API Management Platform as an Integral Part of Your API Strategy

This blog post focuses on API management – the cornerstone for executing an effective API strategy. At first, we will explore the key capabilities, business benefits, and best-case implementation scenarios of API management platforms for banks. The second part of this blog post features an in-depth overview of the market-leading API management platforms to help you select a solution that perfectly suits your technical and business needs.

What Is API Management and Why Is It Important?

API management involves various tools and services, typically incorporated in a digital platform, which enables centralized governance across all stages of the API lifespan. API management platforms are used to create, test, document, publish, analyze, and scale APIs in a secure environment, as well as support API monetization. By implementing such solutions, businesses can ensure error-free, protected, and consumable APIs. Moreover, API management platforms can facilitate the adoption of API integration platforms, which enable the automation of complex business workflows.

The global API management market is expected to grow from $4,5 billion in 2022 to $13,7 billion by 2027 at a 25.1% CAGR, according to this research. The rapid market growth is driven by the booming API economy, which is pioneered by the BFSI industry. In pursuit of new revenue streams, many banks exert all efforts to increase their API maturity and seize emerging business opportunities. For example, BaaS and API marketplaces in banking are anticipated to hit mainstream adoption within the next two years, as per Gartner. Other factors that accelerate the adoption of API management solutions in the banking industry include:

• Rising customer demands for seamless, omnichannel financial services
• Gradual substitution of brick-and-mortar banking with digitally-first connected banking
• New business ecosystems, where partners consume and share mutual services
• Monetization of digital banking functionality via the API-as-a-Product model where API acts as SaaS
• Growing adoption of modern microservices architectures, where API management is essential
• The need to comply with Open Banking regulations and PSD2 in the EU markets.

Key Capabilities of API Management Platforms

API Gateway

API gateway acts as a unified entry point to the connected systems and services. It receives API requests from third parties, passes them to the provider’s back-end system, and returns the response to the requester. In essence, it’s a dedicated operations center that lets users view and administer the APIs. The API gateway is also used to perform important security functions, such as identity and access management and enforcement of security policies. Furthermore, it can facilitate API traffic management via caching, API throttling, and aggregate API data for further analytics.

Developer Portal

The API developer portal is a centralized knowledge management hub with self-service capabilities. It stores all relevant API documentation, schemas, tutorials, sample code, and development kits, thus serving as a single source of truth for developers. API providers can use the portal to streamline collaboration across their in-house IT teams, and simplify the process of building, testing, and deploying APIs. In addition, the portal can be customized to match the API provider’s brand and provided as a reference guide to third-party developers.

API Lifecycle Management

Lifecycle management is an integral part of any API management platform, which helps organizations control and coordinate the complete lifespan of APIs – from planning and design to decommissioning. It includes a collection of tools that are used to create and document APIs, apply security policies, test, debug, and deploy APIs into production. Lifecycle management ensures that each API is consistent, reusable, and aligned with the API governance models.

Stages of the API Lifecycle

Source

Performance Monitoring & Analytics

API management platforms have built-in monitoring, analytics, and reporting tools that track the availability and overall performance of APIs. These tools gather, process, and visualize different types of data from API gateways, including resource consumption, average response time, traffic volume, etc. Besides optimizing API performance, the gathered data can be used to rapidly troubleshoot issues, such as traffic errors or network failures.

API Monetization

API management platforms offer a wide range of features that help enterprises facilitate API monetization. API providers can form and publish packages of API products, create flexible pricing plans, and configure different billing options based on API usage or functionality. On top of that, API management platforms may be used to issue invoices and collect API purchase payments.

Benefits of Implementing API Management Platforms

The core capabilities of API management platforms are essential to sustain a robust API ecosystem that connects employees, business partners, and customers. Banks that harness these capabilities and manage all their APIs in a single centralized platform can unlock the true value of their digital assets and access a myriad of tangible benefits, such as:

Enhanced Business Agility

With centralized API lifecycle management and a developer portal, you can develop, test, and iteratively publish new APIs, as well as adjust the existing APIs. This helps to meet the ever-changing customer demands and adapt to new business needs as you can rapidly create new services or combine them to build modern API-based solutions.

API management platforms can also serve as an efficient pre-sale tool that may significantly accelerate the time-to-market of your financial products. For example, you developed a payment system and applied for a tender from a retailer who wants to integrate online payments into his website. Previously, the retailer would have had to sift through vast volumes of technical documentation and then select one of the offered systems. Now you can provide access to your bank’s API gateway in a test mode to the retailer for a hands-on assessment, which is a lot more convenient and compelling.

