Rapid Api Prototyping

•

3 likes•1,259 views

How many of you have created an API? But how many created a good API? A good API is like a good meal, makes developers extremely happy with a belly full - and for some companies who are API first having a simple, documented, reliable API is crucial. When developers complain about your API it is maybe because you didn't design it well enough - intentions are surely important but design is king. The Rapid API Prototyping talk, is all about bridging the gap between thinking and doing with focus on best practices, tooling and tricks to make developers LOVE your API at first sight.

Engineering

@orliesaurus
Rapid
API
Prototyping
Do it right!

@orliesaurus
Building a good API is hard

@orliesaurus
API Development LifeCycle
Design
Mock
Test
Build
Release
Maintain

@orliesaurus
API Considerations
Authentication
Versioning
Sync/ASync
Pagination
Caching
Rate-Limiting

@orliesaurus
API Considerations
XML vs JSON
Nomenclature
Error Msgs (HATEOAS)

@orliesaurus
Mocking
WADL -> XML
Swagger -> JSON
IODocs -> JSON
RestDoc -> JSON
APIBlueprint -> Markdown
RAML -> YAML

$@orliesaurus Clean Example: RAML /beers: /{beerName}: get: description: Retrieve a specific beer responses: 200: body: application/json: example: | { "data": { "id": "b33rg00d", "name": "Duvel", "description": "A nice belgian beer”, "datetime": 1341533193, "genre": "Belgian", "producer": "DUVEL INCORPORATED", "label_img": "https://s3.amazonaws.com/beerbrah/uploads/images/525446/duvel.png", }, "success": true, "status": 200 }$

@orliesaurus
APIs are for Automa..
Humans

@orliesaurus
Rails/Rails-Api
Express (Node)
Node-Restify
Flask(Python) / Flask-Restful (thx Twilio)
Falcon (Python)
Pecan (Python)
Werkzeug(Python)
Interfake (Node - @basicallydan )
slimframework (PHP)
Laravel (PHP)

@orliesaurus
Hello Humans,
We’re here to help
HTTPie - cURL for humans
POSTman - Chrome addon
Advanced REST Client - Another addon
CocoaRESTClient - Mac ONLY

“An API should only do one single thing and do
it extremely well”
@orliesaurus
Value

Ease of use = (Best Practices + Documentation +
Code Snippets)
@orliesaurus
Value

@orliesaurus
Testing and Performance
(Keep an eye on the metrics)

@orliesaurus
Value
Performance
Scalability

What's hot

Kubernetes ecosystem is seeing adoption across the industry and is on the path to becoming the de-facto orchestration platform on modern cloud service delivery. Kubernetes not only provides primitives for deploying run microservices in the cloud but goes one step further and helps you define interactions and lifecycle for your APIs. The Ingress API in Kubernetes allows you to expose your microservice to the outside world and define routing policies for your north-south traffic (or traffic coming into your virtual data center). We invite Harry Bagdi, Sr. Cloud to discuss in-depth about the design and why of Ingress resource, the benefits of using Ingress to manage your API lifecycle using CI/CD pipelines, and how you can accomplish Ingress using a popular open-source solution, Kong. Kong’s Ingress Controller implements authentication, load-balancing, traffic throttling, transformations, caching, metrics, and logging across Kubernetes clusters.

Kuberntes Ingress with Kong

Nebulaworks

Presentation security automation (Selenium Camp)

Artyom Rozumenko

Service mesh is a dedicated layer of a company's infrastructure which should simplify communication between services and make it reliable, secure and observable. In this talk, we'll go deep into Booking.com's case study of introducing service mesh. We will discover the reasons and objectives of the project. Why Envoy was selected as the base rather than other available options. Find out what is the setup and features of the homegrown control plane. We will expand on what service is provided for developers and how they safely deploy potentially dangerous configuration changes. Finally, we will talk about pitfalls met along the way.

Introducing envoy-based service mesh at Booking.com

Ivan Kruglov

Mastering Microservices with Kong (CodeMotion 2019)

Maarten Mulders

ZMON: Monitoring Zalando's Engineering Platform

Zalando Technology

Altitude SF 2017: Logging at the edge

Fastly

So you think JSON is cool?

