Welcome!

@DevOpsSummit Authors: Elizabeth White, Pat Romanski, Liz McMillan, Stackify Blog, Simon Hill

Related Topics: @DevOpsSummit, Linux Containers, @CloudExpo

@DevOpsSummit: Blog Feed Post

Top 11 Misconceptions About APIs By @PaulSBruce | @DevOpsSummit #API #DevOps

APIs permeate the connected world, used by technical and non-technical professionals alike

by Paul Bruce

APIs permeate the connected world, used by technical and non-technical professionals alike. At some point, we all work with APIs, building them, selling them, maintaining them and consuming them. With so many viewpoints and opinions, misconceptions can quickly emerge, clouding the decision-making process and hindering execution of improvements to the business of API delivery.

This article focuses on dispelling some of the most common myths around the API lifecycle, so that you don't fall at the mercy of misinformation in your own process. The points in this article are graciously lent by Ole Lensmar, CTO at SmartBear, based on his recent talk at AppsWorld North America on the topic.

Myth #11: APIs only solve a technical problem
APIs don't have buttons and flashy graphics, but that doesn't diminish their importance to non-developers. Business decision makers all need to know that APIs can speed time-to-delivery by compartmentalizing work projects, providing well-modeled 11 myths of apis 1data to business users through spreadsheets, and even act as their own product in the data economy.

If your organization has pigeon-holed APIs to be a geeky, technical asset solely existing for the benefit of the developer, you may find that simply sitting down with the right non-technical business owner, say the CTO or Director of IT, is just the kick start you need to break through this misconception. A 15-minute review of the non-technical reasons that APIs are a big deal to everyone in your organization might be just what the doctor ordered.

Myth #10: APIs are secondary to a business
Even if APIs are perceived as just "glue" for your organization, or if instead of shipping a public API you use them internally, integrations between systems are a vital part of the health and function of a business.  Just ask11 api myths 2 the finance department to go without a few critical integrations that depend on APIs, and you'll see how quickly business as usual will come grinding to a halt.

Similarly, many organizations use some form of traditional database scheme behind the scenes. You wouldn't call the code and queries in the database "secondary" to the business, and so you shouldn't when it comes to the APIs that connect the systems an organization uses. Every company is a tech company in the information age, and understanding the importance of the working components underlying your business model protects you from bad or uninformed decisions when it comes time to change.

Myth #9: Their API will always be available
Do you think that third-party API you just integrated with will be around forever? API companies, especially those who only produce APIs, can very quickly crumble unless they have a healthy ecosystem and leadership to back them.You must choose your third-party integrations wisely, because if they happen to fold, you may be in for quite the scramble to find another API provider that meets your technical needs and financial requirements.

And if you think you're safe integrating with the big players such as Google APIs, Twitter, and Amazon - guess what? You're not. While it's not likely that they'll experience a catastrophic collapse,11 api myths 3 these companies do change their public API schemas regularly. If you're not paying attention, your integration with large providers might break due to these changes. It's also important to consider that you hold far less authority as one of countless other API consumers to a popular API, so your vote on how these APIs change (if you even get a vote) may count far less than if you were to integrate with an API provider that really depends on your subscription to their services.

Myth #8: Our API can't be hacked
Just because you haven't been hacked yet, or you have taken what youbelieve are adequate measures to protect misuse of your API, rest assured your API will be the target of hacking attempts from malicious users and bad actors.

It happens all the time in the news - just consider the Moonpig breach and constant attacks on companies like Uber and Tinder, as a clear sign that public APIs constitute just as much of a security problem as any other web or mobile app. Certainly the folks at Uber thought about security before releasing their API publically, but through elbow grease and malicious intent, hackers still found a way to misuse their APIs. If you are publishing a public API, it's important to bake in time to review your API for conformance to guidelines like the Top 10 OWASP scans for REST or SOAP web services.11 api myths 4

Myth #7: Their API can't be hacked
Each of the points above applies when you think about integrating with 3rd party APIs as well. If they don't have a zero-day response policy, you may want to reconsider trusting your data with their web service. Also be wary of API providers that present compliance at a point in time, but aren't willing to go into detail with you about their continuous security process. If they're not constantly ensuring the conformance they tout, then they might not even know they've been breached.

