API Marketplace Engineering : Design, Build, and Run a Platform for External Developers

This is your hands-on guide to designing, building, and operating an API Marketplace to allow your organization to expose internal services and customer data securely for use by external developers. The book shows the mutual nature of a relationship in which organizations benefit from revenue and the reach of a new digital channel and third-party developers benefit from leveraging APIs to build unique applications.Providing open access is a regulatory requirement in some sectors, such as financial services, and this book helps you to build a platform to comply with regulatory requirements while at the same time encouraging and supporting use by external development teams. The book provides the blueprints for assembling teams and systems to build and support an API ecosystem. It offers insight into how the Marketplace can be constructed in a way to allow agility and flexibility to meet aggressive startup developer timelines while balancing established enterprise requirements of stability, reliability, and governance. The goal of this book is to provide engineering teams with a view of the operational requirements and how to meet and exceed these by establishing foundational elements at design time.An API Marketplace presents a unique challenge as organizations have to share internal capability and customer data with external developers. Security practices and industry standards are contrasted and discussed in this book. Practical approaches are provided to build and support a third-party developer ecosystem, manage sandbox environments hosting APIs of varying complexities, and cover monetization strategies that are yielding positive results to achieve self-sustainability. **What You Will Learn** * Understand the motivation and objectives for an API economy * Build key technical components of an API platform * Comply with regulatory requirements such as Open Banking * Secure APIs and customer data from external attack * Deliver APIs quickly while satisfying governance requirements * Get insight into a real-world API Marketplace implementation **Who This Book Is For** Solution architects, API product owners, delivery and development leads, and developers; anyone developing APIs for consumption by external business partners; API developers who want more insight into regulatory compliance Table of Contents 5 About the Author 13 About the Technical Reviewer 14 Acknowledgments 15 Introduction 17 Chapter 1: API Engineering 19 APIs in Action 20 What Makes APIs So Special? 21 Connectedness, Sharing, and Survival 22 An API Manifesto 23 Speedboats and Aircraft Carriers 24 Patterns of Integration 25 Enterprise-wide Impact 25 The Gravity of a New Digital Channel 27 Developer Ecosystem 29 Roles 29 A Guide to This Book 32 Chapter 2: Regulation 34 Background 34 Screen Scraping 35 Application Programming Interfaces (APIs) 36 Open Banking 37 Objectives 37 Terminology 38 Benefits 39 Risks 40 Prescriptive, Facilitated, or Market-Driven Approaches 42 Open Banking Across the Globe 43 From Open Banking to Open Finance 48 Sample Applications 49 Summary 51 Chapter 3: Consumption 53 Marketplace APIs vs. Internal APIs 53 Personas 54 Business Value 55 Attract 58 Educate 59 Build Trust 60 Transparency 61 Collaborate 62 Lead 63 Technical Developer Portal 63 Attract 65 Educate 66 Build Trust 67 Transparency 68 Collaborate 69 Lead 70 Developer Advocacy 70 Developer Support 71 Ecosystem 73 Developer Engagement 74 Tooling 75 cURL 76 Postman API Client 76 Fiddler 78 Developer Education 78 Summary 79 Chapter 4: Monetization 80 The API Marketplace Flywheel 81 Your Marketplace Identity 83 Value and Revenue Strategies 85 Developer Pays 86 Developer Gets Paid 89 Free 90 Indirect 91 Billing Engineering 91 Analytics and Insight 95 Data Collection 96 Data Analysis 97 Reporting 100 The Notional Income Statement 101 Pivot to New Business Models 103 Summary 104 Chapter 5: Platform Architecture 105 Elements 106 API Gateway (External/Internal) 106 Identity 107 Container Platform (Managed/Unmanaged) 108 Microservices 111 Database 113 Integration Strategy 113 Google Remote Procedure Call (gRPC) 117 The Power of Port-Forward 118 Taxonomy 120 Platform As a Service 123 Platform Services 124 Deployment Architecture 126 Launch Configuration 126 As-Is Configuration 128 To-Be Configuration 129 Summary 131 Chapter 6: Security 132 Cross-Cutting Concern 133 API Security 135 Open APIs 135 Business to Business (B2B) 135 Business to Consumer (B2C) 136 OAuth 137 Actors and Scopes 138 Application Registration 139 Grant Types and Access Tokens 142 Client Credentials 