Mit APIs auf der Überholspur zur produktorientierten Organisation

© OPITZ CONSULTING 2023 / Öffentlich
With APIs in the fast lane towards a product-oriented organization 1
Cologne, 2023-10-25
Fabian Hardt
Sven Bernhardt
WITH APIS IN THE FAST LANE TO A
PRODUCT-ORIENTED ORGANIZATION

INTRODUCTION

IT ARCHITECTURES HAVE NEED TO ENSURE EVOLVABILITY AND FLEXIBILITY

„STRUKTURELLE ZUKUNFTSUNFÄHIGKEIT“
STRUCTURAL INABILITY TO STAY
4
 End of Support
 Lack of maintainability
 Declining benefits
 Dying knowledge
 Lack of agility / Implementation backlog
 Declining data quality
 Rising costs
 …
„Despite its benefits for companies, old
software is structurally unsustainable.
This is due to their characteristics and the
resulting risks for the actual business. “
(Lünendonk 2015)
With APIs in the fast lane towards a product-oriented organization

© OPITZ CONSULTING 2023 / Öffentlich Seite 5
This is what it looks like sometimes/often/always in application
landscapes...
https://www.youtube.com/watch?v=iXaw70X7wb4&t=2s

© OPITZ CONSULTING 2023 / Öffentlich 6
PRODUCT-CENTRIC APPLICATION WORLD DIGITAL
PRODUCT
Digital
Product
Monolith
Digital
Product
Business Domain
Shared Application Platform
Shared Services (Foundation) incl. integration platform
Hybrid, flexible infrastructure incl. Cloud Services
Standard
(On-Prem)
Business Domain
Business Domain
Digital Product
Standard
(On-Prem)
SaaS-Cloud
Standard
SaaS
Follows Gartner‘s Composable Enterprise idea

API VISION & STRATEGY

 Strategy to develop APIs efficiently
 API development approach (e.g. API-first)
 Developers as first-class citizen - motivated developers
 Ensure collaboration
 API Platform that operationalizes the strategy
 Embraces Design4Change
 Provides great Developer experience
 Furthers Developer productivity
 Supports collaborative approach
 Goals:
 Reducing complexity
 Reducing costs
 Increasing DX and productivity – faster time-to-market
TRANSITION TO API-DRIVEN WORLD
NEEDS CLEAR VISION

QUESTIONS TO ANSWER
BEFORE DEFINING AN API
STRATEGY
 Does the API strategy align with the general IT
strategy?
 What are your business drivers for going in the
direction of APIs?
 How to deal with available APIs?
 What kind of visibility do my APIs need?
(Internal, Partner, Public)
 The target audience of my APIs?
 Which protection needs does the data exposed
by APIs have?
 …
Security needs
Data
Existing IT landscape
Organization
C-level attention
People

REALIZE THAT APIS ARE
SUBJECT TO A LIFECYCLE
 A stable API lifecycle is an essential part of an
effective API governance strategy
 API lifecycle
 Reaches from idea to „ready to use API“
 Supports fast innovation lifecycles
 Helps to implement API-first strategy
 There are different lifecycles for producers &
consumers – but related
 Benefits
 Increased productivity
 Greater visibility
 Organizational alignment
Design
Review & build
Deploy
Promote,
deprecate, retire
Operate &
observe
Learn & evolve
API ideation &
planning
Back to design due to
consumer feedback
during development

APIS PRODUCTS

PROJECT VS PRODUCT

 Known from big hyperscalers
 Easy to use and well documented peace of
software
 Huge number of customers, who can use and rent
this services
PRODUCTS, PRODUCTS, PRODUCTS …
 A product needs to be relevant and needs a value proposition
 Users must have an immediate use for it
 Products need clear ownership
 Different types of digital products in modern IT environments (digital economies)
Software as a Service
 Known from “Data Mesh” – in modern Data Driven
companies
 Producer offers its data as a product, via a defined
interface
 Brings the principles of microservices to analytics
departments
Data products
 Interface that offers a piece of logic as a kind of
service (product)
 Carefully designed interface with a fixed contract
 Could be exposed via an API platform
 Samples: REST, SOAP, gRPC, GraphQL
API product

PURPOSES OF API PRODUCTS
Automation
By enabling software to communicate with and
manage external services or devices, APIs can
facilitate automation.
Data Access
Developers can create apps that use or show
data by using the structured access to data or
content that many API products offer.
Extensibility
By creating unique apps or integrations, third-
party developers can more easily expand a
platform's or service's capabilities with the use
of API offerings.
Integration
API products facilitate data sharing and
communication between disparate software
systems, thereby empowering enterprises to
optimize their workflows and establish more
effective procedures.

