APIs are the oil of the digital world. Different forms and types of APIs power the digital mesh to which we’re all connected to. The potential and reach of APIs however are heavily underutilized today in many organizations. The root cause of this seems to be the lack of a “product mindset” on APIs. Organizations that strategically invest in building a product mindset for APIs have been successful in putting themselves significantly ahead of the curve in innovation. In this session, Sanjeewa will talk about six key points that will be valuable for API product managers and architects to bring in a product mindset to APIs within their organizations. This will help them to build a more streamlined, agile, and repeatable process that converts their APIs into digital products.

1. APIs: The Products of the 21st Century
September 9, 2020

2. Hello!
Sanjeeewa Malalgoda
Software Architect - API Management WSO2
@sanjeewa190

3. Anything that can be offered to a market to satisfy the desires or needs of a
customer.
What is a Product?
3

4. Delivering business value to customers
4
Consumer
Applications APIs Business Services /
System of Records

5. The Growth of the Application Market
5
2.2 Million Apps 2.8 Million Apps
● 2.7 billion smartphone users globally.
● 1.3 billion tablet users globally.
● Mobile app revenue expected to grow to $189 billion in 2020.
● Average smartphone user uses 30 apps monthly.

6. The Growth of API Driven Revenue
6
Source https://www.information-age.com/organisations-advantage-api-economy-123485729/
100% of Revenue
comes through API
calls

7. How to build your value proposition?
● Pick your customer.
● Understand their pain points.
● Understand the goals of your customer.
● Know the available assets to build upon.
7

8. APIs are the “Interface” to the value
proposition. They are building the
foundation of our digital experience.

9. APIs do two valuable things.
● APIs connect your customers to your data and services.
● APIs simplify that connection process.
The API Wave
9
Makes it easy to securely connect your bank to
the apps you want to use

10. Growing a business is also about building
products your customers aren’t asking for,
but would love to use when built.

11. The API Product Factory
Manufacturing
● Building your API.
● Different technologies - REST, SOAP,
GraphQL, gRPC, Events, etc.
Assembly
● Integrating systems and services to build
APIs.
Packaging
● Packaging APIs to form products
● Creating documentation
● Associating business plans
● Categorization
Delivery
● API Platforms (Marketplaces)
● Catering to demand
Automation
● API Automation techniques
● CI/CD and delivery pipelines
API Product Lifecycle

12. The WSO2 Platform
ENTERPRISE INTEGRATION
Low code
Integration
Streaming
Integration
Code based
Integration
IDENTITY AND ACCESS MANAGEMENT
Identity
Federation
SSO
MFA and
Adaptive Auth

13. APIs API Products

14. The API Value
14
Microservices
API Consumers
API
Business
Partners
External
Users
API Marketplaces

15. Focus about the Quality
15
API User Portal
● Follow design best practices
● Proper naming conventions
● Use correct resources methods etc.

16. Make your APIs Discoverable
16
API User Portal
Tags
Catégories
Search (personalized)

17. Make your APIs Easy to Use
API User Portal
Intuitive Interfaces
Trial Run (Sandbox)
/SDKs
Business
Documentation
Technical
Documentation
“The Wells Fargo Gateway developer portal makes it fast and easy for
customers to integrate application programming interfaces (APIs) that access
their financial data” - BusinessWire

18. Automate your API Development Lifecycle
MANAGEMENT PLANE
API Publisher Developer
Portal
Business Value
Reporting
CONTROL PLANE
Key Manager Traffic Manager Anomaly
Detection
DATA PLANE
Edge APIs Process APIs System APIs
API Developer
Checks In
Code
Triggers
CI/CD
CI/CD
API Product
Manager
Application
Developer
Application
User

19. Make your APIs Safe to Use
API Gateway, Access Control and Federation
Standard protocols and well
known channels
User convenience
Patterns, ML and AI

