August 2023 Summaries

The API product management newsletter, authored by Jennifer Craig, focuses on enhancing business value from APIs and API products by providing resources and insights on API product management. This edition delves into the necessary technical knowledge for API product managers and features key resources, such as an article by Matthew Reinbold questioning whether API product management is a role or a person, and a conference talk by Milos Belcevic aimed at helping non-technical product managers understand API management. Additionally, Dr. Bart Jaworski's LinkedIn post offers ten essential tips for API product managers. The newsletter concludes with job listings for API product management roles and encourages readers to share relevant resources for inclusion in future editions, while also highlighting Tyk's API management services.

API security configuration is crucial for protecting sensitive data, as highlighted by multiple case studies of breaches due to misconfigured APIs. The text outlines incidents with companies like T-Mobile and Optus, where improper API security settings resulted in significant data leaks, underscoring the risk of manual security configurations. The document advocates for the automation of API security deployment using the OpenAPI Specification, which allows for defining authorization rules and integrating OpenAPI extensions for enhanced deployment control. By automating the process and using tools like linters to verify security declarations, organizations can prevent unauthorized access and ensure APIs are deployed with proper security measures. This approach not only mitigates potential vulnerabilities but also streamlines the deployment process, ensuring consistent and reliable API security practices.

Tyk 5.1 introduces significant enhancements to its API management platform, focusing on improved data graph capabilities and platform resilience. The update features advanced GraphQL schema stitching, offering a simplified alternative to GraphQL federation by allowing users to attach data sources to any field in the Universal Data Graph schema and use objects from other data sources as operation variables. To aid first-time users or those needing a refresher, Tyk provides ready-to-go Universal Data Graph configurations in the Tyk Dashboard, facilitating a quick start with pre-made examples. The platform's core stability is bolstered by updates such as the integration of Golang 1.19, request body size limits for APIs, and a new "owned analytics" role for API ownership in the dashboard. These improvements aim to enhance the user experience, offering a seamless setup and enhanced security and operational efficiency for businesses utilizing Tyk's services.

API-first banking is emerging as the future of fintech, revolutionizing how financial services are delivered by prioritizing the development of APIs as standalone, well-defined products. This approach enhances speed, efficiency, security, and customer experience, while encouraging innovation and interoperability within the financial sector. The adoption of APIs has been bolstered by regulatory frameworks like the Payment Services Directive 2, which promotes open banking and secure electronic payment services. However, the shift to API-first banking presents challenges such as integrating with legacy systems and ensuring data security and regulatory compliance. Financial institutions are encouraged to develop comprehensive strategies that focus on user experience, robust security measures, and flexible architectures to maximize the benefits of API-first implementations. As API-first banking gains importance, with a significant portion of IT budgets being allocated to API development, banks and fintechs are urged to embrace this transformation to remain competitive and secure in the evolving financial landscape.

Tyk Cloud Hybrid is a novel solution that offers a balanced blend of self-managed and full-SaaS infrastructure benefits for API management, facilitating both control and convenience. It addresses the challenges associated with traditional self-hosted and cloud-hosted API gateways by providing a hybrid approach that combines the advantages of both models. Tyk Cloud Hybrid features a centrally managed control plane that synchronises distributed data planes, ensuring flexibility, compliance, and control while allowing for smooth scaling and global reach. This approach mitigates vendor lock-in, enhances engineering efficiency, and optimises costs by allowing data planes to be positioned near users to reduce latency. With Tyk Cloud Hybrid, organisations can rapidly deploy their API environments without the burden of extensive infrastructure maintenance, offering an ideal solution for businesses seeking a comprehensive and effective API management strategy.

The fourth edition of the API Platform Engineering newsletter, curated by Jennifer Craig, provides valuable insights and resources for platform teams, including engineers, managers, and DevOps professionals. It highlights the launch of an online program named API Platform Engineering Fundamentals intended for current and aspiring platform teams. The newsletter features a selection of useful resources, including a summary of best practices and patterns from PlatformCon 2023 by tech journalist Jennifer Riggins, insights into platform team effectiveness by Pete Hodgson, and a podcast on measuring and improving developer productivity by Dr. Nicole Forsgren. Additionally, it promotes upcoming events like a database guardrails session and a Dublin-based DevOps and Platform Engineering meetup, and includes an interactive quiz on cloud-native application concepts. The newsletter is produced by Tyk, an API management platform, and encourages contributions from readers to enhance its content.

