout the design and development process
•single point to manage policies and enforcement.
14
![Page 15: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/15.jpg)
WHAT IS API GOVERNANCE?API governance includes:
●tracking what (API) is deployed where (environment)●tracking who is calling what●how is it (API) protected?●defining interface standards●gathering statistics (about API consumers, APIs, and the Developer Portal) ●API versioning●JSON (or XML) Schema versioning●tracking routing information●tracking what policy should be applied to it (API)●sun-setting (retiring a version of the API)
15
![Page 16: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/16.jpg)
One Organization’s Requirements
• Every organization’s governance requirements will have some unique aspects.
• There will also be a large amount of overlap.• Example Requirements this organization had
• Isolation between Non-Production and Production. Two Apigee organizations; (NP: 3 environments, PRD: 1 environment)
• Four environments included in SDLC (Software Development Life Cycle)
• Organization uses Swagger 2.0 to describe interfaces
![Page 17: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/17.jpg)
One Organization’s Requirements•Requirements
• 3rd Party IdP (Azure Active Directory) used• AAD acts as token generator for all actors. Apigee customized to work
with AAD-produced tokens.• came from the organization's IAM and Information Security teams.• drove much complexity
• Top-down development methodology utilized.• Building a program that supports the entire business. Rather than a
particular line of business or development group.• Many different concerns.
17
![Page 18: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/18.jpg)
API LIFECYCLE MANAGEMENT
API Lifecycle Management (which tracks the interface’s life-cycle, not the implementation) is part of API Governance.
The details will vary, but this basically describes the promotion process (life-cycle) of an API version from initial concept, to definition, to the lowest-level
development environment, to production, and eventually to sun-setting.
18
![Page 19: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/19.jpg)
API LIFECYCLE MANAGEMENTSuppose your organization has the following environments:
• Unit Test Environment• Quality Assurance Environment• Load Test Environment• Production Environment
Now, let’s assume that your API life-cycle captures the following additional steps:• Inception (identification of a business or technical need)• Definition (interface definition)• Development• Sun-setting (retiring a version of the API)
The API Lifecycle will account for all of these states
19
![Page 20: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/20.jpg)
API GOVERNANCE TIES INTOAPI Governance ties into:
• Change Management• Asset Management• Configuration Management• Legacy SOA Governance (with the goal of eventually replacing it)• Quality Assurance• Information Security• IT Auditing
Within Enterprise IT all of these things are interrelated. The processes and organization should reflect this.
Yes, it sounds heavy weight. But, effective self-service and good processes makes all the difference in the world.
20
![Page 21: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/21.jpg)
DEVOPS TIE-INAPI Governance ties into DevOps
•The Developer Portal provides a self-service platform to allow developers to
register with the system create applications provision credentials subscribe to APIs view documentation other activities
•The Developer Portal can also increase development and decrease cycle time decrease Mean Time To Resolution (MTTR) enable stakeholder-level overview ease compliance and reporting
21
![Page 22: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/22.jpg)
LESSONS LEARNEDMost small to medium sized organizations can probably use the Apigee developer portal and built-in processes out of the box without significant modification.
• The enterprise IT organization is different. Different = messy details.• There are exceptions to every rule (including this one).
• There is probably a small or medium sized organization out there that has had to deal with these issues.
22
![Page 23: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/23.jpg)
LESSONS LEARNEDNot all organizations are focused on opening their data up to arbitrary third parties. It may be that internal development teams and B2B Business Partner development teams are the primary focus of the API Management Developer Portal.
• Not the API Management use case we often hear about, but very important for many organizations.
• Anything that involves interacting with many development teams outside of your control can benefit from an API Management solution to better manage and communicate with those actors.
23
![Page 24: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/24.jpg)
LESSONS LEARNEDFor this organization, API Governance was an evolution of SOA Governance paradigm that was already in place.
• Not starting from scratch.
Executive sponsorship, buy-in from business/senior management is critical.
24
![Page 25: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/25.jpg)
LESSONS LEARNEDIntegration with a Third Party Identity Provider is likely imperative in a large organization.
• Is Apigee Edge or the third-party IdP issuing tokens to API consumers?
If third-party IdP, introduces much complexity to Edge.If so, applications must be registered with the third-party IdP
and Apigee Edge.If the third-party IdP is issuing tokens, necessitates replicating client identifiers into Apigee Edge's IdP for Quota Enforcement and Business Analytics.
25
![Page 26: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/26.jpg)
LESSONS LEARNED• The group that is supporting your Apigee Edge API Gateway
may not be the same group that supports the Developer Portal infrastructure. Different skill sets.
• Drupals/PHP vs. Javascript/node.js/Edge Policy
• Apigee Developer Portal did not have good support for multiple endpoints for the same API. Had to import the same Swagger for each endpoint (one endpoint per environment).
![Page 27: API Governance in the Enterprise](https://reader035.vdocument.in/reader035/viewer/2022081414/5871d22b1a28ab423c8b5ddf/html5/thumbnails/27.jpg)
Thank you