Welcome!

@DevOpsSummit Authors: Yeshim Deniz, Robin Miller, Aater Suleman, Elizabeth White, Liz McMillan

Related Topics: @DevOpsSummit, Linux Containers, @CloudExpo

@DevOpsSummit: Blog Feed Post

Top 11 Misconceptions About APIs By @PaulSBruce | @DevOpsSummit #API #DevOps

APIs permeate the connected world, used by technical and non-technical professionals alike

by Paul Bruce

APIs permeate the connected world, used by technical and non-technical professionals alike. At some point, we all work with APIs, building them, selling them, maintaining them and consuming them. With so many viewpoints and opinions, misconceptions can quickly emerge, clouding the decision-making process and hindering execution of improvements to the business of API delivery.

This article focuses on dispelling some of the most common myths around the API lifecycle, so that you don't fall at the mercy of misinformation in your own process. The points in this article are graciously lent by Ole Lensmar, CTO at SmartBear, based on his recent talk at AppsWorld North America on the topic.

Myth #11: APIs only solve a technical problem
APIs don't have buttons and flashy graphics, but that doesn't diminish their importance to non-developers. Business decision makers all need to know that APIs can speed time-to-delivery by compartmentalizing work projects, providing well-modeled 11 myths of apis 1data to business users through spreadsheets, and even act as their own product in the data economy.

If your organization has pigeon-holed APIs to be a geeky, technical asset solely existing for the benefit of the developer, you may find that simply sitting down with the right non-technical business owner, say the CTO or Director of IT, is just the kick start you need to break through this misconception. A 15-minute review of the non-technical reasons that APIs are a big deal to everyone in your organization might be just what the doctor ordered.

Myth #10: APIs are secondary to a business
Even if APIs are perceived as just "glue" for your organization, or if instead of shipping a public API you use them internally, integrations between systems are a vital part of the health and function of a business.  Just ask11 api myths 2 the finance department to go without a few critical integrations that depend on APIs, and you'll see how quickly business as usual will come grinding to a halt.

Similarly, many organizations use some form of traditional database scheme behind the scenes. You wouldn't call the code and queries in the database "secondary" to the business, and so you shouldn't when it comes to the APIs that connect the systems an organization uses. Every company is a tech company in the information age, and understanding the importance of the working components underlying your business model protects you from bad or uninformed decisions when it comes time to change.

Myth #9: Their API will always be available
Do you think that third-party API you just integrated with will be around forever? API companies, especially those who only produce APIs, can very quickly crumble unless they have a healthy ecosystem and leadership to back them.You must choose your third-party integrations wisely, because if they happen to fold, you may be in for quite the scramble to find another API provider that meets your technical needs and financial requirements.

And if you think you're safe integrating with the big players such as Google APIs, Twitter, and Amazon - guess what? You're not. While it's not likely that they'll experience a catastrophic collapse,11 api myths 3 these companies do change their public API schemas regularly. If you're not paying attention, your integration with large providers might break due to these changes. It's also important to consider that you hold far less authority as one of countless other API consumers to a popular API, so your vote on how these APIs change (if you even get a vote) may count far less than if you were to integrate with an API provider that really depends on your subscription to their services.

Myth #8: Our API can't be hacked
Just because you haven't been hacked yet, or you have taken what youbelieve are adequate measures to protect misuse of your API, rest assured your API will be the target of hacking attempts from malicious users and bad actors.

It happens all the time in the news - just consider the Moonpig breach and constant attacks on companies like Uber and Tinder, as a clear sign that public APIs constitute just as much of a security problem as any other web or mobile app. Certainly the folks at Uber thought about security before releasing their API publically, but through elbow grease and malicious intent, hackers still found a way to misuse their APIs. If you are publishing a public API, it's important to bake in time to review your API for conformance to guidelines like the Top 10 OWASP scans for REST or SOAP web services.11 api myths 4

Myth #7: Their API can't be hacked
Each of the points above applies when you think about integrating with 3rd party APIs as well. If they don't have a zero-day response policy, you may want to reconsider trusting your data with their web service. Also be wary of API providers that present compliance at a point in time, but aren't willing to go into detail with you about their continuous security process. If they're not constantly ensuring the conformance they tout, then they might not even know they've been breached.

