July 12th, 2012

Are Open APIs Too Open for Big Business?

Written by
 

Twitter and Facebook APIsI’ll admit it.. I’m a “big enterprise” guy.  I’ve either worked for or worked with very large enterprise organizations for most of my career and I’ve seen these companies struggle with the challenge of  incorporating ideas that are spawned from the collective brain trust of the theorists, coders and entrepreneurs that exist in the chaos outside the enterprise’s doors.

It took time and some adaptation for concepts like open source software, social media integration and viral marketing to become part of the enterprise world and I believe that opening up Web APIs will require a similar shift in mindset to work on the enterprise stage. The biggest ships take the longest to turn but modern businesses (even the most risk-averse) must be open to leveraging new technologies and architectural philosophies in order to avoid being left behind.

The buzz around Web APIs has definitely piqued the interest of big business and large enterprises have dipped their toes into its waters with the release of a few compelling APIs over the last year.  But, along with the excitement generated from opening new consumer channels and new avenues for innovation, there is still a  prevailing sense of danger associated with the API movement.

For many enterprises,  there is a fear that publishing APIs means giving up control of their services and data to an army of anonymous 16 year-old mobile developers. After all, who wants their carefully crafted brands and products to end up at the mercy of the masses? We’ve seen marketing experiments with “crowd sourcing” produce some interesting results in the past, so there is reason to be cautious when opening up the doors for collaboration in any form.

Of course, the good news is that the challenge of controlling APIs can be elegantly addressed with a strong API Management system. At Layer 7, our SecureSpan API Proxy gives enterprise customers the tools they need to maintain control over how content and services are used, allowing publishers to lock down APIs as much as they want.

However, publishers will also need to ensure that they provide enough accessibility to their API libraries or they will run the risk of exposing wonderful APIs that sit unused, waiting for developers to utilize them. APIs are only useful when they are used and a closed-door policy will not encourage anyone to sign up. That’s why we also offer the Layer API Portal, which is designed to facilitate developer community outreach and secure developer onboarding.

Making APIs attractive to the developer community is the key to increasing usage and it is becoming clear that developers want stability and control in the APIs they use. For example, Twitter’s continued restrictions on API usage and Facebook’s closure of the face.com face recognition API have created a small wave of backlash amongst their developer communities. While it’s not enough of a storm to make much of a dent in the uptake of Twitter or Facebook APIs,  application developers are realizing that building their apps based on APIs from which they may lose access is ultimately a losing proposition.

This is good news for larger enterprises as it signals a growing level of maturity in the API market and the need for stable, fairly-priced APIs that can support apps in the longer term. A set of well-designed, secure APIs with a well thought out revenue model is exactly the right fit for the large enterprise world.

So, are open APIs too open for enterprises? Probably. But enterprises will need to adapt or risk being unable to reach their customers as the device revolution continues at its explosive pace. Conversely, launching a poorly-designed API library just to get it out there can be an equally devastating misstep. Organizations need to think carefully and plan their API strategies in order to find the perfect balance between control and accessibility.

It isn’t easy for enterprises to embrace open APIs but when the risks are managed properly with a well-built API Gateway, developer portal and API strategy, the rewards can be immense.

July 6th, 2012

OpenID Connect: Live Tech Talk July 10 9am PDT

OpenID ConnectOur Tech Talks strive to focus on the most interesting and relevant API Management topics for both developers and publishers. And as new and evolving protocols emerge, we want to provide a forum for developers and publishers alike to discuss these protocols in an open discussion forum. So with that in mind, our next Tech Talk will focus on OpenID Connect.

OpenID Connect is an emerging standard that adds federated authentication to OAuth 2.0-enabled systems. It’s a suite of lightweight specifications that provide a framework for identity interactions via RESTful APIs. And in its simplest deployment, OpenID Connect allows all types of clients including browser-based, mobile and javascript to request and receive information about identities and currently authenticated sessions.

So, it’s a relatively simple protocol that helps make authenticating complicated scenarios easier. And let’s be honest – simple and easy are always welcome when it comes to securing RESTful APIs. Authorization and authentication are now available using only one technology. This makes life easier for anyone looking to secure their APIs.

But of course, questions always arise when discussing the various implementation scenarios for OpenID Connect. That’s why we’re excited to welcome Senior Software Developer Sascha Preibisch as our special guest for our July 10 Tech Talk Tuesday. He will answer any OpenID Connect questions you may have – so get those questions ready and join us on July 10 at 9am PDT.

