Click here to close now.

Welcome!

IoT User Interface Authors: Yeshim Deniz, Carmen Gonzalez, Elizabeth White, Liz McMillan, Hovhannes Avoyan

Related Topics: @MicroservicesE Blog, Java IoT, Industrial IoT, IoT User Interface, Agile Computing, SDN Journal

@MicroservicesE Blog: Blog Feed Post

Categorizing APIs

Quick: name some APIs! Which ones come to mind? Amazon? Twitter? Google Maps?

Quick: name some APIs! Which ones come to mind? Amazon? Twitter? Google Maps? Chances are, the APIs which came to mind are APIs which are open to any developer to use. But are these the only kinds of APIs that exist? What about Enterprise APIs?

In order to answer this question, let's look at how APIs can be categorized.

First of all, let's look at API Exposure. The two categories are:

  • External : Able to be used outside the organization.
  • Internal : Used only inside the organization

Second, let's look at API Protection. It may be one of three categories:

  • Open: Anybody can use the API, anonymously with no controls
  • Requiring Registration: Developers are identified with API Keys and usage is monitored accordingly
  • Enterprise: Goes beyond just developer registration, adding tight controls on sensitive data, integration with enterprise systems such as Identity Management and event monitoring (SIEM, Splunk, etc).

These axes are orthogonal. Using these axes, APIs divide into six categories. Let's look at the categories:

External APIs

Open External APIs
These are APIs which are open to anybody to access. Usually they take the form of read-only public data feeds.

An example is the Nobel Prize API, which allows a developer to query information about Nobel Prize winners. Another example is the Massachusetts Roadway Events API, which provides developers with access to the (many) roadworks projects happening in Massachusetts at any given moment.

External APIs requiring Registration
These are APIs which are open to any developer to use, but require registration. Once a developer registers, they typically get an API Key. It's important to note that the API Key is not necessarily used for authentication, but instead it is used for identification of the app developer. In this way, the API publisher can apply limits to the usage of their API, and track the usage also.

An example is the US Postal Service's Shipping API. Any developer can use this, but they must register first. The Google Maps API is another good example of a Managed External API. API Keys are required in order to use this API, but any developer can sign up for it. Another example is the Staples API which allows the Staples catalog to be queried. The data is not sensitive, but the developer access is controlled with API Keys.

External Enterprise APIs
These APIs are used to conduct business, or to access sensitive data such as health records. Documentation and information about the API is sometimes public, as in the case of some payments APIs. In many cases though, developer access to the API is by invitation only,  and the documentation may be private. An example is a large HMO in the US which provides an API to retrieve patient prescription information. Access to this API is tightly controlled. Another example, in the B2B space, is a large 401.K provider which allows its corporate customers to provision their new employees with 401.K plans via an API. Access to this API is also tightly controlled.

Other examples of Enterprise External APIs come from the "Internet of Things" where devices such as electricity meters transmit sensitive information via APIs, and this data must be tightly protected.

Enterprise External APIs are typically linked to other enterprise systems such as enterprise Identity Management (IdM).

Internal APIs
Just like on the Internet, lightweight REST APIs are taking over from heavyweight SOAP services inside the organization. However, SOAP and XML are still a fact of life, which means that Internal APIs typically span both XML and JSON.


Open Internal APIs
An example is a company directory API. It is open to all access.

Internal APIs requiring Registration
In some large organizations, as part of an initiative to allow internal developers to develop apps to be used by company employees, some functionality may be exposed as APIs. Access to these APIs is managed, so that developers can sign up, and usage of the APIs can be monitored. An example is an inventory lookup API, which checks the inventory of a particular item in a warehouse. This may be used to develop internal apps for personnel in the field. Internal developers sign up to use this API, get their API keys, and the API usage is monitored in order to prevent data-mining or excessive usage. However, data sensitivity itself is low.

Internal Enterprise APIs
These include APIs used to access private customer data, which may be subject to regulatory controls. Enterprise-class controls are required for these APIs. Even though its exposure is just internal to the organization, its data sensitivity is high. Remember that many privacy breaches come from inside the organization.

In the financial services sector, these include APIs to perform fund management operations such as buying and selling stock. For example, in one large Mutual Fund company, fund managers required the ability to manage their funds via iPad apps. This required access to Internal Enterprise APIs from iPads. This was delivered using tightly-controlled Internal Enterprise APIs.

In the healthcare sector, this category includes APIs which access patient data from inside hospitals and health insurer systems.

On top of simply registering developers, Internal Enterprise APIs require rules to be in place for sensitive data protection, and for a signed audit trail, to prove which user has accessed the API. Internal Enterprise APIs also must integrate with enterprise Identity Management, such as directories and single sign-on.

Conclusion
It is useful to categorize APIs into different axes, because it allows decisions to be made about how to manage them. It is a fact that the most well-known APIs are open APIs on the Internet, or APIs such as Google Maps for which any developer can obtain API Keys. However, although many people are not aware of them, Enterprise APIs are common and perform vital functions for businesses. They are exposed outside the organization and inside the organization also. By categorizing APIs, we can see their requirements clearly, and manage our APIs accordingly.

Read the original blog entry...

More Stories By Mark O'Neill

Mark O'Neill is VP Innovation at Axway - API and Identity. Previously he was CTO and co-founder at Vordel, which was acquired by Axway. A regular speaker at industry conferences and a contributor to SOA World Magazine and Cloud Computing Journal, Mark holds a degree in mathematics and psychology from Trinity College Dublin and graduate qualifications in neural network programming from Oxford University.