Trust no one. Be vigilant. Demand the same from others.

Myth #6: SSL + OAuth is enough
Thorough security is never locked to one layer, so it's important to have multiple layers of security considerations in place in order to deter hacking attempts and reduce single-point vulnerabilities. Relying too heavily on a single 11 api myths 5layer such as SSL as a transport security mechanism or OAuth as an authorization pattern, without considering network-level or data-level vulnerabilities, will make it very easy for hackers to play along with the few mechanisms you've established until they find an unprotected aspect of your system to exploit.

Just consider the bearer token exploit, in that without SSL the entire authentication process is bogus. There are other common vulnerabilities too, but the overarching theme is that your approach to securing your APIs must be multi-layered. Using OAuth + SSL might be a major step in the right direction, especially if you use something as arcane as Basic authentication, but it's just one step. Make sure you take the next one soon as part of your deployment or maintenance plans.

Myth #5: Metadata is bad
Put simply, the idea that Metadata is bad is patently false. Metadata is just ‘other information' than the primary data of purpose. Common programs such as Microsoft Office, for instance, produce lots of metadata; the primary data is the content that you include in your document or spreadsheet, whereas the metadata is author and origin information, credentials to underlying data sources, and other information that becomes associated 11 api myths 6with a document throughout its creation, but is usually not exposed within the document itself.

API metadata can be considered critical to the primary function of the API but this data is exposed in non-standard methods to the way that primary data is delivered. Metadata can exist in the form of custom headers to abate the process of baking new functionality into the existing HTTP body schema or specification.  So long as everyone using the API understands why ‘metadata' exists separate from traditional ‘data,' all metadata is data. Use it wisely.

Myth #4: You need to adhere to REST principals
One of the most constraining business practices is to follow strict adherence to some form of guidelines even when they don't make sense for a given situation. REST11 api myths 7 principals are great and all, but REST lacks pretty important things like a built-in formal schema definition and bolt-on standards for doing security (WS-Security, WS-Trust), distributed transactions, and asynchronous processing (JAX-WS).

Regardless of whether you have SOAP or REST services, you should be willing to consider the context by which you apply architectural principals. Using REST as a canon on how to build APIs misses the point of REST: build what is appropriate based on thoughtful consideration of the domain.

Myth #3: Top-down creation of APIs is only for elaborate architectures
Not so! APIs come in all shapes and sizes, especially in the enterprise. Rewriting small portions of infrastructure one at a time is often the only way teams can make headway in migrating from a monolithic web service approach to a more scalable, maintainable model like Microservices.

11 api myths 7If you're trying to partition a class of problems that are thematic throughout your infrastructure, then yes, a top-down approach is often a good thing to try...on the whiteboard...with the rest of your team. The most effective APIs are designed with the consumer in mind, which is great news for people who like to think about their designs before getting lost in implementation details. Even the smallest API should be well thought through, and taking a top-down approach to API design at each opportunity can help to improve the consumer experience and the overall landscape of your API infrastructure, one endpoint at a time.

Myth #2: Nobody uses SOAP
This could be one of the most prevalent API misconceptions that exist today, but it grossly misrepresents the current API economy. Plenty of organizations have existed well before the existence of REST APIs and have been through programming era after era. 11 api myths 9SOAP was the only option in the early SOA days, obtaining both mass adoption in the enterprise as well as years of ecosystem support and tooling. Now, of course, there is a shift away from SOAP for applications and devices that are designed to trade formality for agility. But much of our world is built on XML, no matter how hard we want to move on.

Most notably are organizations that employ a formal back-end, an enterprise service bus (ESB), where many ESB vendors have standardized on XML documents as a native structured input and output format. Building APIs that use SOAP naturally fits in to this kind of ecosystem, and makes sense for teams where the informalities of REST/JSON aren't feasible due to compliance or regulatory concerns.

