API Management Project Lessons
•Download as PPTX, PDF•
4 likes•2,252 views
The document discusses Capgemini's experience implementing API management for a client. It describes choosing IBM API Connect and building APIs using microservices and a factory model. Key elements included establishing an agile project team, test-driven development, and transitioning APIs to offshore support. Lessons learned include recognizing APIs enable business change, following rigorous development practices, and establishing architecture governance.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to API Management Project Lessons
Similar to API Management Project Lessons (20)
More from Capgemini
More from Capgemini (20)
Recently uploaded
Recently uploaded (20)
API Management Project Lessons
- 1. 1Copyright © 2016 Capgemini and Sogeti – Internal use only. All Rights Reserved. Presentation Title | Date API Management Practical Enterprise Implementation Experience Narinder Sahota Chief Architect - Capgemini David Rutter Solutions Architect - Capgemini
- 2. 2Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Agenda Overview Why APIs matter What is API Management What does an architect consider Vendor landscape Our project and what we have delivered Lessons and takeaways Q&A
- 3. 3Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 1. All teams will henceforth expose their data and functionality through service interfaces. 2. Teams must communicate with each other through these interfaces. 3. There will be no other form of interprocess communication…no back-doors whatsoever. It doesn’t matter what technology they use. HTTP, Corba, Pubsub, … — doesn’t matter. 4. All service interfaces, without exception, must be designed from the ground up to be externalizable. That is to say, the team must plan and design to be able to expose the interface to developers in the outside world. No exceptions. API MANDATE Anyone who doesn’t do this will be fired. Jeff Bezos
- 4. 4Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 “The application is the API. The interfaces to your core applications are the key to both liberating your existing IT estate and enabling its innovation and growth. May the best API win!” Joakim Lindbom Bring your application services as APIs to the outside world and let it create solutions and new value in ways you never anticipated. Capgemini Technovision Ron Tolido Search over 15,859 APIs API Access to 8,200 stores Revenue share model Source: https://goo.gl/IoZz0u HBR: The Strategic Value of APIs – Bala Iyer, Mohan Subramaniam %Revenue From APIs 60% 50% 90%
- 5. 5Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Business Goals 1. Accelerated customer onboarding for APIs 2. Increased visibility of APIs and usage 3. Improved business customer satisfaction 4. Revenue growth through new channels Context
- 6. 6Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 “If you build it, he will come”
- 7. 7Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 What is API Management? Developer Portal • Self Service, Approval Workflows • Self-documenting APIs • Test harness API Gateway • Access Control • Data Transformations Routing, Aggregation Local Processing API Manager Portal • Lifecycle • Service & Support • Analytics Monitoring Business Application APIs Analytics Local Processing Internal/External App Developer API Business Owner API Management Dev Team Service Management API Dev Team
- 8. 8Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Architectural Considerations • API, Messaging, Files • SOAP, REST, GraphQL • Routing • Aggregation What How With What Who • New Business Processes • Who will consume? • API Identification TOGAF, IAF, DDD • Documentation • Environments • Tool
- 9. 9Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 API Management Landscape has two distinct approaches API Management Integration
- 10. 10Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 API Management Landscape has two distinct approaches APIm Pure players being bought by Integration players API Management
- 11. 11Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Following a Vendor evaluation, the client selected IBM API Management (now called API Connect) Business Partner Apps Mobile & Web Apps Enterprise Internal Apps Internet of Things Cloud Service Application Server ESB / Middleware Data Store MicroservicesTraffic API Traffic API Gateway3 (DataPower/MicroGW) Microservices App Computer Runtime6 (Node.js/Java) Developer Portal1 API Management Node2 Collective Controller5 Developer4 Toolkit External App Developer Internal App Developer Partner App Developer
- 12. 12Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 IBM API Connect Capabilities ... On prem, Dedicated Bluemix, Public Bluemix, 3rd Party Cloud • Node.js & Java Microservice application runtime • Node.js & Java integrated runtime management • Enterprise HA & scaling • On-cloud & on-premises staging of Microservice applications • Policy enforcement • Enterprise security • Quota mgmt. & rate limiting • Content-based routing • Response caching, load-balancing and offload processing • Message format & transport protocol mediation • API discovery • API, Plan & Product policy creation • API, Plan & Product lifecycle management • Self-service, customizable, developer portal • Advanced Analytics • Subscription & community management • Rapid model-driven API creation • Data-source to API mapping automation • Standards-based visual API spec creation in Swagger 2.0 • Local API creation and testing • On-cloud & on-prem staging of APIs, Products & Plans Create Run ManageSecure
