This presentation explores what is needed from an API management system and what you can expect from WSO2 API Manager.

1. Director, API Architecture
WSO2 API Manager: Why, What, How,
and What's Next
Nuwan Dias

2. Why do you need
API Management?
Image source: blog.dailysteak.co

3. APIs are essential to address the problem of
app explosion
● Demand for consumption is on the rise. (easier/convenient
ways to consume information and services).
● Demand for consumption is driving digital transformation.
● Digital transformation creates opportunity for $$.
● APIs are the key to enabling digital transformation.

4. What do you need from an API Management
System?
1. Creating and publishing APIs.
2. API security and rate limiting.
3. Platform for discovering, searching and consuming APIs.
4. API governance and lifecycle management.
5. API analytics, specialization and evolution.

5. Maslow’s hierarchy of needs
Image source: verywellmind.com

6. What do you need from an API Management
System?
1. Creating and publishing APIs. - Physiological needs.
2. API security and rate limiting. - Safety needs.
3. Platform for discovering, searching and consuming APIs -
Love and belonging needs.
4. API governance and lifecycle management. - Esteem needs.
5. API analytics, specialization and evolution - Self actualization
needs.

7. Creating and
publishing APIs
Defining the contract
between the API
provider and the API
consumers - The API
developer portal.

8. API Design - Import Definition

9. API Design - Start new

10. API Design - Resource Definition

11. API Documentation

12. API Publishing

13. API Security and
Rate Limiting
Allow verified,
permitted and
controlled access into
your assets - API
Gateways.

14. API Gateways: The enforcement point of all
policies

15. API Security
● Trusted Sub-systems
○ Mutual TLS
○ Basic Authentication
● Delegated Authentication
○ OAuth2.0
● Authorization
○ OAuth2.0 Scopes
○ OIDC
○ XACML
● CORS

16. Authentication: OAuth2.0 Grant Types

17. Federated Authentication

18. Authorization
XACML

19. Rate Limiting
● Quotas: for monetization
○ By number of requests or bytes
● Fair usage policy
● Entry point control rules
● Protection from over usage
● Custom policies

20. API Consumption
The need for APIs to
be easily discoverable,
searchable and
consumable - The app
developer portal.

21. API Discovery: Registry of APIs
● Paginated listing of APIs
● Tags
● Groups

22. API Searching

23. Application Management

24. Consuming the API
● API documentation
● API testing
● SDKs
● Developer tooltips

25. API Governance and
Lifecycle
Management
Formalizing the
evolution of APIs and
assurance of
standards and
practices.

26. API Versioning
● Different version formats.
● Backwards compatibility and transitioning of apps to use the
latest and greatest version.
● Running multiple versions in parallel.
● Deep copy of documents and policies
● Transitioning current subscribers to latest version
● Notifying current subscribers.

27. Declaration and execution of custom defined
API lifecycles.

28. Execution of custom defined workflows for..
● API state transitions
● Developer onboarding
● Application registration
● API subscriptions
● Generation of application keys

29. Tooling for automation of CI/CD processes

30. API Analytics and
specialization
● Observing and
reacting to
abnormalities and
trends.
● Optimizing the value
chain of APIs by
specializing and
scaling.

31. API Analytics: Business Insights
● Business performance
● New opportunities
● Expansions
● Promotions
● EOLs
● Achievers
● Laggards

32. API Analytics: Operational
● Performance metrics
● Abnormalities
● Trends
● Tracing
● Debugging
● Alerting

33. Specialization and evolution of APIs
● Different API types
○ SOAP APIs
○ gRPC APIs
○ Websockets
○ Event streams
● API gateways evolving into microgateways

34. Whats Next?
How do we address
the trillion endpoints
problem?

35. The trillion endpoints problem

36. What’s Next?
● Developer first APIs and microgateways.
● Integration with service mesh technologies.
● Dynamic service discovery: etcd, consul, etc.
● Dynamic APIs: Short lived APIs that adapt and evolve or die.
● Serverless API gateways.
● API Management for event driven architectures.
● Embedded/Native API management on large scale-cloud
infrastructures.

37. THANK YOU
wso2.com