Myth #1: Our API works!
How do you know this? Do you have proof such as proper test coverage, both positive and negative condition checks in your tests, and are you monitoring your APIs to see exactly what the uptime percentage really is?

The fact is, most API development teams build and ship without proper testing or monitoring practices to ensure that the API being delivered does exactly what it's supposed to do, reliably and safely. Maybe another project takes priority, the "quality analysis" problem is offloaded to another group, or the problems in production are a known quantity solved by a workaround.

The only way you don't fall into the hazards of thinking your API works when it really doesn't is to proactively test to prove that your API stands up to the challenge.

Read the original blog entry...

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

@DevOpsSummit Stories
Translating agile methodology into real-world best practices within the modern software factory has driven widespread DevOps adoption, yet much work remains to expand workflows and tooling across the enterprise. As models evolve from pockets of experimentation into wholescale organizational reinvention, practitioners find themselves challenged to incorporate the culture and architecture necessary to support DevOps at scale. In his session at @DevOpsSummit at 20th Cloud Expo, Anand Akela, Senior Director of DevOps Solutions at CA Technologies, will discuss how existing adopters are employing unified agile and DevOps techniques to engage functional processes and toolchains that deliver increased software quality, faster time-to-market and measurably improved customer experience.
Join IBM November 2 at 19th Cloud Expo at the Santa Clara Convention Center in Santa Clara, CA, and learn how to go beyond multi-speed it to bring agility to traditional enterprise applications. Technology innovation is the driving force behind modern business and enterprises must respond by increasing the speed and efficiency of software delivery. The challenge is that existing enterprise applications are expensive to develop and difficult to modernize. This often results in what Gartner calls "Bimodal IT," where business struggle to apply modern tools and practices to traditional monolithic applications. But these existing assets can be modernized and made more efficient without having to be completely overhauled. By leveraging methodologies like DevOps and agile, alongside emerging technologies like cloud-native services and containerization, traditional applications and teams can be ...
Grape Up is a software company, specialized in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the USA and Europe, we work with a variety of customers from emerging startups to Fortune 1000 companies.
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value Stream Mapping for the development and operations tool chain by offering DevOps Tool Chain Integration and Traceability; DevOps Tool Chain Orchestration; and DevOps Insight and Intelligence. CollabNet also offers traditional application lifecycle management, ALM, for the enterprise through its TeamForge product.
SYS-CON Events announced today that Interoute, owner-operator of one of Europe's largest networks and a global cloud services platform, has been named “Bronze Sponsor” of SYS-CON's 20th Cloud Expo, which will take place on June 6-8, 2017 at the Javits Center in New York, New York. Interoute is the owner-operator of one of Europe's largest networks and a global cloud services platform which encompasses 12 data centers, 14 virtual data centers and 31 colocation centers, with connections to 195 additional third-party data centers across Europe. Its full-service Unified ICT platform serves international enterprises and many of the world’s leading service providers, as well as governments and universities.
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal today!
SYS-CON Events announced today that Grape Up will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company specializing in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the U.S. and Europe, Grape Up works with a variety of customers from emerging startups to Fortune 1000 companies.
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
In his keynote at 19th Cloud Expo, Sheng Liang, co-founder and CEO of Rancher Labs, discussed the technological advances and new business opportunities created by the rapid adoption of containers. With the success of Amazon Web Services (AWS) and various open source technologies used to build private clouds, cloud computing has become an essential component of IT strategy. However, users continue to face challenges in implementing clouds, as older technologies evolve and newer ones like Docker containers gain prominence. He explored these challenges and how to address them, while considering how containers will influence the direction of cloud computing.
All organizations that did not originate this moment have a pre-existing culture as well as legacy technology and processes that can be more or less amenable to DevOps implementation. That organizational culture is influenced by the personalities and management styles of Executive Management, the wider culture in which the organization is situated, and the personalities of key team members at all levels of the organization. This culture and entrenched interests usually throw a wrench in the works because of misaligned incentives.