Authentication and Authorization
Security features to restrict access to
the API, usually by using tokens or
authentication keys.
6.
COMPONENTS OF API PRODUCTS
Developer Tools
API products often include software
development kits (SDKs), code
samples, and other tools to facilitate
integration and development.
5.
Documentation
To aid developers in understanding how
to use the API. This documentation
covers information on available
endpoints, request parameters,
response formats, and sample usage.
4.
Rate Limits
API products frequently have rate limits
and usage plans that outline the
maximum number of requests a
developer is allowed to make in a given
amount of time in order to control usage
and stop abuse.
3.
Support and Maintenance
To guarantee that the API product stays
secure and functional, many API
providers provide frequent updates and
customer support.
2.
API Endpoints
Developers can use API endpoints,
which are particular URLs or URIs, to
submit requests to the API.
1.

API PLATFORM

CHARACTERISTICS OF A MODERN
API PLATFORM
Modern Tooling: Use modern engineering tools and
techniques, infrastructure as code and automation
Easy Onboarding: Low ramp for new internal teams to
onboard to the platform
Minimize cognitive load: Empower developers to foucs on
delivering core business value
Continually evolve: The Platform should be flexible
enough to support new use cases (Desing4Change)
01
02
03
04

Integration / Plugins
Different API Types
BASIC CAPABILITIES OF A MODERN API PLATFORM
AuthN & AuthZ
API Mgmt Tools
Analytics
Developer Portal
API Gateway
Lifecycle Mgmt
Scalibility
Developer Mgmt
Security Features
Compliance
Extensibility
Multi-Cloud and
Hybrid Deployment
Container Support
Modern API Platform
Monitoring

BUILDING BLOCKS API PLATFORM

 Establish API Platform team responsible for:
 Providing API platform
 Providing automation scripts
 Enabling Dev teams
 Constantly improves the platform
 Responsibility of the teams:
 Ownership of the APIs
 Ownership of the Gateways (depending on
the size)
PLATFORM SHOULD PROVIDE
INTUITIVE SELF-SERVICE CAPABILITIES

SILOED MODEL
 Central IT team creates a deployment
blueprint and IaC
 Decentralized teams use this code to setup a
platform
 Full responsibility for decentralized teams
 Maintenance, Updating / Patching
 Security, Hardening
 Decentralized teams are not bounded to
central governance processes
 Reusage and sharing between teams is
limited
 Single API catalog is missing
 Central IT team is responsible for the API
platform
 Maintenance, Updating / Patching
 Security, Hardening
 Scaling
 Deployed API gateways are shared between
teams
 Shared platform team can become a
bottleneck
 Limited ability to implement strict isolation
between different business units
CENTRALIZED MODEL

FEDERATED API MANAGEMENT
 One centralized control plane
 Used by all teams within organization
 Multi tenancy
 Multiple API gateways (data planes)
 Managed by different, decentralized teams
 Helps teams to get more independent
 Configuration managed by APIOps within the
teams
 Provisioned with IaC
 Updates / Security (Hardening) managed
centrally
Source: https://konghq.com/blog/enterprise/federated-api-management

API DELIVERY

API-FIRST MINDSET TO FOCUS ON HOW AND FOR WHAT APIS ARE
USED
 Everything is build around and with APIs
 Major outcomes:
 Digital experience (best service customers,
wherever they are)
 Developer Experience
 Increased Develper Productivity (Velocity of releases,
etc.)
 API-first makes Developer experience measurable
 Benefits of being an API-first company:
 Faster time-2-market
 Fewer failures
 Faster recovery times in case of failure
Source: https://www.postman.com/state-of-api/api-first-strategies/#it-pays-to-be-api-
firstmdashespecially-if-youre-scaling-up

APIS MUST BE CONSUMABLE
 APIs should deliver business value
 Focus on potential consumers
 How will a consumer use my API?
 What kind of resources and operations are
needed by the consumers?
 …
 APIs should be consumer-centric and thus be
consumable
 Well-designed, secured and compliant
 Documented, discoverable and accessible
 Performant, reliable and scalable
Source: https://konghq.com/blog/what-is-apiops/
Compliant
Functional Findable
The intersection of the three
characteristics defines
consumable APIs!

CHALLENGE: BALANCE BETWEEN SPEED AND CONSISTENCE
https://opitzcloud.canto.global/b/I3FO4

DECENTRALIZED API MANAGEMENT: FOCUS ON SPEED
API Platform
Dev
Team 1
Dev
Team 2
Dev
Team n
API Standard 1
API Standard 2
API Standard n
Decreasing
consistency

CENTRALIZED API MANAGEMENT: FOCUS ON CONSISTENCE
API Platform
Dev
Team 1
Dev
Team 2
Dev
Team n
API
Platform
Team
Review loop
Review loop
Review loop
API
Guidelines
API
Guidelines
API
Guidelines
Decreased
speed

AUTOMATION TO BALANCE SPEED AND CONSISTENCE
https://opitzcloud.canto.global/b/OQR0O

APIOPS APPROACH: FOCUS ON SPEED AND CONSISTENCE
API Platform
Dev
Team 1
Dev
Team 2
Dev
Team n
API
Platform
Team
API
Guidelines
API
Guidelines
API
Guidelines
Automated deployment
Governance layer
Defines Guidelines,
Rules &
Restrictions
Automated, direct
feedback
Automated, direct
feedback
Automated, direct
feedback

