API Management

Overview
Definition
• An API Gateway provides a central access point for managing, monitoring, and securing access to
your publicly exposed web services. It would also allow you to consolidate services across
disparate endpoints as if they were all coming from a single host. For example let's say you had
ten different service endpoints that were all part of a single "suite" of services. Rather than
informing consumers of your service to use service1.yourcompany.com for one service and
service2.yourcompany.com for another and so forth, you can instead have them all point to
api.yourcompany.com/service1 or api.yourcompany.com/service2 and the gateway would be
responsible for redirecting the requests to the appropriate endpoints.

• An ESB is an internal "Bus" that allows applications and services to communicate with each other
in an uncoupled fashion. All applications can hook into the bus and they can receive any message
that interests them when published by another application. They can also publish their own
messages that another application may listen for and respond to. The applications are not
responsible for connecting with each other directly, they publish their messages to the bus and all
interested parties listen and react.

• Logically the API Gateway is not a replacement for an ESB but rather an enhancement for a
service oriented architecture in the application integration environment.
 ESB Comparison
Capabilities Oracle SOA Suite 12c IBM Websphere ESB Red Hat Jboss Fuse
Connectivity Cloud adapter to other Apps, Services and Platform Cloud Adapter such as AWS Cloud Services,
Social Media (Facebook, etc)
Adapter to on-premises Apps (Oracle Application, SAP Provide adapter for Email, Flat Files, FTP, Adapter to SAP Applications, Salesforce
Applications, Microsoft Application, etc.) JDBC, JD Edwards Enterprise One, Oracle E-
Business Suite, Siebel Business Application,
SAP Software
Technology adapters : SOAP, REST, FTP, Files, Support JMS 1.1, SOAP/HTTP, SOAP/JMS, Technology adapter to many Database
Database, AQ, Tuxedo, VSAM, CICS, IBM MQ Series WSDL 1.1, UDDI 3.0 Service Registry, vendors, Active MQ, etc
and JMS through WebSphere Intergration Developer,
WS-* Standars inclduing WS-Security, WS-
Atomic Transactions
B2B Connectivity support EDI, ebXML, RosettaNet,
Managed File Transfer (MFT)
Service Virtualization & Provide Enterprise Service Bus. Developer can create WebSphere ESB manages the flow of The JBoss Enterprise SOA Platform is a
a standard API for any backend system, from messages between service requesters and framework for developing enterprise
Mediation mainframe to ERPs including REST/JSON API to mobile service providers. Mediation modules within application integration (EAI) and service-
application the ESB handle mismatches between oriented architecture (SOA) solutions. It is
requesters and providers, including protocol made up of an enterprise service bus (JBoss
or interaction-style, interface and quality of ESB) and some business process automation
service mismatches. In an SCA-based infrastructure. It allows you to build, deploy,
solution mediation modules are a type of integrate and orchestrate business services
SCA module. The mediation modules (JBoss ESB)
perform a special role, and therefore have
slightly different characteristics from other
components that operate at the business
level.
Orchestration Provide BPEL Process Manager Provide BPM (JBpm)
Provide Oracle Business Rules Provide Business rules engine (JBoss Rules)
Analytics Provide Business Activity Monitoring (BAM)
Provide Event Processing
 API Gateway Comparison
Capabilities Oracle API Platform IBM API Connect Red Hat 3scale Axway API Getway CA API Getaway
Key features Apiary Mock Server - Quickly model an API Use automated, visual and coding 3scale is designed to scale to billions of ƒAPI creation and virtualization Security: Passed rigorous vulnerability
on Apiry's hosted server to make sure that options to rapidly generate Swagger API calls and its distributed architecture ƒDrag-and-drop policy creation tests, and integrates with any popular
everyone Is on-board compliant APIs from backend ensures no single point of failure. Scale to ƒIntuitive graphical “flow chart” policy IAM system with support forOAuth, SAML
sources. Using API Designer, you can meet demand easily by adding more metaphor and RADIUS.• Performance and Scale:
Apiary Interactive Documentation - Takes create a REST API using the LoopBack proxy instances, or choose a CDN ƒLibrary of over 200 pre-built policy Clustered architecture allows linear
the API description and allows not only read Node.js framework. You can use Docker deployment and push content to operations scalability across multiple Gateways, with
and write, but also interact with the API - to manage the runtime of Node.js, Swift worldwide edge-nodes to speed access. ƒPolicy property store with graphical automatic failover. Includes application
evern before it is built and Java microservices. API Connect also Our layered architecture delivers schema editor for simplified level throttling and prioritization.•
