API Marketplace Engineering: Design, Build, and Run a Platform for External Developers

Description

This is your hands-on guide to designing, building, and operating an API Marketplace to allow your organization to expose internal services and customer data securely for use by external developers. The book shows the mutual nature of a relationship in which organizations benefit from revenue and the reach of a new digital channel and third-party developers benefit from leveraging APIs to build unique applications. Providing open access is a regulatory requirement in some sectors, such as financial services, and this book helps you to build a platform to comply with regulatory requirements while at the same time encouraging and supporting use by external development teams. The book provides the blueprints for assembling teams and systems to build and support an API ecosystem. It offers insight into how the Marketplace can be constructed in a way to allow agility and flexibility to meet aggressive startup developer timelines while balancing established enterprise requirements of stability, reliability, and governance. The goal of this book is to provide engineering teams with a view of the operational requirements and how to meet and exceed these by establishing foundational elements at design time. An API Marketplace presents a unique challenge as organizations have to share internal capability and customer data with external developers. Security practices and industry standards are contrasted and discussed in this book. Practical approaches are provided to build and support a third-party developer ecosystem, manage sandbox environments hosting APIs of varying complexities, and cover monetization strategies that are yielding positive results to achieve self-sustainability. What You Will Learn Understand the motivation and objectives for an API economyBuild key technical components of an API platformComply with regulatory requirements such as Open BankingSecure APIs and customer data from external attackDeliver APIs quickly while satisfying governance requirementsGet insight into a real-world API Marketplace implementation Who This Book Is For Solution architects, API product owners, delivery and development leads, and developers; anyone developing APIs for consumption by external business partners; API developers who want more insight into regulatory compliance Table of Contents About the Author About the Technical Reviewer Acknowledgments Introduction Chapter 1: API Engineering APIs in Action What Makes APIs So Special? Connectedness, Sharing, and Survival An API Manifesto Speedboats and Aircraft Carriers Patterns of Integration Enterprise-wide Impact The Gravity of a New Digital Channel Developer Ecosystem Roles A Guide to This Book Chapter 2: Regulation Background Screen Scraping Application Programming Interfaces (APIs) Open Banking Objectives Terminology Benefits Risks Prescriptive, Facilitated, or Market-Driven Approaches Open Banking Across the Globe From Open Banking to Open Finance Sample Applications Summary Chapter 3: Consumption Marketplace APIs vs. Internal APIs Personas Business Value Attract Educate Build Trust Transparency Collaborate Lead Technical Developer Portal Attract Educate Build Trust Transparency Collaborate Lead Developer Advocacy Developer Support Ecosystem Developer Engagement Tooling cURL Postman API Client Fiddler Developer Education Summary Chapter 4: Monetization The API Marketplace Flywheel Your Marketplace Identity Value and Revenue Strategies Developer Pays Developer Gets Paid Free Indirect Billing Engineering Analytics and Insight Data Collection Data Analysis Reporting The Notional Income Statement Pivot to New Business Models Summary Chapter 5: Platform Architecture Elements API Gateway (External/Internal) Identity Container Platform (Managed/Unmanaged) Microservices Database Integration Strategy Google Remote Procedure Call (gRPC) The Power of Port-Forward Taxonomy Platform As a Service Platform Services Deployment Architecture Launch Configuration As-Is Configuration To-Be Configuration Summary Chapter 6: Security Cross-Cutting Concern API Security Open APIs Business to Business (B2B) Business to Consumer (B2C) OAuth Actors and Scopes Application Registration Grant Types and Access Tokens Client Credentials Authorization Code Refresh Token Permission Revocation Variation: Open Banking Vulnerability OWASP Security Top 10 Recommendations Security Review Summary Chapter 7: API Design Design Strategy Top Down, Pre-defined Bottom Up Consumer-Driven Build Your Own Considerations Viability and Feasibility Requirements Documentation Governance Access Mechanisms SOAP REST GraphQL Patterns Synchronous Asynchronous The Proxy vs. Tap Debate Lifecycle Developer Experience Versioning End of Life Design Guidelines Error Handling Filtering and Pagination Software Development Kit (SDK) Summary Chapter 8: API Development API First, Tech Second Team Structure Delivery Lead(s) Developers Quality Assurance Delivery Approach Defining the Strategy Planning Squads Agile Methodology DevOps Continuous Integration (CI) Continuous Delivery (CD) Microservices Application Development Development Guidance API Gateway Microservices Platform Services Portal Applications Summary Chapter 9: Sandbox Purpose Process Sandbox Strategies beta Approach Use-Case Design Considerations Backend Simulation Approach Use-Case Design Shallow Approach Use-Case Design Semi-Live Approach Use-Case Design QA Live Approach Use-Case Design Third-Party Sandbox Access Building a Virtualiser Requirements Implementation Options Design Philosophy Sample Flow Summary Chapter 10: API Operations The Operational Universe Change and Release Management DevOps Practice Logging The ELK Stack Monitoring Environment Monitoring Application Performance Monitoring Functional Monitoring Telemetry Alerting Support Roles Transition Communication Strategy Process Issue Tracking and Reporting Service-Level Agreements Supporting Systems Platform As a Service Strategy Backend Dependencies Summary Chapter 11: Conclusion Team Dynamic Organizational Support Agility to Pivot Developer Centricity Where to Start Keep in Touch Index