Welcome!

Java IoT Authors: Liz McMillan, Yeshim Deniz, Elizabeth White, Zakia Bouachraoui, Pat Romanski

Related Topics: @DevOpsSummit, Linux Containers, @CloudExpo

@DevOpsSummit: Blog Feed Post

Top 11 Misconceptions About APIs By @PaulSBruce | @DevOpsSummit #API #DevOps

APIs permeate the connected world, used by technical and non-technical professionals alike

by Paul Bruce

APIs permeate the connected world, used by technical and non-technical professionals alike. At some point, we all work with APIs, building them, selling them, maintaining them and consuming them. With so many viewpoints and opinions, misconceptions can quickly emerge, clouding the decision-making process and hindering execution of improvements to the business of API delivery.

This article focuses on dispelling some of the most common myths around the API lifecycle, so that you don't fall at the mercy of misinformation in your own process. The points in this article are graciously lent by Ole Lensmar, CTO at SmartBear, based on his recent talk at AppsWorld North America on the topic.

Myth #11: APIs only solve a technical problem
APIs don't have buttons and flashy graphics, but that doesn't diminish their importance to non-developers. Business decision makers all need to know that APIs can speed time-to-delivery by compartmentalizing work projects, providing well-modeled 11 myths of apis 1data to business users through spreadsheets, and even act as their own product in the data economy.

If your organization has pigeon-holed APIs to be a geeky, technical asset solely existing for the benefit of the developer, you may find that simply sitting down with the right non-technical business owner, say the CTO or Director of IT, is just the kick start you need to break through this misconception. A 15-minute review of the non-technical reasons that APIs are a big deal to everyone in your organization might be just what the doctor ordered.

Myth #10: APIs are secondary to a business
Even if APIs are perceived as just "glue" for your organization, or if instead of shipping a public API you use them internally, integrations between systems are a vital part of the health and function of a business.  Just ask11 api myths 2 the finance department to go without a few critical integrations that depend on APIs, and you'll see how quickly business as usual will come grinding to a halt.

Similarly, many organizations use some form of traditional database scheme behind the scenes. You wouldn't call the code and queries in the database "secondary" to the business, and so you shouldn't when it comes to the APIs that connect the systems an organization uses. Every company is a tech company in the information age, and understanding the importance of the working components underlying your business model protects you from bad or uninformed decisions when it comes time to change.

Myth #9: Their API will always be available
Do you think that third-party API you just integrated with will be around forever? API companies, especially those who only produce APIs, can very quickly crumble unless they have a healthy ecosystem and leadership to back them.You must choose your third-party integrations wisely, because if they happen to fold, you may be in for quite the scramble to find another API provider that meets your technical needs and financial requirements.

And if you think you're safe integrating with the big players such as Google APIs, Twitter, and Amazon - guess what? You're not. While it's not likely that they'll experience a catastrophic collapse,11 api myths 3 these companies do change their public API schemas regularly. If you're not paying attention, your integration with large providers might break due to these changes. It's also important to consider that you hold far less authority as one of countless other API consumers to a popular API, so your vote on how these APIs change (if you even get a vote) may count far less than if you were to integrate with an API provider that really depends on your subscription to their services.

Myth #8: Our API can't be hacked
Just because you haven't been hacked yet, or you have taken what youbelieve are adequate measures to protect misuse of your API, rest assured your API will be the target of hacking attempts from malicious users and bad actors.

It happens all the time in the news - just consider the Moonpig breach and constant attacks on companies like Uber and Tinder, as a clear sign that public APIs constitute just as much of a security problem as any other web or mobile app. Certainly the folks at Uber thought about security before releasing their API publically, but through elbow grease and malicious intent, hackers still found a way to misuse their APIs. If you are publishing a public API, it's important to bake in time to review your API for conformance to guidelines like the Top 10 OWASP scans for REST or SOAP web services.11 api myths 4

Myth #7: Their API can't be hacked
Each of the points above applies when you think about integrating with 3rd party APIs as well. If they don't have a zero-day response policy, you may want to reconsider trusting your data with their web service. Also be wary of API providers that present compliance at a point in time, but aren't willing to go into detail with you about their continuous security process. If they're not constantly ensuring the conformance they tout, then they might not even know they've been breached.

Trust no one. Be vigilant. Demand the same from others.

Myth #6: SSL + OAuth is enough
Thorough security is never locked to one layer, so it's important to have multiple layers of security considerations in place in order to deter hacking attempts and reduce single-point vulnerabilities. Relying too heavily on a single 11 api myths 5layer such as SSL as a transport security mechanism or OAuth as an authorization pattern, without considering network-level or data-level vulnerabilities, will make it very easy for hackers to play along with the few mechanisms you've established until they find an unprotected aspect of your system to exploit.

Just consider the bearer token exploit, in that without SSL the entire authentication process is bogus. There are other common vulnerabilities too, but the overarching theme is that your approach to securing your APIs must be multi-layered. Using OAuth + SSL might be a major step in the right direction, especially if you use something as arcane as Basic authentication, but it's just one step. Make sure you take the next one soon as part of your deployment or maintenance plans.

Myth #5: Metadata is bad
Put simply, the idea that Metadata is bad is patently false. Metadata is just ‘other information' than the primary data of purpose. Common programs such as Microsoft Office, for instance, produce lots of metadata; the primary data is the content that you include in your document or spreadsheet, whereas the metadata is author and origin information, credentials to underlying data sources, and other information that becomes associated 11 api myths 6with a document throughout its creation, but is usually not exposed within the document itself.