Optimized Time & Costs with Workflow Automation

API management solutions can help you spare a tremendous amount of time and costs by automating various types of workflows. Depending on the platform, you can apply automation across API documentation, monitoring and analytics processes, or API testing. In addition, you can increase the job satisfaction of your API developers by redirecting their efforts to meaningful tasks, while the platform performs all the routine work. Another important benefit is that API management platforms allow implementing API integration solutions, which can automate a wide range of complex business workflows.

Informed Decisions & Exceptional Customer Experience

API management platforms generate valuable business insights about API consumers, including usage patterns, buying behavior, and preferred digital channels. You can use this data to make better strategic decisions, deliver hyper-personalized services, improve existing financial products, and create new revenue streams.

Reinforced API Security

API management solutions ensure the ultimate safety of all your APIs and transactions between different systems, environments, and partners. You can mitigate both internal and external threats by enforcing powerful security protocols and utilizing advanced identity and access management tools. Many platforms also include real-time anomaly and fraud detection, which can further strengthen your security posture.

When Is the Right Time to Adopt an API Management Platform?

API management may not be essential for SME banks with low API maturity and a small IT team that develops REST APIs for ad-hoc needs. However, if you decide to employ more APIs to create and deliver new financial services or expose your services via a third party, API lifecycle management becomes business-critical. Imagine you want to integrate your credit services into a website of a car trading company. To ensure a seamless integration and error-free functionality, your APIs must be thoroughly designed, protected, tested, and monitored for performance issues. The entire process becomes a lot faster and easier with an API management platform at hand.

Security concerns are an important wake-up call for adopting an API management platform. As organizations expose more critical business services via internal or external APIs, the attack vector naturally increases. As a result, threat actors are increasingly targeting their attacks on the API layer. With the help of an API management platform, you can eliminate the majority of API security vulnerabilities and mitigate sophisticated threats, such as SQL injections or DDoS attacks.

Lastly, the adoption of an API management platform is imperative if you plan to migrate to the cloud and replace your monolithic architecture with microservices. The crux of the matter is that a microservices architecture incorporates a large amount of small self-contained services, each serving a single task, and operating via a specific API. Such a large pool of services and APIs cannot be properly controlled without a dedicated management solution.

Best Practices for Selecting the Perfect Platform

The adoption of an API management platform is a significant investment that requires thorough planning. Prior to selecting the solution, it’s important to assemble an API team, prioritize your API business value (new revenue streams, innovation, etc.), and develop a solid API strategy.

Read our blog post “Whys and Hows of API Strategy for Banking” to learn about the key aspects of developing a successful API strategy.

Once the API strategy is settled, you can proceed with selecting a platform that resonates with your goals, suits your existing architecture, and includes all the required technical capabilities. To simplify the process, you can create a checklist of key platform capabilities that are important for your business case. The key points to consider include, but are not limited to:

• Which developer portal customization options and workflows are available?
• Development capabilities – which data sources can be used? How are API specifications created? Does the platform work with non-REST APIs?
• Which security standards are supported by the platform? What tools are used for data protection and user identity and access management?
• Does the solution support direct or indirect API monetization?
• What analytics capabilities are available? Is the platform capable to perform real-time API monitoring?

To spare your time, in the next section of this blog post, we offer a brief overview of five market-leading API management platforms, including their core capabilities, benefits, and drawbacks.

Overview of Top 5 Modern API Management Platforms

We have based our overview of the leading API management platforms on Gartner Magic Quadrant for Full Life Cycle API Management 2021 –advanced research that profiles API management solution vendors to help businesses judge how various solutions align with their business needs. Gartner evaluates API management platforms by their core capabilities, various use cases, vendor response, and customer feedback.

Gartner’s Quadrant for API Lifecycle Management Solutions

Source

Microsoft Azure API Management

Azure API Management is a holistic solution that allows deploying and managing APIs across cloud, on-premises, or hybrid environments. The platform provides an API gateway that is used to perform API throttling, caching, routing, and other essential tasks. Moreover, it includes a self-hosted API gateway – an optional containerized version that can help you optimize API traffic and facilitate compliance.

Azure API management also features an intuitive management plane that is used to control the entire API lifecycle, and a highly customizable developer portal where you can view API documentation, manage keys, and access API analytics. In addition to supporting various security policies, the platform can be integrated with Azure Active Directory, Azure Monitor, and Azure Key Vault to reinforce API protection.

Azure API management is available in different tiers – Developer, Basic, Standard, and Premium. Each tier includes a diverse set of capabilities, integration options, and pricing plans that depend on the number of API calls.