Trust no one. Be vigilant. Demand the same from others.

Myth #6: SSL + OAuth is enough
Thorough security is never locked to one layer, so it's important to have multiple layers of security considerations in place in order to deter hacking attempts and reduce single-point vulnerabilities. Relying too heavily on a single 11 api myths 5layer such as SSL as a transport security mechanism or OAuth as an authorization pattern, without considering network-level or data-level vulnerabilities, will make it very easy for hackers to play along with the few mechanisms you've established until they find an unprotected aspect of your system to exploit.

Just consider the bearer token exploit, in that without SSL the entire authentication process is bogus. There are other common vulnerabilities too, but the overarching theme is that your approach to securing your APIs must be multi-layered. Using OAuth + SSL might be a major step in the right direction, especially if you use something as arcane as Basic authentication, but it's just one step. Make sure you take the next one soon as part of your deployment or maintenance plans.

Myth #5: Metadata is bad
Put simply, the idea that Metadata is bad is patently false. Metadata is just ‘other information' than the primary data of purpose. Common programs such as Microsoft Office, for instance, produce lots of metadata; the primary data is the content that you include in your document or spreadsheet, whereas the metadata is author and origin information, credentials to underlying data sources, and other information that becomes associated 11 api myths 6with a document throughout its creation, but is usually not exposed within the document itself.

API metadata can be considered critical to the primary function of the API but this data is exposed in non-standard methods to the way that primary data is delivered. Metadata can exist in the form of custom headers to abate the process of baking new functionality into the existing HTTP body schema or specification.  So long as everyone using the API understands why ‘metadata' exists separate from traditional ‘data,' all metadata is data. Use it wisely.

Myth #4: You need to adhere to REST principals
One of the most constraining business practices is to follow strict adherence to some form of guidelines even when they don't make sense for a given situation. REST11 api myths 7 principals are great and all, but REST lacks pretty important things like a built-in formal schema definition and bolt-on standards for doing security (WS-Security, WS-Trust), distributed transactions, and asynchronous processing (JAX-WS).

Regardless of whether you have SOAP or REST services, you should be willing to consider the context by which you apply architectural principals. Using REST as a canon on how to build APIs misses the point of REST: build what is appropriate based on thoughtful consideration of the domain.

Myth #3: Top-down creation of APIs is only for elaborate architectures
Not so! APIs come in all shapes and sizes, especially in the enterprise. Rewriting small portions of infrastructure one at a time is often the only way teams can make headway in migrating from a monolithic web service approach to a more scalable, maintainable model like Microservices.

11 api myths 7If you're trying to partition a class of problems that are thematic throughout your infrastructure, then yes, a top-down approach is often a good thing to try...on the whiteboard...with the rest of your team. The most effective APIs are designed with the consumer in mind, which is great news for people who like to think about their designs before getting lost in implementation details. Even the smallest API should be well thought through, and taking a top-down approach to API design at each opportunity can help to improve the consumer experience and the overall landscape of your API infrastructure, one endpoint at a time.

Myth #2: Nobody uses SOAP
This could be one of the most prevalent API misconceptions that exist today, but it grossly misrepresents the current API economy. Plenty of organizations have existed well before the existence of REST APIs and have been through programming era after era. 11 api myths 9SOAP was the only option in the early SOA days, obtaining both mass adoption in the enterprise as well as years of ecosystem support and tooling. Now, of course, there is a shift away from SOAP for applications and devices that are designed to trade formality for agility. But much of our world is built on XML, no matter how hard we want to move on.

Most notably are organizations that employ a formal back-end, an enterprise service bus (ESB), where many ESB vendors have standardized on XML documents as a native structured input and output format. Building APIs that use SOAP naturally fits in to this kind of ecosystem, and makes sense for teams where the informalities of REST/JSON aren't feasible due to compliance or regulatory concerns.

Myth #1: Our API works!
How do you know this? Do you have proof such as proper test coverage, both positive and negative condition checks in your tests, and are you monitoring your APIs to see exactly what the uptime percentage really is?

The fact is, most API development teams build and ship without proper testing or monitoring practices to ensure that the API being delivered does exactly what it's supposed to do, reliably and safely. Maybe another project takes priority, the "quality analysis" problem is offloaded to another group, or the problems in production are a known quantity solved by a workaround.