143 Authorization Code 144 Refresh Token 147 Permission Revocation 149 Variation: Open Banking 150 Vulnerability 153 OWASP 154 Security Top 10 154 Recommendations 156 Security Review 157 Summary 158 Chapter 7: API Design 160 Design Strategy 161 Top Down, Pre-defined 161 Bottom Up 162 Consumer-Driven 163 Build Your Own 165 Considerations 166 Viability and Feasibility 166 Requirements 167 Documentation 169 Governance 170 Access Mechanisms 171 SOAP 171 REST 172 GraphQL 172 Patterns 172 Synchronous 173 Asynchronous 174 The Proxy vs. Tap Debate 176 Lifecycle 177 Developer Experience 178 Versioning 179 End of Life 180 Design Guidelines 181 Error Handling 181 Filtering and Pagination 182 Software Development Kit (SDK) 183 Summary 184 Chapter 8: API Development 185 API First, Tech Second 186 Team Structure 187 Delivery Lead(s) 187 Developers 189 Quality Assurance 192 Delivery Approach 193 Defining the Strategy 194 Planning 194 Squads 196 Agile Methodology 197 DevOps 198 Continuous Integration (CI) 198 Continuous Delivery (CD) 200 Microservices 201 Application Development 202 Development Guidance 202 API Gateway 203 Microservices 204 Platform Services 208 Portal Applications 208 Summary 209 Chapter 9: Sandbox 211 Purpose 212 Process 215 Sandbox Strategies 215 beta 216 Approach 217 Use-Case 218 Design Considerations 218 Backend Simulation 218 Approach 219 Use-Case 219 Design 220 Shallow 220 Approach 222 Use-Case 222 Design 223 Semi-Live 223 Approach 224 Use-Case 224 Design 225 QA Live 225 Approach 226 Use-Case 226 Design 227 Third-Party Sandbox Access 227 Building a Virtualiser 229 Requirements 230 Implementation Options 231 Design Philosophy 231 Sample Flow 233 Summary 235 Chapter 10: API Operations 237 The Operational Universe 238 Change and Release Management 239 DevOps Practice 243 Logging 245 The ELK Stack 247 Monitoring 248 Environment Monitoring 248 Application Performance Monitoring 250 Functional Monitoring 252 Telemetry 253 Alerting 254 Support 255 Roles 255 Transition 257 Communication Strategy 258 Process 259 Issue Tracking and Reporting 260 Service-Level Agreements 263 Supporting Systems 263 Platform As a Service Strategy 263 Backend Dependencies 264 Summary 266 Chapter 11: Conclusion 267 Team Dynamic 268 Organizational Support 268 Agility to Pivot 269 Developer Centricity 270 Where to Start 271 Keep in Touch 272 Index 273 This is your hands-on guide to designing, building, and operating an API Marketplace to allow your organization to expose internal services and customer data securely for use by external developers. The book shows the mutual nature of a relationship in which organizations benefit from revenue and the reach of a new digital channel and third-party developers benefit from leveraging APIs to build unique applications. Providing open access is a regulatory requirement in some sectors, such as financial services, and this book helps you to build a platform to comply with regulatory requirements while at the same time encouraging and supporting use by external development teams. The book provides the blueprints for assembling teams and systems to build and support an API ecosystem. It offers insight into how the Marketplace can be constructed in a way to allow agility and flexibility to meet aggressive startup developer timelines while balancing established enterprise requirements of stability, reliability, and governance. The goal of this book is to provide engineering teams with a view of the operational requirements and how to meet and exceed these by establishing foundational elements at design time. An API Marketplace presents a unique challenge as organizations have to share internal capability and customer data with external developers. Security practices and industry standards are contrasted and discussed in this book. Practical approaches are provided to build and support a third-party developer ecosystem, manage sandbox environments hosting APIs of varying complexities, and cover monetization strategies that are yielding positive results to achieve self-sustainability. What You Will Learn Understand the motivation and objectives for an API economy Build key technical components of an API platform Comply with regulatory requirements such as Open Banking Secure APIs and customer data from external attack Deliver APIs quickly while satisfying governance requirements Get insight into a real-world API Marketplace implementation Who This Book Is For Solution architects, API product owners, delivery and development leads, and developers; anyone developing APIs for consumption by external business partners; API developers who want more insight into regulatory compliance