The blog post by Jennifer Craig explores the challenge of propagating context without cancellation in Go, specifically within the Tyk Cloud service used for managing APIs. When onboarding new customers, the company faced issues with their email-sending function due to context cancellation errors, which occurred because the context was tied to the HTTP request lifecycle. This led to premature termination when the context was cancelled after the HTTP handler returned. To address this, the team initially sought external solutions but eventually developed a custom package to detach the context’s cancellation aspect while retaining its values. The problem was later addressed in Go version 1.21, which introduced a standard library feature to propagate context without cancellation. Additionally, a linter was created by Damian Gryski to help developers avoid similar issues in the future. The post also highlights the ease of starting a free trial with Tyk Cloud for API management.

An API catalogue is a crucial tool for managing an organisation's growing inventory of APIs, preventing the chaos of API sprawl by providing a structured, internal library that allows developers to discover and use available APIs efficiently. Unlike a developer portal, which targets specific markets and provides additional documentation, an API catalogue organises all APIs, including those under development, to avoid duplication and enhance reuse. Effective management of an API catalogue involves defining processes for adding new APIs, maintaining URL path conventions, and potentially automating API registration through continuous delivery processes. As organisations aim for "big 'R'" reuse, they often transition to managing an API platform that supports internal and external developers, fostering innovation and integration with partners and customers. A case study in the hospitality industry illustrates the challenges and benefits of implementing an API catalogue, such as improving accessibility and automating deployment, ultimately leading to a more modular and composable API infrastructure that supports diverse developer needs.

The text discusses the importance of adopting an organisational approach to API security as companies increasingly rely on APIs for delivering products and services. It highlights the shift from viewing API security as solely a technical issue to recognizing it as a broader organisational concern, particularly as APIs become integral to product offerings. Leadership buy-in is critical, with digital and product teams taking responsibility for ensuring that APIs are secure and align with customer expectations. Collaboration with risk and compliance teams is essential to address potential data exposure, regulatory compliance, and financial risks associated with APIs, thereby enabling secure and compliant product development. The implementation of a robust security architecture and adherence to secure coding practices are vital to protect APIs from threats while ensuring quality and maintainability. Overall, API security requires a comprehensive, top-to-bottom strategy involving multiple stakeholders across the organisation to prevent reputational damage and ensure successful API management.

Platform teams aiming to implement an API gateway can benefit from a comprehensive approach that includes defining project needs, using free trials, evaluating customer support, and focusing on seamless integration. The process begins with outlining essential API gateway features, considering budget constraints, and assessing compatibility with existing systems and open-source preferences. Free trials provide valuable insights into the ease of creating, deploying, and managing APIs, while customer support evaluations ensure smooth integration and maintenance. Once a suitable gateway is chosen, such as Tyk, teams should engage in detailed planning, installation, and creation or importation of APIs, emphasizing security measures like OAuth 2.0 and JSON Web Tokens. Thorough documentation and a user-friendly developer portal are crucial for efficient API consumption and maintenance, while ongoing monitoring and optimization enhance performance and reliability. With the right API gateway, platform teams can transform business processes into scalable assets, ensuring controlled access and an improved user experience.

Jennifer Craig's API product management newsletter, dated August 15, 2023, aims to assist product teams in maximizing business value from APIs and API products by providing educational content and useful resources. The edition discusses monetization strategies, highlighting the telecom industry's success in this area, and features a video by Amdocs CTO Joe Hogan on the 5G API landscape. It also includes a Fireship tutorial on building and monetizing APIs quickly and evaluates various API business models with insights from Kristopher Sandoval. The newsletter shares current job vacancies in API product management and invites contributions from readers, while being supported by Tyk, an API management platform that enhances product development.

API gateways play a crucial role in platform engineering by safeguarding various types of APIs, which are essential for automation and self-service software delivery capabilities. As the use of APIs in organizations continues to grow, with 92% of organizations maintaining or increasing their investment in APIs, the need for robust protection against data breaches becomes increasingly vital. An API gateway serves as a management service that provides a unified entry point for API calls, handling tasks such as authentication, protocol mediation, analytics, and caching. It is essential for platform engineers to leverage API gateways to protect internal, public, and third-party APIs by managing access, enforcing rate limits, and enhancing security. By doing so, they help prevent unauthorized access and mitigate the risks associated with leaked API keys, thereby maintaining the integrity and security of the organization’s digital assets.