To summarize, the benefits of Azure API management include robust lifecycle management capabilities and API security, as well as flexible adoption plans. However, the platform does not report on some API ecosystem metrics, and has limited third-party integration options.

IBM API Connect

IBM API Connect comprises four key components – API gateway, API manager, API analytics, and a feature-rich, fully customizable developer portal. The platform supports on-premises, multi-cloud, and hybrid deployment options. Most importantly, it offers an all-embracing toolkit for designing, implementing, and managing not only REST APIs but also SOAP and GraphQL APIs. Moreover, IBM offers extensive API versioning features, such as version rollback and change of governance policy versions.

IBM API Connect puts a strong emphasis on API testing and security. The platform can generate and execute API test cases and has built-in AI capabilities that identify any gaps in API tests. IBM’s API management solution supports a broad spectrum of security standards, including OAuth 2.0, OpenID Connect, SAML, WS-Security, and others.

Platform users surveyed by Gartner indicate that IBM API Connect is a high-performing and secure platform, yet it has certain upgrading and patching complexities and is hard to navigate in container-based environments.

Google API Management (Apigee)

Apigee is an API lifecycle management platform based on the Google Cloud Platform (GCP). It offers two developer portal options –configuration-driven and Drupal-based, which enables more complex customizations. The platform supports REST, SOAP, GraphQL, and gRPC APIs and has a fully managed API gateway. API security is among the key strong points of Apigee. The platform incorporates a range of powerful tools that quickly identify security vulnerabilities, cyberattacks, and malicious traffic.

Other benefits that make Apigee stand out are substantial support of API monetization and BFSI-focused capabilities. The platform features Apigee Open Banking APIx – a dedicated solution that ensures the swift and secure delivery of APIs aligned with PSD2 as well as banking-specific API documentation in the developer portal.

Apigee has flexible pricing plans, including a pay-as-you-go model and three tiers of subscription plans – Standard, Enterprise, and Enterprise Plus.

Despite its tangible benefits, Apigee requires extensive configurations in a hybrid deployment model, and the platform’s advanced features, such as AI-driven API management, AI-based security, and API monitoring are available only in cloud environments.

Amazon API Gateway

Amazon API Gateway is an efficient API management platform that allows to develop, maintain, and monitor RESTful and WebSocket APIs. It offers an intuitive administrative interface and a customizable, serverless developer portal. API Gateway includes a broad spectrum of API management features, namely performance monitoring, throttling, version and traffic management, and robust identity and access management tools. The platform is a good choice for organizations that utilize AWS services, as it can be seamlessly integrated with AWS Lambda, Kinesis, Dynamo DB, EC2, and other cloud services. API Gateway is billed only via a pay-as-you-go model that depends on the number of API calls.

Amazon API Gateway is a good choice for AWS users but may not suit organizations that have hybrid or multi-cloud APIs, as the platform can be deployed only in AWS environments. Furthermore, it has limited support of API monetization.

WSO2 API Manager

WSO2 API Manager is an open-source platform that enables API lifecycle management across on-premises, cloud, hybrid, and containerized environments. It offers an advanced, customizable developer portal that ensures simple and secure API consumption. Other key components of WSO2 include:

• Management plane – used for API development, management, monitoring, and monetization.
• Data plane – acts as a proxy for API calls and exposes the provider’s digital assets to consumers.
• Control plane – covers all API security processes, including key management, traffic control, and anomaly detection.

WSO2 has a dedicated Open Banking offering that helps financial institutions meet the regulatory requirements either through direct support of WSO2, or its ecosystem of partners.

The platform has numerous subscription plans – Micro, Standard, and Custom. Each plan has a different annual billing rate that is based on the number of API calls.

The cautions for WSO2 API Manager adoption include a strong focus on integrations with other WS02 solutions, which may lead to product dependencies and insufficient metrics for measuring API business value.

Conclusion

Recognizing that APIs have become a fundamental aspect of modern financial services and a catalyst for innovation, banks are rushing to develop an API strategy. Yet, this is only the first step. To truly thrive in the surging API economy, you must move forward and ensure complete control over the lifecycle of your APIs. This can be achieved by adopting an API management platform, which is the foundation for becoming an agile, resilient, and competitive financial services provider.

Infopulse offers expert API management consulting along with the implementation, customization, and integration services for Microsoft Azure API Manager, WSO2 API Manager, and other platforms.  We also provide a wide range of API security services, including API discovery and audit, API monitoring, firewall and runtime policy enforcement, API security assessment, and security hardening.