Herval Freire

Kong API

Patrick Pierson

About the webinar The use of an API gateway and the move to microservices are two of the most important trends in application development. But are they similar, or different; complementary, or contradictory? In this webinar, we discuss the advantages of an API gateway, the advantages of microservices development, and how and when they can work together. The NGINX Microservices Reference Architecture (MRA) uses three different network architectures, with service mesh as a fourth. We describe how an API gateway relates to each of these network architectures and how to reduce rework if your application needs to evolve from one architecture to another. Speakers: Charles Pretzer, Technical Architect, NGINX, Inc. Floyd Smith, Director of Content Marketing, NGINX, Inc.

Using an API Gateway for Microservices

NGINX, Inc.

Secrets are indisputably the biggest risk area in the authentication arena and Apache Kafka is no exception. Kafka services are typically configured using properties files which contain plain text secret configurations, upon startup these configurations are transmitted in clear text to different components, stored in filesystem, internal topics and logs thus creating a secret sprawl. This talk will deep dive into how we can eliminate this secret sprawl by adding Config Providers to integrate with centralized management systems such as Vault, Keywhiz, or AWS Secrets Manager. We’ll cover Security implications of clear text secrets and secret sprawl Insecure parsing of secrets configurations in Kafka Know how about Kafka Config Providers Centralized Management Systems How to secure Kafka with CP and CMS Trust but Verify ~ Demo

Overcoming the Perils of Kafka Secret Sprawl (Tejal Adsul, Confluent) Kafka S...

confluent

Planet9energy.com is a new electricity company building a sophisticated analytics and energy trading platform for the UK market. Since the earliest draft of the platform, we took the unconventional decision to go serverless and build the product on top of AWS Lambda and the Serverless framework using Node.js. In this talk, I want to discuss why we took this radical decision, what are the pros and cons of this approach and what are the main issues we faced as a tech team in our design and development experience. We will discuss how normal things like testing and deployment need to be re-thought to work on a serverless fashion but also the benefits of (almost) infinite self-scalability and the piece of mind of not having to manage hundreds of servers. Finally, we will underline how Node.js seems to fit naturally in this scenario and how it makes developing serverless applications extremely convenient.

Building a Serverless company with Node.js, React and the Serverless Framewor...

Luciano Mammino

Nginx Deep Dive Kubernetes Ingress

Knoldus Inc.

Kong is a lightweight, cloud-native API solution that makes it easier and faster than ever to connect APIs and microservices in today’s hybrid, multi-cloud environments. With its agnostic, flexible deployment approach, Kong can be used in today’s heterogeneous IT system landscapes to integrate a wide variety of data and systems – even across company boundaries – using APIs. In addition to REST APIs, Kong also offers support for gRPC and GraphQL, which broadens the possibilities to implement modern application architectures. In this presentation, we will discuss deployment patterns and use cases for Kong to demonstrate the flexibility of the platform. Using a practical example, aspects of the API development and deployment process as well as the integration in existing software development processes will be discussed.

Flexible, hybrid API-led software architectures with Kong

Sven Bernhardt

Gatekeeper: API gateway

ChengHui Weng

Stress Testing at Twitter: a tale of New Year Eves

Herval Freire

API Gateway study

Rafael Gonzaga

DevOps Braga #15: Agentless monitoring with icinga and prometheus

DevOps Braga

NGINX is one of the most popular images on Docker Hub and has been at the forefront of the web since the early 2000's. In this talk we will discuss how and why NGINX's lightweight and powerful architecture makes it a very popular choice for securing containerized applications as a sidecar reverse proxy within containers. We will highlight important aspects of application security that NGINX can help with, such as TLS, HTTP, AuthN, AuthZ and traffic control.Additional Sponsor InformationDuring our session we will be Raffling off a swag pack to live attendees. We'll also be offering 30% off our swag store that can be shared via social. Details below:URL: swag-nginx.com Code: DOCKERCON30 Value: 30% off