API metadata can be considered critical to the primary function of the API but this data is exposed in non-standard methods to the way that primary data is delivered. Metadata can exist in the form of custom headers to abate the process of baking new functionality into the existing HTTP body schema or specification.  So long as everyone using the API understands why ‘metadata' exists separate from traditional ‘data,' all metadata is data. Use it wisely.

Myth #4: You need to adhere to REST principals
One of the most constraining business practices is to follow strict adherence to some form of guidelines even when they don't make sense for a given situation. REST11 api myths 7 principals are great and all, but REST lacks pretty important things like a built-in formal schema definition and bolt-on standards for doing security (WS-Security, WS-Trust), distributed transactions, and asynchronous processing (JAX-WS).

Regardless of whether you have SOAP or REST services, you should be willing to consider the context by which you apply architectural principals. Using REST as a canon on how to build APIs misses the point of REST: build what is appropriate based on thoughtful consideration of the domain.

Myth #3: Top-down creation of APIs is only for elaborate architectures
Not so! APIs come in all shapes and sizes, especially in the enterprise. Rewriting small portions of infrastructure one at a time is often the only way teams can make headway in migrating from a monolithic web service approach to a more scalable, maintainable model like Microservices.

11 api myths 7If you're trying to partition a class of problems that are thematic throughout your infrastructure, then yes, a top-down approach is often a good thing to try...on the whiteboard...with the rest of your team. The most effective APIs are designed with the consumer in mind, which is great news for people who like to think about their designs before getting lost in implementation details. Even the smallest API should be well thought through, and taking a top-down approach to API design at each opportunity can help to improve the consumer experience and the overall landscape of your API infrastructure, one endpoint at a time.

Myth #2: Nobody uses SOAP
This could be one of the most prevalent API misconceptions that exist today, but it grossly misrepresents the current API economy. Plenty of organizations have existed well before the existence of REST APIs and have been through programming era after era. 11 api myths 9SOAP was the only option in the early SOA days, obtaining both mass adoption in the enterprise as well as years of ecosystem support and tooling. Now, of course, there is a shift away from SOAP for applications and devices that are designed to trade formality for agility. But much of our world is built on XML, no matter how hard we want to move on.

Most notably are organizations that employ a formal back-end, an enterprise service bus (ESB), where many ESB vendors have standardized on XML documents as a native structured input and output format. Building APIs that use SOAP naturally fits in to this kind of ecosystem, and makes sense for teams where the informalities of REST/JSON aren't feasible due to compliance or regulatory concerns.

Myth #1: Our API works!
How do you know this? Do you have proof such as proper test coverage, both positive and negative condition checks in your tests, and are you monitoring your APIs to see exactly what the uptime percentage really is?

The fact is, most API development teams build and ship without proper testing or monitoring practices to ensure that the API being delivered does exactly what it's supposed to do, reliably and safely. Maybe another project takes priority, the "quality analysis" problem is offloaded to another group, or the problems in production are a known quantity solved by a workaround.

The only way you don't fall into the hazards of thinking your API works when it really doesn't is to proactively test to prove that your API stands up to the challenge.

Read the original blog entry...

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

IoT & Smart Cities Stories
SYS-CON Events announced today that Silicon India has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Published in Silicon Valley, Silicon India magazine is the premiere platform for CIOs to discuss their innovative enterprise solutions and allows IT vendors to learn about new solutions that can help grow their business.
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use of real time applications accelerate, legacy networks are no longer able to architecturally support cloud adoption and deliver the performance and security required by highly distributed enterprises. These outdated solutions have become more costly and complicated to implement, install, manage, and maintain.SD-WAN offers unlimited capabilities for accessing the benefits of the cloud and Internet. ...
Founded in 2000, Chetu Inc. is a global provider of customized software development solutions and IT staff augmentation services for software technology providers. By providing clients with unparalleled niche technology expertise and industry experience, Chetu has become the premiere long-term, back-end software development partner for start-ups, SMBs, and Fortune 500 companies. Chetu is headquartered in Plantation, Florida, with thirteen offices throughout the U.S. and abroad.
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buye...
Business professionals no longer wonder if they'll migrate to the cloud; it's now a matter of when. The cloud environment has proved to be a major force in transitioning to an agile business model that enables quick decisions and fast implementation that solidify customer relationships. And when the cloud is combined with the power of cognitive computing, it drives innovation and transformation that achieves astounding competitive advantage.
DXWorldEXPO LLC announced today that "IoT Now" was named media sponsor of CloudEXPO | DXWorldEXPO 2018 New York, which will take place on November 11-13, 2018 in New York City, NY. IoT Now explores the evolving opportunities and challenges facing CSPs, and it passes on some lessons learned from those who have taken the first steps in next-gen IoT services.
Cloud-enabled transformation has evolved from cost saving measure to business innovation strategy -- one that combines the cloud with cognitive capabilities to drive market disruption. Learn how you can achieve the insight and agility you need to gain a competitive advantage. Industry-acclaimed CTO and cloud expert, Shankar Kalyana presents. Only the most exceptional IBMers are appointed with the rare distinction of IBM Fellow, the highest technical honor in the company. Shankar has also receive...
DXWorldEXPO LLC announced today that ICOHOLDER named "Media Sponsor" of Miami Blockchain Event by FinTechEXPO. ICOHOLDER gives detailed information and help the community to invest in the trusty projects. Miami Blockchain Event by FinTechEXPO has opened its Call for Papers. The two-day event will present 20 top Blockchain experts. All speaking inquiries which covers the following information can be submitted by email to [email protected] Miami Blockchain Event by FinTechEXPOalso offers sp...
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
@DevOpsSummit at Cloud Expo, taking place November 12-13 in New York City, NY, is co-located with 22nd international CloudEXPO | first international DXWorldEXPO and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time t...