APIs are revolutionizing the insurance industry by streamlining operations, enhancing customer experiences, and driving new revenue opportunities through efficient data sharing and system connectivity. Insurance APIs facilitate communication between various internal and external systems, enabling faster claims management, automated quoting, and improved customer interactions. They offer significant advantages for agents, brokers, carriers, and partners by reducing inefficiencies and supporting new partnerships. Public, private, and partner APIs cater to different needs, allowing for secure data sharing and integration with other industries such as automotive, healthcare, finance, and legal services. This connectivity is not only enhancing operational efficiency but also improving customer satisfaction and retention across the sector.

The third edition of the API Platform Engineering newsletter, released on August 10, 2023, highlights the significance of API platforms for platform teams, featuring community contributions, expert insights, and advancements in automation. Eduardo Munari, a Platform Engineering Master at CI&T, discusses the value of control plane/data plane architecture, while Dr. Liam Terblanche emphasizes automation as a necessity in DevOps with practical examples and tool recommendations. The newsletter also includes a podcast episode by Saim Safder, co-founder of Cloud Native Islamabad, on reducing developers' cognitive load through platform engineering. Additionally, it outlines upcoming events, such as CloudX 2023 and a session on GitHub Actions, invites reader contributions, and offers an AMA with Sonja Chevre, a Group Product Manager at Tyk, a company that produces API management tools.

Tyk is an API management platform that emphasizes simplicity, flexibility, and community engagement, offering a comprehensive suite of features for diverse deployment scenarios from open source to SaaS and hybrid models. The platform boasts ease of installation, robust governance capabilities with an embedded Open Policy Agent, and advanced customization options through its gateway's support for multiple programming languages. Tyk is noted for its lightweight, high-performance nature, capable of handling substantial transaction loads with minimal latency, making it suitable for high-demand environments. Additionally, Tyk integrates seamlessly with service meshes like Istio, LinkerD, and Consul, enhancing its utility in complex API ecosystems. The platform supports automation and synchronization through tools like Tyk Sync and Tyk Operator, promoting seamless integration within DevOps workflows. With a growing open source community and a commitment to customer satisfaction, as evidenced by high ratings on platforms like G2 and Gartner Peer Insights, Tyk positions itself as a reliable partner in API management.

Platform engineering is a core discipline in modern software development, offering self-service delivery capabilities that enhance the developer experience by creating scalable and repeatable workflows and toolchains. It emerged to address the complexities of cloud-native applications and complements DevOps by alleviating developers' operational burdens. Unlike DevOps, which fosters collaboration between development and operations teams, platform engineering provides developers with self-service access to infrastructure and deployment resources through internal developer platforms. These platforms rely heavily on APIs for integration, allowing platform engineers to design and consume APIs to automate processes and orchestrate workflows. A case study of a North American banking institution illustrates the impact of platform engineering, as the bank successfully transitioned from individual team-managed delivery pipelines to a centralized approach with multiple platform engineering teams. This shift included the development of an internal developer portal, automation of infrastructure and API gateway configurations, and the implementation of chaos engineering tools, which significantly enhanced the developer experience and promoted a consume-first development model. As a result, platform engineering has become integral to organizations aiming to streamline their cloud-native initiatives and API programs.

Building an API-first organization involves reorienting company structures and processes to prioritize APIs as the primary means for delivering products to market. In such organizations, APIs are treated as products themselves and are central to the business strategy, requiring senior leadership dedicated to API initiatives, product teams knowledgeable in API technology, and delivery and support teams with ownership and autonomy over API development. This approach fosters a seamless relationship between product and technology teams, enhancing collaboration and decision-making. The prominence of APIs in the organization underscores the importance of efficient API versioning and the ability to swiftly adapt to market changes. API-first organizations distinguish themselves by minimizing dependence on other APIs and ensuring that business ideas are efficiently translated into market-ready product features, thus capitalizing on the API economy's potential.