APIOPS IS BUILT UPON THE PILLARS DEVOPS AND GITOPS
 Principles:
 Fast flow of work in the value stream
 Fast feedback to remediate problems quickly
 Culture of continuous learning, sharing, and
experimentation
 Principles:
 Declarative description
 Versioned and immutable
 Pulled automatically
 Continuously reconciled

APIOPS = GITOPS WITH FOCUS ON APIS
 Principles:
 API-first design
 API spec as a single source of truth
Commit API
spec to Git
API design
guidelines
Validate
Build
Test
Merge
User story
GitOps
Agent
API Platform
watch
observe &
sync
push
check &
generate

Design
Review & build
Deploy
Promote,
deprecate, retire
Operate & observe
Learn & evolve
CONSISTENTLY MANAGE THE API LIFECYCLE USING GIT
Outcome: Validated spec & SDKs
Outcome: Validated implementation
Outcome: API endpoints,
declarative config
Outcome: Managed API
endpoints
Outcome: Shared spec in Git

BUSINESS BENEFITS OF APIOPS
 Increased speed as everything is automated in the
delivery pipeline, which allows for rapidly onboarding,
operating and scaling
 Improved consistency through automated / self-
service governance throughout the delivery pipeline
 Lower cost because automation relieves the QA
teams
 Adopting APIOps increases
 Flexibility
 Agility and
 Ability to innovate

IT BENEFITS OF APIOPS
Developers
 Increased Developers
productivity
 Fewer push backs and less
frustation
 Centralized discovery and
documentation
Operators
 Automated configurations with
Git as Single-Source-of-Truth
 Automated QA
 Consistent, automated rollback
mechanism
Architects
 Faster time-2-market
 Improved consistency
 Increased security and
resiliency
 Increased confidence while releasing changes
 Solid foundation to extend delivery pipeline to further use cases

WHAT’S NEXT?

USING GENERATIVE AI TO
FURTHER DX
 Increase developer productivity
 Decrease tedious and repetitive work
 Improve the quality of the code, and free up
developers to concentrate on more intricate
and creative aspects of their work.
 Remember: Generative AI can be useful, but it
should only be applied sparingly
 Results should be carefully examined and tested
 Necessary security
 Quality standards
Data Generation
Documentation
Natural Language
Processing
Bug Detection
Code Generation /
Completion
Personalized Development
Environment

USING AI TO FURTHER UX FOR
API CONSUMPTION
 Today API portals are used to discover APIs
 Challenges:
 How to deal with undocumented APIs?
 How do we enable non-technical users to
discover current APIs?
 Leverage the power of AI to overcome
challenges and provide comprehensible UX
 Example: PolyAPI
 Provides Conversational UI to browse APIs
 Learns while using APIs
 Creates Client SDK and provides Code Snippets
how to invoke API
Source: https://ployapi.io

BUILT-IN SECURITY – EVOLVING FROM APIOPS TO APISECOPS
 Security throughout the complete API Lifecycle
 Design-Time
 Run static AppSec testing (mind false positives)
 Run dynamic AppSec testing (Check for OWASP
API Security Top 10)
 Run API conformance tests
 Runtime
 Find unknown and unused APIs
 Detect anomalies in API usage (DDoS attacks,
etc.)
 Automating as much as possible and aim at early
feedback
 Use respective tooling (e.g. Crunch42)
 Create attack playbooks
Source: https://www.postman.com/state-of-api/executing-on-apis/#greatest-security-risks

CONCLUSION

 Introducing new technologies is usually not a
big deal
 Difficult things are:
 Change mindset
 Change cultural aspects
 Restructure teams
 Modify responsibilities
IT’S ALL ABOUT THE PEOPLE WORKING
IN AN ORGANIZATION
Change Management Support is an
important part and necessary from the
beginning to bring all people along on
the API journey!

 API vision/strategy is essential
 Think in API products
 API-first development approach
 Collaboration is a key to creating valuable API
products
 Requires a good data basis  cross-
sectional qualification
 API platform
 Not only API gateway
 Extensibility, security, APM, developer portal,
…
KEY TAKEAWAYS
SUMMARY

Q & A

www.opitz-consulting.com
KONTAKT
Sven Bernhardt
Chief Architect
Sven.Bernhardt@opitz-consulting.com
+49 172 2193529
https://www.xing.com/profile/Sven_Bernhardt/
https://www.linkedin.com/in/sven-bernhardt-0570b823/
Fabian Hardt
Solution Architect
Fabian.Hardt@opitz-consulting.com
https://twitter.com/fabian_hardt
https://www.xing.com/profile/Fabian_Hardt
https://www.linkedin.com/in/fabian-hardt

Mit APIs auf der Überholspur zur produktorientierten Organisation

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie Mit APIs auf der Überholspur zur produktorientierten Organisation

Ähnlich wie Mit APIs auf der Überholspur zur produktorientierten Organisation (20)

Mehr von Fabian Hardt

Mehr von Fabian Hardt (10)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Mit APIs auf der Überholspur zur produktorientierten Organisation

Hinweis der Redaktion