Inventory management tools

First and foremost, you should inventory and select API management tools. The management tools will enable you to make rapid progress in the actual work on APIs and avoid unnecessary effort.

Key management tools are:

• Developer Portal
• API Gateway
• API Manager
• API Analytics.

Select the management tool based on the following criteria:

1. Costs and ease of use: Cloud-based solutions are often cost-effective and easy to deploy.
2. Meeting basic needs: Ensure that the tool supports all key API management functions (such as access rights management, verification of authorisations and usage monitoring).
3. Compatibility: The tool must work seamlessly with the organisation’s existing infrastructure.
4. Continuity: Check that the API management tools have permanent funding that does not depend on individual projects.

Management tools are supplied by

• commonly used cloud service providers
• separate system suppliers
• open source code projects.

Comparing the basic functionalities of the solutions is easy.

In practice, interoperability with the rest of the organisation’s infrastructure is often more important than the differences between individual solutions' management features.

API Developer Portal is a software developers' website for finding and testing APIs and requesting access to them.

The Developer Portal is a single site where all the organisation’s APIs are listed and can be found.

It contains an up-to-date description in two formats:

1. in readable format
2. in a format that developers' tools can use automatically.

In the Developer Portal, the organisation’s APIs can be documented in a sufficiently consistent way. At best, it creates a structure for content production that guides developers to describe the APIs uniformly. This makes it easy for an outsider or a new person to understand the way they work and the added value they offer.

The Developer Portal may also contain

• ready-made reference implementations showing how an API can be used
• analytics data on how the APIs work
• service disruption notices
• information about API versioning and life cycles
• contact details of persons who can help with deployment or fault reporting.

A public sector organisation typically manages dozens or hundreds of APIs. As a basic premise, they all have the same fundamental requirements:

• access control
• usage monitoring
• limitations and prioritisations of use.

Redoing these basic things for each API is a waste effort.

API Gateway, or a centralised publication channel, is software that

• manages API access rights and authorisations
• implements information security policies
• controls and prioritises network traffic
• limits and manages the total load of back-end information systems
• operates caching.

All cloud service providers offer their own products, and open source products are additionally available.

The API Gateway is also an efficient design principle and architecture model. It is a single hub that hides complexity and centralises authentication, access monitoring, and traffic limitations. Read more: Charest, G. 2020.Opens in a new window. API Principles and Practices Use of the API Gateway and Portal.Opens in a new window. Harvard UniversityOpens in a new window..

Millions of rows of log entries can be rapidly accumulated from API use. Getting an overview based on them often takes a lot of effort. This is why you need software that analyses log entries and visualises information in a format that is easier for humans to understand.

Analytics that converts log data into observations is almost unavoidably part and parcel of API management.

Analytics helps all parties resolve various fault situations. It also enables knowledge-based decision-making in API issues. The data should be refined for development, business, customer management and information security purposes. For example, API logs can serve as a data source for a Security Operation Center (SOC) that produces an overview.

The purpose of API analytics is to keep track of which APIs each user has used, how and when. For the part of freely available data, examining the total volume of use and its distribution is interesting. With regard to restricted data, checking their use is also important in questionable situations. In some use cases, you even need to drill down to the level of individual data content and user IDs.

The API Manager, or management feature, is intended for API operators.

The following aspects are specified in the information system:

• which APIs are enabled
• which back-end systems they call
• API protocols
• identification methods
• access rights.

The definitions made in the management functionality are transferred to the API Gateway component, which in practice implements the desired functionalities.

The management tool may also include a browser or separate application that facilitates API specification. The specification tool produces a set of API specifications for the other management system components.

The organisation’s internal APIs may be managed differently from external APIs.

Three commonly used options for managing internal APIs are available:

1. No separate management: If the technical documentation is easily accessible and the APIs have a limited group of users, separate management may not be needed. Instructions for use may be included in the documentation available to other developer and maintenance teams. This model may be particularly suitable for small and limited environments.
2. The same management solution for internal and external APIs: If there is a large number of internal developer teams or the organisation wishes to benefit from systematisation, internal APIs can be managed in the same way as external ones. In this case, locating the API Gateway in the same data center or cloud service as the organisation's other services is recommended to minimise the impact of network disruptions.
3. Service mesh model: In this model, a separate system and Developer Portal is created for managing internal APIs in the same way as in option 2, but data connections link the calling information system directly to the system providing the API. While this combines manageability and efficiency, it may require more learning at the beginning.