DockerCon Live 2020 - Securing Your Containerized Application with NGINX

Kevin Jones

On-Demand Recording: https://www.nginx.com/resources/webinars/whats-new-nginx-ingress-controller-kubernetes-version-150/ Kubernetes is the leading orchestration platform for deploying, scaling, and managing containerized applications. Infrastructure operators constantly impose new application delivery requirements as they adopt Kubernetes for production workloads. The NGINX Ingress controller is the most popular ingress load balancer for Kubernetes, providing a complete and supported solution for delivering your containerized applications to clients. Attend this webinar to learn about the latest developments in NGINX Ingress Controller for Kubernetes Release 1.5.0.

What’s New in NGINX Ingress Controller for Kubernetes Release 1.5.0

NGINX, Inc.

On-Demand Link: https://www.nginx.com/resources/webinars/analyzing-nginx-logs-datadog/ About the Webinar Datadog is a SaaS-based monitoring and analytics platform for cloud-scale organizations. The company is an industry leader in monitoring and observability – with over 350+ vendor-supported integrations, Datadog seamlessly correlates metrics, traces, and logs across the full DevOps stack. With Datadog’s Log Management solution, you can cost-effectively collect, analyze, and archive all your logs with an easy-to-use, intuitive interface. Attend this webinar to learn how to analyze NGINX logs using Datadog to achieve business outcomes including SEO optimization, improved website performance, and detection of DDoS attacks.

Analyzing NGINX Logs with Datadog

NGINX, Inc.

What's hot (20)

Kuberntes Ingress with Kong

Presentation security automation (Selenium Camp)

Introducing envoy-based service mesh at Booking.com

Mastering Microservices with Kong (CodeMotion 2019)

ZMON: Monitoring Zalando's Engineering Platform

Altitude SF 2017: Logging at the edge

So you think JSON is cool?

Kong API

Using an API Gateway for Microservices

Overcoming the Perils of Kafka Secret Sprawl (Tejal Adsul, Confluent) Kafka S...

Building a Serverless company with Node.js, React and the Serverless Framewor...

Nginx Deep Dive Kubernetes Ingress

Flexible, hybrid API-led software architectures with Kong

Gatekeeper: API gateway

Stress Testing at Twitter: a tale of New Year Eves

API Gateway study

DevOps Braga #15: Agentless monitoring with icinga and prometheus

DockerCon Live 2020 - Securing Your Containerized Application with NGINX

What’s New in NGINX Ingress Controller for Kubernetes Release 1.5.0

Analyzing NGINX Logs with Datadog

Viewers also liked

API Management - The Value of the Management Part

Menno Abbink

3Q2016 LinkedIn MDM, RDM & Data Governance special interest group analysis

Aaron Zornes

A review of tools that can be used to design APIs, understand how API design works and to mock infrastructure to test your assumptions. We all know that a happy developer is a powerful ally. The focus of this presentation is on the creation of APIs with the support of tools to achieve this. The goal is to create APIs that are simple for developers to understand and consume, powerful enough to be maintained by your business, in minutes rather than hours.

Tools for designing and building great APIs

Kong Inc.

Microservices vs History

Kong Inc.

Let's explore why you should have an API, how will it influence your business, why you should think about a monetisation seriously. There are a whole bunch of existing models that can help you find the right fit for your API depending on your roadmap. Finally we take a look at the distribution of APIs to developers. Like any cake, you need to make sure it looks and tastes great to be able to sell it and be a leader!

Distribute and Monetize APIs

Kong Inc.