Managing API gateway sprawl involves addressing the complexities and challenges that arise when an organization uses multiple API gateway vendors, which is common in medium-to-large enterprises due to factors such as local procurement, mergers and acquisitions, cloud migration, multi-cloud vendor support, and regulatory requirements. To tackle this, organizations should aim to unify API governance by establishing consistent standards and practices across different groups and gateways, potentially consolidating to fewer vendors or maintaining a federated approach. Additional strategies include unifying authorization through a central management layer, creating a central API catalog to enhance visibility, implementing distributed logging for traffic analysis, using reverse proxies for non-gateway APIs, and adding correlation identifiers for troubleshooting across gateways. These efforts aim to make interoperability across multiple API gateway vendors feasible while ensuring consistency and security within the API ecosystem.

Classboard, a project developed by five computer science students from Obafemi Awolowo University in Nigeria, has been awarded the 2023 Tyk Side Project Fund. This innovative online platform is designed to enhance educational experiences by streamlining class management, offering centralized access to schedules, reminders, and resources for students, aiming to improve information dissemination without involving lecturers. Having progressed beyond its initial MVP stage, Classboard has onboarded around 3000 students and plans to expand globally, starting from local schools in Nigeria. The project, driven by principles of ownership, problem-solving, and teamwork, has faced challenges like financial constraints and defining its MVP, but has overcome them through collaboration and feedback from senior developers and users. The Tyk fund will support Classboard in upgrading essential services, securing developer accounts, and investing in marketing to enhance the user experience. By inspiring other student developers to tackle real-world problems, Classboard aims to make a positive impact on the wider technology industry.

The API product management newsletter provides insights into the growing field of API product management, emphasizing its importance in driving business performance and the increasing demand for API product managers. It highlights the role's significance by mentioning that 54% of organizations regard finding an API product manager as a core challenge in their API strategy. The newsletter features articles that explore the responsibilities and skills required for API product managers, along with salary expectations, and discusses how product management capabilities contribute significantly to business success. Additionally, it shares job opportunities and encourages reader engagement by inviting them to share useful resources for product managers. Produced by Tyk, the newsletter aims to support product teams in maximizing software investments and enhancing their API product management strategies.

Otterkit, a winner of the Tyk Side Project Fund 2023, is revitalizing the COBOL programming language through a free and open-source compiler that supports the latest COBOL standard (ISO/IEC 1989:2023). Founded out of a fascination with COBOL's modern capabilities hidden beneath its outdated reputation, Otterkit aims to modernize the language’s ecosystem by building on the .NET runtime, allowing COBOL code to be compiled into C# and further into bytecode or native builds. Unlike other costly COBOL compilers, Otterkit is accessible and free, making it attractive for developers worldwide. The project is currently in the final parsing stage, focusing on name resolution and type checking, with plans to introduce a package manager for COBOL to streamline dependency management. With the support of the Tyk fund, Otterkit will acquire full copies of the COBOL standard, ensuring their compiler adheres to the latest standards, and aims to positively impact the developer community by proving COBOL’s relevance in modern development environments.

Tyk has announced the winners of its 2023 Side Project Fund, aimed at supporting innovative side projects with the potential to revolutionize industries. The fund was established to help aspiring entrepreneurs overcome financial and resource challenges associated with developing their projects. This year's winners include Classboard, an educational technology platform enhancing classroom communication; Otterkit, an open-source COBOL compiler modernizing the COBOL ecosystem; and PipeOps, a platform simplifying DevOps for businesses of all sizes. Each winner receives £500 to advance their projects, and their achievements will be showcased in upcoming community events and interviews. The fund is part of Tyk's commitment to fostering creative engineering and empowering innovators to make a significant impact.

PipeOps, one of the winners of the Tyk Side Project Fund 2023, is an innovative platform designed to simplify and enhance the DevOps experience for startups and businesses facing challenges with scalable cloud infrastructure. Originating from a necessity during the team's time at Flux, where increased traffic overwhelmed their existing setup, PipeOps was developed to allow seamless migration from costly platforms like Heroku to more affordable options like AWS. This platform manages infrastructure efficiently by automating provisioning and monitoring, thereby eliminating the need for specialized DevOps personnel. Currently in its early development stages, PipeOps aims for product-market fit by streamlining workflows and fostering collaboration among developers, DevOps teams, and non-technical founders. The Tyk Side Project Fund supports PipeOps by enhancing its credibility, expanding its network, and providing opportunities for collaboration, ultimately empowering the team to further innovate and impact the wider technology industry.