The only way you don't fall into the hazards of thinking your API works when it really doesn't is to proactively test to prove that your API stands up to the challenge.

Read the original blog entry...

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

@DevOpsSummit Stories
Vulnerability management is vital for large companies that need to secure containers across thousands of hosts, but many struggle to understand how exposed they are when they discover a new high security vulnerability. In his session at 21st Cloud Expo, John Morello, CTO of Twistlock, addressed this pressing concern by introducing the concept of the “Vulnerability Risk Tree API,” which brings all the data together in a simple REST endpoint, allowing companies to easily grasp the severity of the vulnerability. He provided attendees with actionable advice related to understanding and acting on exposure due to new high severity vulnerabilities.
Enterprises are adopting Kubernetes to accelerate the development and the delivery of cloud-native applications. However, sharing a Kubernetes cluster between members of the same team can be challenging. And, sharing clusters across multiple teams is even harder. Kubernetes offers several constructs to help implement segmentation and isolation. However, these primitives can be complex to understand and apply. As a result, it’s becoming common for enterprises to end up with several clusters. This leads to a waste of cloud resources and increased operational overhead.
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, discussed how data centers of the future will be managed, how the public cloud best suits your organization, and what the future holds for operations and infrastructure engineers in a post-container world. Is a serverless world inevitable?
"Infoblox does DNS, DHCP and IP address management for not only enterprise networks but cloud networks as well. Customers are looking for a single platform that can extend not only in their private enterprise environment but private cloud, public cloud, tracking all the IP space and everything that is going on in that environment," explained Steve Salo, Principal Systems Engineer at Infoblox, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"ZeroStack is a startup in Silicon Valley. We're solving a very interesting problem around bringing public cloud convenience with private cloud control for enterprises and mid-size companies," explained Kamesh Pemmaraju, VP of Product Management at ZeroStack, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"CA has been doing a lot of things in the area of DevOps. Now we have a complete set of tool sets in order to enable customers to go all the way from planning to development to testing down to release into the operations," explained Aruna Ravichandran, Vice President of Global Marketing and Strategy at CA Technologies, in this SYS-CON.tv interview at DevOps Summit at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buyers learn their thoughts on their experience.
SYS-CON Events announced today that Telecom Reseller has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, which can process our conversational commands and orchestrate the outcomes we request across our personal and professional realm of connected devices.
DevOps promotes continuous improvement through a culture of collaboration. But in real terms, how do you: Integrate activities across diverse teams and services? Make objective decisions with system-wide visibility? Use feedback loops to enable learning and improvement? With technology insights and real-world examples, in his general session at @DevOpsSummit, at 21st Cloud Expo, Andi Mann, Chief Technology Advocate at Splunk, explored how leading organizations use data-driven DevOps to close their feedback loops to drive continuous improvement.
SYS-CON Events announced today that Evatronix will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Evatronix SA offers comprehensive solutions in the design and implementation of electronic systems, in CAD / CAM deployment, and also is a designer and manufacturer of advanced 3D scanners for professional applications.
Sanjeev Sharma Joins June 5-7, 2018 @DevOpsSummit at @Cloud Expo New York Faculty. Sanjeev Sharma is an internationally known DevOps and Cloud Transformation thought leader, technology executive, and author. Sanjeev's industry experience includes tenures as CTO, Technical Sales leader, and Cloud Architect leader. As an IBM Distinguished Engineer, Sanjeev is recognized at the highest levels of IBM's core of technical leaders.
We all know that end users experience the Internet primarily with mobile devices. From an app development perspective, we know that successfully responding to the needs of mobile customers depends on rapid DevOps – failing fast, in short, until the right solution evolves in your customers' relationship to your business. Whether you’re decomposing an SOA monolith, or developing a new application cloud natively, it’s not a question of using microservices – not doing so will be a path to eventual business failure.