API Implementation - Build new APIs using offers a comprehensive set of public APIs outstanding performance, even at high development of dynamic metadata- Manageability: Handles migrations across
Apiary UI for CI/CD integration and automation. volumes. driven policies dev/test/production with global
API Deployment - Deploy, Activate, ƒInteractive API testing tool management tools, and integrates with
Deprecate, and Remove APIs ƒIntegration with Axway API Portal for enterprise BI, analytics, and reporting
API Inventory & Catalog - Know which APIs developer onboarding and tools.• Flexibility: Multiple form
are available for use management, and API development, factors/deployment models with support
Application Registration & Management - registration, for a wide range of platforms, including
Manage the applications using your APIs to publication and lifecycle management Docker, AWS and Azure. Provides
ensure proper usage ƒSelf-service API and web service protocol bridging across legacy and new
Operational Analytics - 10 pre-built charts to consumption systems, and includes content-based
see, ie : who is using your API, how, and if ƒIntegration with API/SOA routing.• Extensibility: Plug-in framework
they are encountering issues repositories and registries to add new transports and identity
Policies - Top security, quality of service, and providers, and deep integration with
routing policies enterprise management and BI products.
User Roles & Grants - Control access to your
APIs with API-level entitlements
Security Authentication and API Autorization Set up access control over APIs for both 3scale’s powerful API access, policy and ƒNIST FIPS- and NSA Suite B-compliant Secures your corporate assets with
Threat Protection API providers and consumers by using traffic controls make it simple to modes central access control. Integrates with
Threat Detection & Alerting role-based permissions, API packaging authenticate traffic, restrict by policy, ƒEmbedded API Firewalling engine most IAM systems and supports
Roles and Grants constructs, and subscription and protect backend services, impose rate ƒSafeNet Luna HSM (hardware OAuth/OpenID Connect, FIDO, PCI-DSS,
community management limits and create access tiers. Provide security module) integration FHIR and PSD2. Broad coverage for your
Enforce built-in and user-defined policies sophisticated support for authentication ƒOut-of-the-box integrations with all diverse infrastructure enables you to
at runtime. Monitor the set of rules and with API keys, OIDC tokens or custom the leading identity management seamlessly bridge security standards and
conditions that govern the API to ensure configs. Classify different types of users vendors, such as CA, IBM and Oracle solutions between consumers and
it is fulfilling its intended purpose, and and provide a variety of business services. ƒCustomizable authentication policies providers.
make adjustments if necessary Application plans help control what can for any API or web service registered
be done with your API. Rate limits allow in the API catalog
Retire and archive APIs when appropriate
you to manage and control flow. ƒOAuth token-based authorization
 API Gateway Comparison – cont’d
Capabilities Oracle API Platform IBM API Connect Red Hat 3scale Axway API Getway CA API Getaway
Agility Quickly changes APIs and their policies
to enable rapidly introduction or
modification of services or applications
Analytics General - Provide overall analytics on Access API usage analytics for both With 3scale you can share API Configurable logging of any
all API transactions (succesful, rejected API providers and consumers, with analytics across the organization API transaction data
and error transactions). Provides runtime and historical reporting on with clear reporting. Use the Real-time system monitoring
detailed information on request usage patterns and performance standard metrics or enhance these Alerting based on errors,
volumes, response times, paylod sizes metrics and customizable to support your exact needs. exceptions and thresholds
and requests by resources dashboards and easy offloading to Monitor and set customized alerts Transaction tracing and root
third-party tools. You can filter, sort to send reports and emails. cause analysis
and aggregate your API event data, Metrics are accessible via API to API usage analysis
and then present the results within include in standard business Automated generation and
correlated charts, tables and maps dashboards or reports. delivery of reports
to help you make informed Integration with log and
decisions. Gain insights into which system management tools
APIs are having the largest impact
on your organization's API program.
Applications - Provides analytics based
on different applications invoking APIs.
Includes information on requests,
rejections and errors for different
applications
Rejection and Errors - Provides
analytics on rejections rates, rejection
distributions, error distributions and
error rate for requests, responses and
service invocations