This is a session given by Konstantin Yakushev at Nordic APIs 2016 Platform Summit on October 25th, in Stockholm Sweden. Description: API versioning is a very heated topic in API design world. Common approaches are passing version number explicitly (with a lot of fairly useless discussion on where exactly to put that number) or only introducing backwards-compatible changes. When creating internal API for Badoo applications we found those approaches to be too limiting. Passing version number requires implementers to accommodate for all breaking changes when bumping version – even when it’s not required for business goals of that application at the time. Instead of driving value for business, application developers are in constant race to keep up with the API. Never introducing incompatible changes is also not an option. After several feature redesigns (something that may happen at Badoo once every few weeks) protocol becomes bloated and half of the fields transmitted over the wire start being useless. This talk is about our approach to versioning as part of client-server component negotiation. Client announces features and capabilities it supports and server replies with features status: whether they are enabled or disabled and whether they can be enabled by some user action (e. g. by buying some paid product). Beside those componentized features, client also sends support flags such as SUPPORT_IMAGE_SIZE_VIA_URL which affects how API works. We use those flags where in typical API a version number bump would be required. This approach allows both server and client to understand their current state and adjust their code accordingly – essentially, a tailor-made API for every client. Gathering data on feature and flag support among clients allows us to remove old code branches while continuing to evolve the API. As a result, we are not afraid to change something when that change is required. Old clients continue to work while protocol rot is kept at low level. In this talk I will give details on how exactly this versioning scheme work, how we test those changes, how and when we deprecate our old clients and note some stats and insights from using this scheme at Badoo for several years.

Versioning strategy for a complex internal API (Konstantin Yakushev)

Nordic APIs

Apinf Open Api Management

Taija Björklund

This is a session given by Gustaf Nyman at Nordic APIs 2016 Platform Summit on October 25th, in Stockholm Sweden. Description: In enterprises the majority of APIs are internal and may count in hundreds. APIs are often implemented in and used from a variety of languages and platforms, and legacy system and protocols are ever-present. As APIs are increasingly part of business strategies, API management becomes an important concern of the whole organisation. Gustaf has spent more than 15 years building API infrastructure for enterprises. In this talk, he shares his thoughts on designing and implementing a long-lasting API management strategy.

Lessons Learned from Building Enterprise APIs (Gustaf Nyman)

Nordic APIs

This is a session given by Michael Kuehne at Nordic APIs 2016 Platform Summit on October 26th, in Stockholm Sweden. Description: It can be tough to test an apparently simple service comprehensively. A microservice architecture brings a new level of complexity to the question “How can we validate that our API is working as intended?” In this talk Michael will explain how to use test driven development for APIs and even further how TDD can drive an API Design towards a more usable design, and how to build an well-tested ecosystem of microservices. This approach is applicable for different kinds of services (REST APIs, websockets, industrial protocols). Independent from the type of interface we always ran into similar problems when we build an ecosystem of services. We have to deal with dependency, asynchronous behaviours, fallback mechanisms, endpoint versioning and sometimes even shared databases. It’s not trivial to apply TDD to these kinds of problems cause you have to think of scenarios. But there are ways of identify these scenarios and to test them. As an API specialist Michael worked with various clients designing, building, testing, maintaining and even redesigning private and public services. Based on his project experience he developed a practical approach to apply TDD to APIs in microservice ecosystems.

TDD for APIs in a Microservice World (Michael Kuehne Schlinkert)

Nordic APIs

Platform Security that will Last for Decades (Travis Spencer)

Nordic APIs

This is a session given by Bill Doerrfeld at Nordic APIs 2016 Platform Summit on October 25th, in Stockholm Sweden. Description: At Nordic APIs, our goal is to help businesses make smart tech decisions using APIs. To that end, via events and content Nordic APIs has treaded the business and technical sides to consider holistic best practices for providing an API. In this introductory Summit keynote talk, I’ll introduce what we’ve learned in the form of 6 core tenants of API practice which we’ve also designed this conference to address. Together they define a functional and evolving API: Platformification: Becoming an API-first company means undergoing a platformification process. This represents a global trend that many argue needs to be adopted to keep your business competitive within the digital economy. Strategy: Even before development begins, it’s important to consider your core API strategy. This is a defensible position that aligns your tech with platform goals, strategically exposing internal assets catered to an industry niche. Business Models: APIs have the power to improve efficiency, reduce overhead cost, open up complementary revenue streams, extend R&D, or even alter an existing business model entirely. Thus, you’ll want to determine the right monetization method that improves overall business and leads to end profitability. Security: With new major data breaches reaching the public ear every month, the importance of digital security can never be underestimated. For APIs, much of that lies in monitoring usage, access management, and identity control. Design: No developer wants to use an API with an ugly developer portal, unintuitive URL structures, outdated technology, or terrible lag time. In order to keep your developer consumer happy, paint the API portal and overall developer experience with an aesthetic brush. Marketing: In order to spark adoption, you need to have more than awesome functionality. I’ll review evangelism and discovery techniques you can use to get an API in the hands of more developer users. We’ll look at specific successful implementations of these philosophies in the wild, and mention examples from our blog and eBook content that have brought in industry experts to share their insights. I’ll initiate dialogue and open the conference up to see where we’re heading. What you can get out of embracing the core tenants of API practice?