Cloud promises the agility required by today’s digital businesses. As organizations adopt cloud based infrastructures and services, their IT resources become increasingly dynamic and hybrid in nature. Managing these require modern IT operations and tools. In his session at 20th Cloud Expo, Raj Sundaram, Senior Principal Product Manager at CA Technologies, will discuss how to modernize your IT operations in order to proactively manage your hybrid cloud and IT environments. He will be sharing best practices around collaboration, monitoring, configuration and analytics that will help you boost experience and optimize utilization of your modern IT Infrastructures.
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory?
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on quality and value.
In recent years, containers have taken the world by storm. Companies of all sizes and industries have realized the massive benefits of containers, such as unprecedented mobility, higher hardware utilization, and increased flexibility and agility; however, many containers today are non-persistent. Containers without persistence miss out on many benefits, and in many cases simply pass the responsibility of persistence onto other infrastructure, adding additional complexity.
SYS-CON Events announced today that Juniper Networks (NYSE: JNPR), an industry leader in automated, scalable and secure networks, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Juniper Networks challenges the status quo with products, solutions and services that transform the economics of networking. The company co-innovates with customers and partners to deliver automated, scalable and secure networks with agility, performance and value.
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In his Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, will explore the ways that Nutanix technologies empower teams to react faster than ever before and connect teams in ways that were either too complex or simply impossible with traditional infrastructures.
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Business Unit at CA Technologies, will share his vision about the true ‘DevOps Royalty’ and how it will take a new breed of digital cloud craftsman, architecting new platforms with a new set of tools to achieve it. He will also present a number of important insights and findings from a recent cloud and DevOps study – outlining the synergies high performance teams are exploiting to gain significant busin...
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, New York, and 21st International Cloud Expo, which will take place in November in Silicon Valley, California.
Back in February of 2017, Andrew Clay Schafer of Pivotal tweeted the following: “seriously tho, the whole software industry is stuck on deployment when we desperately need architecture and telemetry.” Intrigue in a 140 characters. For me, I hear Andrew saying, “we’re jumping to step 5 before we’ve successfully completed steps 1-4.”
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet the demands of Digital Transformation – including accelerating application delivery, closing feedback loops, enabling multi-channel delivery, empowering collaborative decisions, improving user experience, and ultimately meeting (and exceeding) business goals.
DevOps is being widely accepted (if not fully adopted) as essential in enterprise IT. But as Enterprise DevOps gains maturity, expands scope, and increases velocity, the need for data-driven decisions across teams becomes more acute. DevOps teams in any modern business must wrangle the ‘digital exhaust’ from the delivery toolchain, "pervasive" and "cognitive" computing, APIs and services, mobile devices and applications, the Internet of Things, and now even blockchain.
SYS-CON Events announced today that Juniper Networks (NYSE: JNPR), an industry leader in automated, scalable and secure networks, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Juniper Networks challenges the status quo with products, solutions and services that transform the economics of networking. The company co-innovates with customers and partners to deliver automated, scalable and secure networks with agility, performance and value.
@DevOpsSummit has been named the ‘Top DevOps Influencer' by iTrend. iTred processes millions of conversations, tweets, interactions, news articles, press releases, blog posts - and extract meaning form them and analyzes mobile and desktop software platforms used to communicate, various metadata (such as geo location), and automation tools. In overall placement, @DevOpsSummit ranked as the number one ‘DevOps Influencer' followed by @CloudExpo at third, and @MicroservicesE at 24th.
SYS-CON Events announced today that Hitachi, the leading provider the Internet of Things and Digital Transformation, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Hitachi Data Systems, a wholly owned subsidiary of Hitachi, Ltd., offers an integrated portfolio of services and solutions that enable digital transformation through enhanced data management, governance, mobility and analytics. We help global organizations open new revenue streams, increase efficiencies, improve customer experience and ensure rapid time to market in the digital age. Only Hitachi Data Systems powers the digital enterprise by integrating the best information technology and operational technology from across the Hitachi family of companies. We combine this experience with Hitachi expertise in the internet of things to d...