20. End to End API Security
API Security is much more than Authentication and Authorization!
API
Bot Detection
Authentication
& Authorization
Rate Limiting
Payload
Scanning
Payload
Scanning
Data Redaction
Surveillance
Logs
AI / ML Analysis

21. End to End API Security(WSO2)
Static and Dynamic
Security for APIs
AI-powered Threat
Protection for APIs
OpenAPI Exploitation
API Security Audit, API Conformance Scan, API Protection
Data & Application Attacks
Advanced Persistent Threats, Data exfiltration, Deletion
DoS & DDoS Attacks
DDoS API attack, Login service DDoS attack, Botnet attacking API
Login Attacks
Stolen tokens or cookies, Credential stuffing, Fuzzing
Payload Scanning
JSON/XML threat protection, SQL injection, XSS, Schema validation, Encryption &
signature, Redaction
Access Control
Authentication, Authorization, Token Translation
Rate Limiting
Client throttling, Provider throttling, Quotas, Spike Arrest
Network Privacy
SSL/TLS
Fine Grained Permission Validation
OAuth 2.0 based scopes /XACML
API Security Tools to
identify and remedy
OpenAPI vulnerabilities
and offer runtime
protection for APIs

22. Make your APIs Scale to Demand
API Gateways, throttling and rate limiting
CONSUMER DEMAND
SUPPLIERS DISAGGREGATE ARCHITECTURE TO MEET DEMAND
MONOLITHIC
BUSINESS APP
ENTERPRISE
APPS
DEPARTME
NTAL APPS
SAAS APPS
PUBLIC /
PRIVATE APIS
SERVERLESS &
MICROSERVICES
1970s
|
MAINFRAME
1980s
|
IT
AWAKENING
1990s
|
INTERNET
2000s
|
MOBILE
2010s
|
IoT/AI
2020+
|
DIGITAL NATIVE
1
10
102
103
105
109
Scale up fast on demand
Scale down to prevent
resource wastage
Prevent systems from
overheat

23. Build an Elastic Data Plane
MANAGEMENT PLANE
API Publisher Developer
Portal
Business Value
Reporting
CONTROL PLANE
Key Manager Traffic Manager Anomaly
Detection
API
DATA PLANE
API API API

24. Iterate and Improve your API Product
Business Value Reporting,
Operational Metrics, Developer
Metrics (NPS, community, churn)
Monitor usage and metrics
Get feedback from
developers
Innovate - New API versions,
lifecycle management and
migration of consumers
https://wso2.com/about/customers/qantas/

25. Build business models for your API Product
API Monetization and Billing Models
● Free access to APIs
○ (ex some government APIs, Facebook APIs)
● Developers/Consumer pays for API usage.
○ Revenue generated by API usage(ex stripe, paypal, google).
○ Tiered, freemium, pay as go, transaction fee based, unit based etc
● Developers/Consumers get paid for API usage.
○ Affiliated marketing, ecommerce platforms, revenue sharing solutions.
● Indirect revenue
○ Internal API usages, ecommerce solutions,
○ Use APIs to do some business and earn revenue through that.

26. Build business models for your API Product
API Monetization and Billing
Implicit monetization
Explicit monetization
● One time pay
● Pay as you go
● Subscription based
● Revenue share
API delivery models

27. Forrester wave for API Management Solutions: Q3 2020
Download link: https://wso2.com/resources/analyst-reports/the-forrester-wave-api-management-solutions-q3-2020/

28. ● Built in plugins for third party IDP integrations (Okta, KeyCloak, etc).
● Private Jet Microgateways on Kubernetes
● Git Integration support for the API Controller (:> apictl)
● Built in synchronizer for API Gateway artifacts (no NFS, RSync, etc).
● GraphQL - Query complexity based subscription policies.
● And more ……
Download: https://wso2.com/api-management/
Docs: https://apim.docs.wso2.com/en/latest/
Announcing WSO2 API Manager v3.2.0
28

29. wso2.com
Thanks!