- 13. 13Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Key Elements of the API Management project: Technology: IBM APIm Agile Project • Distributed, multi-discipline team • Joint Capgemini + Client • Prioritize Risk Mitigation Collaboration Tools: • Atlassian and Slack Test Driven development • Test origin API => SOAPUI • Adapt tests for Dev and UAT • Import tests into AlertSite Monitoring dashboard and Alerting APIs transitioned to offshore 24x7 support New APIs built using a factory model “I consider the APIM Capability delivery to be a great example of how partnering with Capgemini maximises our ability to achieve our outcomes“. Technology Programme Director API Monitoring … from intro to development within 6 hours compared to the 10 day SLA prior to APIm. Impressive! Customer Solutions Over 200 developers registered for APIs in first few months API Management User Portal
- 14. 14Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Monetization & Non-Repudiation & Security Server, Consumer and Unauthenticated Access API Management HTTPS Client Id + Client Secret REST or SOAP 3rd Party, + Partners Service Provider HTTPS Client Id REST or SOAP API Management 3a HTTPS Auth Token Service Provider 4 HTTPS Auth Token 1 HTTPS getToken (username password) Identity Management 2 HTTPS Auth Token 4b Validate Auth Token 3b Validate Auth Token Desktop, Mobile Browser Mobile + Tablet Apps API Management HTTPS Client Id + IP Address + HTTP REFERRER Service Provider HTTPS Client Id Desktop, Mobile Browser Throttle, CORS
- 15. 15Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Messaging more appropriate than APIs for some scenarios Public/Private Cloud Internal Networks Gateway Events APIs: SOAP, REST Business Customers Message Hub API Management APIs: SOAP, RESTSubscribed Events AMQP APIs: SOAP, REST Events, MQ, Tib Management
- 16. 16Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Lessons Learnt
- 17. 17Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Recognise APIs are about business change: Utilise Integration Competency Centre approach
- 18. 18Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Development by policy/configuration Needs same rigour as a coding project
- 19. 19Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Technology is evolving and risk mitigations needed
- 20. 20Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Service Management and External Monitoring designed in from beginning Ensure rapid resolution when things go wrong
- 21. 21Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Architecture Governance required Agreement on Principles and Patterns for Integration & Security
- 22. 22Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Contrast with Lessons from Other projects Built custom Digital Enablement Portal Focus on Developers Sophisticated ELK stack based Monitoring Analytics to drive consumption Web Sockets based push model for in-game Supporting High demand models Established API competency centre with Agile lifecycle Well-defined reference architecture
- 23. 23Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016
- 24. 24Copyright © 2016 Capgemini and Sogeti. All Rights Reserved. API Management | #CWIN16 Sept 2016 Contact information Narinder Sahota Chief Architect, Account CTO narinder.sahota@capgemini.com uk.linkedin.com/in/nssahota @NarinderSahota David Rutter Solution Architect david.rutter@capgemini.com uk.linkedin.com/in/drutter @DavidRutterUK Insert contact picture Insert contact picture
Editor's Notes
- Hello everyone – thanks for spending your time with us. Whilst we haven’t got the graveyard shift we are the ones between you and whenever lunch gets released. Which is about 30mins time. My name is Narinder Sahota, I am a Capgemini certified Chief Architect and for over 2 years have been the Account CTO at one of our key Digital accounts who are a national distribution business. David Rutter is a Digital Architect who has been working for many years on the account and was the lead architect on our API Management project. Todays talk is focussed on our experiences of implementing an APIM in a large well established enterprise environment and we will share some the practical lessons we have learnt. With talks today on Microservices and Mulesoft later, its fair to say APIs are now a key part of modern architectecture. next
- If you have been operating in this space for a while you will have heard of Jeff Bezos mandate It’s useful to read the specifics but in terms of setting a bar for all internal interfaces being effectively APIs this was a bold move. What’s interesting for me is when this mandate was said to have been communicated? Any one? It was 2002. We all have developers who haven’t been coding that many years. As for the final line we probably all though it was a joke but I think he meant it.