Here’s how to join the discussion:

Click here to get a reminder in your calendar.

On the day of the event, join on Livestream or Facebook:
»  livestream.com/layer7live
»  facebook.com/layer7

Tuesday, July 10 | 9am PDT | 12pm EDT | 5pm BST

Submit your questions:
Tweet using the tag #Layer7Live
Email techtalk@layer7.com
Check in & Chat through Facebook

June 11th, 2012

API Analytics Tech Talk Tuesday

API AnalyticsGet your API analytics questions ready! Tech Talk is coming up tomorrow, Tuesday June 12 – it’s live it’s interactive and CTO Scott Morrison will be our guest. Tweet questions to #layer7live.

Add it to your calendar

If you publish an API, you need a way to measure and understand how that API functions. You need a way to manage it. You need a way to measure it. APIs are becoming an essential part of the Internet and more enterprises are opening up their APIs to third-party developers.

Of course, API security is always a concern but if you publish an API, you also need to measure how it functions – what metrics are you concerned with? Are there any API errors my application is seeing? How does my API usually perform and is that changing? Is it slowing down or are there latency issues caused by using a proxy?

Key metrics API publishers need to consider include: errors, performance, availability, latency and response time. And with the Layer 7 API Portal, these metrics can be graphed and filtered by user, developer and API.

So be sure to join us tomorrow at 9am PDT when Layer 7 CTO Scott Morrison will take live questions from the stream. It’s a great chance to have your API analytics questions answered.

How to Attend:

Just visit the Layer 7 Facebook page at 9am PDT on June 12 and click the Livestream icon.

Don’t have Facebook? Simply click here to watch directly through Livestream.

How to Submit Questions:

On Facebook

•    Click on the Livestream PLAY button to join the stream
•    Click the red “Check in & Chat” button to submit questions

On Twitter
•    Tweet questions with the hashtag #layer7live

May 28th, 2012

Gluecon 2012

Gluecon LogoGlue Conference, aka Gluecon, is such a refreshing event – filled with API and application developers, not a single suit in sight, demo pods, hackathons, spheros etc.

APIs are popping up everywhere and creating amazing integration possibilities. One of the coolest demos I saw at Gluecon was Ducksboard’s dashboard service, which lets you create your own monitoring dashboard using a library of widgets for existing social and Cloud providers. You can even create your own widget and have your own data pushed to it via an API endpoint created just for you, on the fly – so sexy!

Thanks to everybody who came to my presentation Making Sense of API Access Control. I hope this shed some light on how to leverage OAuth for controlling access to REST-based APIs. A lot of the new APIs I discovered this week could certainly use some help in that regard. API key authentication in HTTP basic without password has its limitations. The slides from Making Sense of API Access Control are embedded below.

March 27th, 2012

M2M & the Digital Frontier

Written by
 

M2M API GatewayThe machine-to-machine (M2M) movement is having a broad impact across industries.  New business models are being powered by information distributed to and collected from smart meters in the utilities sector, connected vehicles in logistics, heart monitors in healthcare, RFID-tagged inventory in retail and digital signage in the media. M2M creates a vast “Internet of things” comprised of smart devices that produce data, networks that transmit data and applications that turn data into real-world insight.

The M2M paradigm presents an exciting new opportunity for companies to use Layer 7’s API Management products.  APIs represent the key to unlocking the value of M2M by linking devices in the field to the core enterprise applications that are able to analyze and apply the data these devices produce. Layer 7 empowers organizations to make that link in a secure, scalable way:

  • The SecureSpan SOA Gateway or API Proxy provides REST-based connectivity to heterogeneous enterprise systems
  • The Layer 7 API Portal allows M2M API owners to set and enforce SLAs and provide comprehensive information to API users (smart device developers, network operators)
  • The Layer 7 OAuth Toolkit configures access control policies that are fit for M2M and able to leverage existing back-end infrastructure

We already have customers achieving M2M success in the automotive, healthcare, media and energy industries. So, whether you’re a logistics company looking to get a real-time view of your global fleet, a retailer needing to manage your disparate warehouses or a telecommunications company providing a broad set of M2M services, we encourage you to apply our industry-leading technology as part of your solution.

Read the solution brief: Simplify M2M Integration with a SOA Gateway