API management - definition & overview

API management includes the entire process of creating and publishing an API for your application, enforcing the usage policy for your APIs according to your chosen release model, controlling and validating user access, growing your API subscriber or user base, capturing and analyzing usage data for your APIs and processing that data into operational and business insights for your organization.

As more enterprise organizations choose to make their internal data systems accessible to their business partners or to the public, API management software solutions will provide them with the features and tools needed to manage the entire process.

API management tools differ in design and user experience, but there are five core components or features of API management that we see replicated across platforms. These correspond to the most important functionalities that organizations require to effectively deliver, track and monetize APIs:

API publishing tools

API management software tools provide the functionalities that organizations need to simplify creating and releasing new APIs. For most API management programs, users will begin by importing an API that conforms to either the OpenAPI or RAML specifications for describing RESTful APIs. There could be tools for creating a test API, generating mock responses to mock user requests, applying rate limiting to protect an API, stripping data from APIs to prevent data breaches, debugging, creating revisions and applying version history and other functions.

API publishing tools are all about working with the APIs themselves, ensuring that they are customized appropriately and creating the documentation and resources that software developers need to use them productively.

API gateway

API security is one of the most important functions of API management software. APIs open up an organization's internal databases to external applications, but as the number of APIs increases, so do the number of security vulnerabilities and potential attack vectors for a malicious actor.

An API gateway is a server that sits between your back-end systems and front-end systems. It acts as a bottleneck that user requests must pass through before the server responds, giving you the opportunity to validate inputs and prevent unauthorized users from attacking the system. A gateway can also include request orchestrations preventing the system from overloading and preventing DoS attacks. Common API gateway functions include user authentication and authorization, security testing, data capture, and audit/compliance.

API store

API management software tools often include functionality for an API store or developer's portal where an organization can market and sell its completed APIs to software developers. API stores can be gated such that they are only available internally or to partner businesses, but they may also be made available to the general public. Depending on how the store is configured, users may be able to subscribe to individual APIs, or several APIs may be combined into a single product and sold as a package.

API monetization

Enterprises operating under the partner or public release models may charge money for access to their APIs. API management software tools support this functionality with features that enable companies to charge for commercial API access. Companies may want to set up pricing rules based on pay-per-use, pay-per-access, or any number of other models. Other time-saving features like automated invoicing and credit card payment processing can also be incorporated and connected with the API store to facilitate purchases, streamline accounting and help track ROI.

API monitoring and analytics

APIs generate a wealth of valuable data that companies can track to assess the security, operational performance and business effectiveness of their API management program. Each feature of the API management platform plays a role in capturing data that can be aggregated and analyzed to assess the security and operational performance of APIs.

The API gateway captures and relays all user requests from external applications to the backend server. It collects analytics that can be used to evaluate API performance and loading, including how many times an API is queried, how many computing resources were used, the total number of transactions and average latency and how much data was transferred between back-end servers and users.

The API store captures behavior analytics for developers and other customers browsing or shopping for APIs. This data can be used to continuously improve the user experience of the API store, improve its structure to help developers find the tools and resources they are searching for, and encourage developers to build products using the company's available APIs.

API monetization data can also be captured to help the organization optimize its pricing strategy to provide the best value for customers while maintaining profitability and quality in service delivery.

API management tools help technology companies ensure that their APIs are adequately secured against cyber attacks and that their efforts to publish and release APIs match the practical needs of software developers and business partners. The ability to capture data from API gateways and stores on an ongoing basis means that organizations can respond in near real-time to changing customer demands and work to provide the best user experience for API subscribers.

Organizations that deal heavily in APIs use sophisticated API management tools and platforms to enhance their visibility and control of all processes related to the creation and administration of APIs. When API management software providers need industry-leading monitoring and analytics, they turn to Sumo Logic. The Apigee API Management Platform, developed by Google Cloud, allows users to visually configure and code API proxies and implement a variety of security control to restrict unwanted access.

Sumo Logic partnered with Apigee to provide log aggregation, centralization and retention functionalities that help Apigee meet its regulatory compliance requirements and improve operational efficiency. With Sumo Logic, Apigee users benefit from real-time interactive analytics and rapid insight into API security and operational performance.