"Cloud4U builds software services that help people build DevOps platforms for cloud-based software and using our platform people can draw a picture of the system, network, software," explained Kihyeon Kim, CEO and Head of R&D at Cloud4U, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Is advanced scheduling in Kubernetes achievable?Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configurations? In his session at @DevOpsSummit at 21st Cloud Expo, Oleg Chunikhin, CTO at Kublr, answered these questions and demonstrated techniques for implementing advanced scheduling. For example, using spot instances and cost-effective resources on AWS, coupled with the ability to deliver a minimum set of functionalities that cover the majority of needs – without configuration complexity.
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory? In her Day 2 Keynote at @DevOpsSummit at 21st Cloud Expo, Aruna Ravichandran, VP, DevOps Solutions Marketing, CA Technologies, was joined by a panel of industry experts and real-world practitioners who shared their insight into an emerging set of best practices that lie at the heart of today's digital transformation.
SYS-CON Events announced today that Synametrics Technologies will exhibit at SYS-CON's 22nd International Cloud Expo®, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Synametrics Technologies is a privately held company based in Plainsboro, New Jersey that has been providing solutions for the developer community since 1997. Based on the success of its initial product offerings such as WinSQL, Xeams, SynaMan and Syncrify, Synametrics continues to create and hone innovative products that help customers get more from their computer applications, databases and infrastructure. To date, over one million users around the world have chosen Synametrics solutions to help power their accelerated business and personal computing needs.
As many know, the first generation of Cloud Management Platform (CMP) solutions were designed for managing virtual infrastructure (IaaS) and traditional applications. But that's no longer enough to satisfy evolving and complex business requirements. In his session at 21st Cloud Expo, Scott Davis, Embotics CTO, explored how next-generation CMPs ensure organizations can manage cloud-native and microservice-based application architectures, while also facilitating agile DevOps methodology. He explained how automation, orchestration and governance are fundamental to managing today's hybrid cloud environments and are critical for digital businesses to deliver services faster, with better user experience and higher quality, all while saving money.
SYS-CON Events announced today that Google Cloud has been named “Keynote Sponsor” of SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Companies come to Google Cloud to transform their businesses. Google Cloud’s comprehensive portfolio – from infrastructure to apps to devices – helps enterprises innovate faster, scale smarter, stay secure, and do more with data than ever before.
Cloud Expo | DXWorld Expo have announced the conference tracks for Cloud Expo 2018. Cloud Expo will be held June 5-7, 2018, at the Javits Center in New York City, and November 6-8, 2018, at the Santa Clara Convention Center, Santa Clara, CA. Digital Transformation (DX) is a major focus with the introduction of DX Expo within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throughout enterprises of all sizes.
Continuous Delivery makes it possible to exploit findings of cognitive psychology and neuroscience to increase the productivity and happiness of our teams. In his session at 22nd Cloud Expo | DXWorld Expo, Daniel Jones, CTO of EngineerBetter, will answer: How can we improve willpower and decrease technical debt? Is the present bias real? How can we turn it to our advantage? Can you increase a team’s effective IQ? How do DevOps & Product Teams increase empathy, and what impact does empathy have on productivity?
There is a huge demand for responsive, real-time mobile and web experiences, but current architectural patterns do not easily accommodate applications that respond to events in real time. Common solutions using message queues or HTTP long-polling quickly lead to resiliency, scalability and development velocity challenges. In his session at 21st Cloud Expo, Ryland Degnan, a Senior Software Engineer on the Netflix Edge Platform team, will discuss how by leveraging a reactive stream-based protocol, we have been able to solve many of these problems at the communication layer. This makes it possible to create rich application experiences and support use-cases such as mobile-to-mobile communication and large file transfers that would be difficult or cost-prohibitive with traditional networking.
You know you need the cloud, but you're hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You're looking at private cloud solutions based on hyperconverged infrastructure, but you're concerned with the limits inherent in those technologies. What do you do?
The 22nd International Cloud Expo | 1st DXWorld Expo has announced that its Call for Papers is open. Cloud Expo | DXWorld Expo, to be held June 5-7, 2018, at the Javits Center in New York, NY, brings together Cloud Computing, Digital Transformation, Big Data, Internet of Things, DevOps, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal today!
The past few years have brought a sea change in the way applications are architected, developed, and consumed—increasing both the complexity of testing and the business impact of software failures. How can software testing professionals keep pace with modern application delivery, given the trends that impact both architectures (cloud, microservices, and APIs) and processes (DevOps, agile, and continuous delivery)? This is where continuous testing comes in. D