- Capgemini’s own thought leaders through our Technovision publication and API blogs have talked about embracing the API economy. Including opportunity to liberate you existing IT estate, which we have been doing And Ron talking about creating solutions and new value The growth tracked by ProgrammableWeb is immense growth --- I could search 16,000 APIs on Sunday Walgreen, who use APIGEE have been redefining their business, see the link about but they have a well defined Walgreens – well define Revenue Share model, access 8000 stores --- Prescription API, Photo print API, Rewards API Harvard Business Review – as % revenue from API’s those are big numbers from big companies
- So moving to our project, it is useful to understand the context in which this project was occurring a mature enterprise environment with an existing Integration HUB referred to as BIG connecting all critical systems with, 400 plus external customers connected, with brokers, gateway appliances and millions of file transfers We had just setup a new strategic implementation in a new data centre and were ramping up a large team to migrate hundreds of interfaces across and establishing an Interface Developemnt factory to accelerate new interface development Our customer wanted the heavy lifting we already had but also a fast lane – with 4 key relevant business goals --- accelerate customer onboarding – people who use their distribution facility --- driving up visibility and usage of APIs --- improve business customer satisfaction --- provide revenue growth
- Anybody able to guess what 1989 film this picture is from? Field of Dreams starring Kevin Costener it was an adaption of W.P. Kinsella's novel Shoeless Joe. Kinsella died a couple of week’s ago (September 16). I won’t go into the detail of the film you can watch it on Netflix during lunch on your phone – was about a farmer who ploughed up his expensive cornfields and built a baseball pitch. So coming to relevance, what was the memorable line? “If you build it, he will come” often misquoted as if you build it, they will come Everyone wants to monetise the business and developers are busy building APIS – but creating and consuming APIs is not enough … this is where APIM comes in.
- Key Capabilities for APIm API Gateway for access control, data transformations and routing Developer portal for external consumers; key is self service, workflows for approvals, and documentation of APIs, including examples Monitoring and testings are key capabilities needed from other vendors
- Identifying Services: IAF, Togaf, Domain Driven Design Are APIs appropriate What type of APIs, REST easier to adopt; SOAP more useful for non-repudiation; transforms Do we need to transform existing services Do we need to aggregate, especially Microservices for REST – simple example where query, transactions and images come from 3 different microservices
- Weakest link is Amazon; its APIm isn’t. Fronted with Apigee; we have an inflight project using Mulesoft Q Do you really want to use the same tooling as your cloud provider? APIs are likely to be cross cloud
- Technology: IBM APIm Agile Project Distributed, multi-discipline team Capgemini + Client Team work Prioritize Risk Mitigation Collaboration Tools: Atlassian and Slack Test Driven development Test origin API => SOAPUI Adapt tests for Dev and UAT Import tests into AlertSite Alertsite: Provides a monitoring dashboard and alerting APIs transitioned to offshore 24x7 support New APIs built using a factory model
- For server to server: Client identifier and secret (username password) common model For consumers, many options OAUTH, SAML, JWT For unauthenticated services, susceptible to misuse by distributed services
- You wouldn’t use polling internally, so why use it externally! Use your APIm infrastructure to manage the messaging
- Development by configuration Requires same rigour as development projects: security, testing, environments, change control, versioning
- Risk Mitigation, TDD, Agile Development, Agile publishing and development API Management is a rapidly evolving, maturing technology Cloud based services, SAAS, evolution and upgrades are not under your control Interruptions to current factory work and release schedule
- Service Management and External Monitoring – if it can go wrong, it will Where do you do mediation, orchestration and aggregation, especially with Microservices
- Cloud based management of internal resources; fast startup, single controlled endpoint Working through security ramifications, tunnels firewalls
- As we are running out of time, I wanted to mention some calibration we did to check our lessons with another high impact API environemnt – this is from a major betting organisation where APIs are a critical channel for business Detail for another day but the team had very similar learnings
- Questions? And our thoughts for the future.