@CloudExpo Stories
DevOps Summit at Cloud Expo New York is offering a limited time FREE "Expo Plus" registration option in New York. On site registration price of $1,95 will be set to 'free' for delegates who register during special offer. To take advantage of this opportunity, attendees can use the coupon code, and secure their registration to attend all keynotes, @DevOpsSummit sessions at Cloud Expo, expo floor, and SYS-CON.tv power panels. Special FREE registration givess access to all Containers and Microservi...
DevOps Summit, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long developmen...
"We have developers who are really passionate about getting their code out to customers, no matter what, in the shortest possible time. Operations are very focused on procedures and policies," explained Stan Klimoff, CTO of Qubell, in this SYS-CON.tv interview at DevOps Summit, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
“We help people build clusters, in the classical sense of the cluster. We help people put a full stack on top of every single one of those machines. We do the full bare metal install," explained Greg Bruno, Vice President of Engineering and co-founder of StackIQ, in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that the "First Containers & Microservices Conference" will take place June 9-11, 2015, at the Javits Center in New York City. The “Second Containers & Microservices Conference” will take place November 3-5, 2015, at Santa Clara Convention Center, Santa Clara, CA. Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities.
ThingsExpo New York is offering a limited time FREE "Expo Plus" registration option in New York. On site registration price of $1,95 will be set to 'free' for delegates who register during special offer. To take advantage of this opportunity, attendees can use the coupon code, and secure their registration to attend all keynotes, ThingsExpo sessions, expo floor, and SYS-CON.tv power panels. Special FREE registration givess access to all DevOps, Containers and Microservices sessions as well. Regi...
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading in...
"Verizon offers public cloud, virtual private cloud as well as private cloud on-premises - many different alternatives. Verizon's deep knowledge in applications and the fact that we are responsible for applications that make call outs to other systems. Those systems and those resources may not be in Verizon Cloud, we understand at the end of the day it's going to be federated," explained Anne Plese, Senior Consultant, Cloud Product Marketing at Verizon Enterprise, in this SYS-CON.tv interview at...
Health care systems across the globe are under enormous strain, as facilities reach capacity and costs continue to rise. M2M and the Internet of Things have the potential to transform the industry through connected health solutions that can make care more efficient while reducing costs. In fact, Vodafone's annual M2M Barometer Report forecasts M2M applications rising to 57 percent in health care and life sciences by 2016. Lively is one of Vodafone's health care partners, whose solutions enable o...
SYS-CON Events announced today that the "First Containers & Microservices Conference" will take place June 9-11, 2015, at the Javits Center in New York City. The “Second Containers & Microservices Conference” will take place November 3-5, 2015, at Santa Clara Convention Center, Santa Clara, CA. Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities.
“DevOps is really about the business. The business is under pressure today, competitively in the marketplace to respond to the expectations of the customer. The business is driving IT and the problem is that IT isn't responding fast enough," explained Mark Levy, Senior Product Marketing Manager at Serena Software, in this SYS-CON.tv interview at DevOps Summit, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Akana, a leading provider of API Management, API Security and Cloud Integration solutions, announced that it is introducing DevOps automation to the API lifecycle. New capabilities in Akana's API Management platform significantly reduce the time required to update API definitions and versions. DevOps teams will be able to work faster in designing and developing APIs, as well as managing them at runtime and publishing them to a portal.
SYS-CON Events announced today that SUSE, a pioneer in open source software, will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. SUSE provides reliable, interoperable Linux, cloud infrastructure and storage solutions that give enterprises greater control and flexibility. More than 20 years of engineering excellence, exceptional service and an unrivaled partner ecosystem power the products and support that help ...
IndependenceIT has been selected by nGenx to power Windows-based DaaS and application delivery on Google Compute Engine to support the delivery of GoldMine Cloud software. For independent software vendors (ISVs) like GoldMine, this expands the theater of operations to increase revenue opportunities while reducing software management and maintenance liabilities. IndependenceIT was selected by application and desktop pioneer, nGenx, to deliver its “Bring Your Own Cloud” strategy to GoldMine and o...
"ElasticBox is an enterprise company that makes it very easy for developers and IT ops to collaborate to develop, build and deploy applications on any cloud - private, public or hybrid," stated Monish Sharma, VP of Customer Success at ElasticBox, in this SYS-CON.tv interview at DevOps Summit, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Growth hacking is common for startups to make unheard-of progress in building their business. Career Hacks can help Geek Girls and those who support them (yes, that's you too, Dad!) to excel in this typically male-dominated world. Get ready to learn the facts: Is there a bias against women in the tech / developer communities? Why are women 50% of the workforce, but hold only 24% of the STEM or IT positions? Some beginnings of what to do about it!
SYS-CON Events announced today DevOps.com will exhibit at SYS-CON's DevOps Summit 2015 New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Launched in 2014, DevOps.com has quickly established itself as an indispensable resource for DevOps education and community building. DevOps.com make it their mission to cover all aspects of DevOps – philosophy, tools, business impact, best practices and more.
17th Cloud Expo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises a...
Imagine a world where targeting, attribution, and analytics are just as intrinsic to the physical world as they currently are to display advertising. Advances in technologies and changes in consumer behavior have opened the door to a whole new category of personalized marketing experience based on direct interactions with products. The products themselves now have a voice. What will they say? Who will control it? And what does it take for brands to win in this new world? In his session at @Thi...
"Vormetric is a data security company. We secure information at rest and our customers are some of the largest organizations in the world. The threats that are coming around today are either from state-sponsored activities and organized crime, and the intent is to steal information," explained Derek Tumulak, Vice President of Product Management at Vormetric, in this SYS-CON.tv interview at Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.