Introduction to The 6 Insights of API Practice (Bill Doerrfeld)

Nordic APIs

This is a session given by Agnes Andersson Hammarstrand at Nordic APIs 2016 Platform Summit on October 25th, in Stockholm Sweden. Description: This spring a new EU General Data Protection Regulation was adopted to replace the current personal data legislations. Companies that break the rules risk fines of up to 4 % of the worldwide group turnover. The new regulations entail a large number of news that all companies should be informed about. Among other things, IT systems need to be adapted to privacy under the principles of privacy by design. Agnes Hammarstrand, partner at Delphi Law firm and expert within IT and online provides an introduction to the new regulations and what you need to do.

New General Data Protection Regulation (Agnes Andersson Hammarstrand)

Nordic APIs

Microservices architecture overview v2

Dmitry Skaredov

In the last years the microservices architecture style has been gaining traction with some companies such as Netflix, Yelp, Gilt, PayPal. Many of that companies abandoned their previous monolithic architecture and moved to a microservices approach. Does that mean that monolithic architectures are a thing of the past? In this talk we will review some key microservices concepts (and misconceptions), search for the essence of microservices architectures and discuss about different approaches to implement them from the industry.

Elastically scalable architectures with microservices. The end of the monolith?

Javier Arias Losada

Digital transformation is on its way and the industry is required to adopt new concepts and techniques, like the Internet of things (IoT), Cloud and Enterprise Mobility. As a matter of that, new business models arise, which need to be evaluated by companies to not lose market shares and stay in touch with the competitors. Gartner’s vision of Bi-modal IT seems to become more and more the reality, which besides all chances, also brings a lot of challenges companies have to deal with. One essential topic for implementing the ideas of Bi-modal IT is API Management – at least from our point of view. In addition, it is also a key enabler to define a solid strategy, in order to meet the challenges with respect to digital transformation.

API Management - Why it matters!

Sven Bernhardt

This is a session given by Zane Claes at Nordic APIs 2016 Platform Summit on October 25th, in Stockholm Sweden. Description: Too often, APIs are only consumed by mobile apps and external services. This leads to inconsistencies between web and API implementations of core business logic. This talk will discuss how Airbnb created an API infrastructure that also powers our website, to create a single source of truth.

APIs as The Source of Truth (Zane Claes)

Nordic APIs

API management solutions help enterprises manage, secure, and mediate API traffic, ensure that developers and partners are productive, and grow their API programs to meet the increasing demands of a digital world. APIU management capabilities including Backend as a Service (BaaS) solutions, analytics engines, and monetization enable developers to develop and extend apps with modern features, provide deep insights into the APIs, and allow API providers to monetize their APIs and developers to share in the revenue.

Definitive Guide to API Management

Apigee | Google Cloud

This is a session given by Peter Drougge at Nordic APIs 2016 Platform Summit on October 26th, in Stockholm Sweden. Description: In the fast paced world of cloud awesomeness there’s a new buzzword in town, and it’s called “serverless computing”. Deposit 20 minutes of your time at this session and you’ll leave knowing how to leverage the power of Azure Functions to build and run an API without worrying about what server it’s hosted on or how it will scale.

Building a serverless API in the cloud

Nordic APIs

The adventure of enabling API management in a large enterprise (Josh Wang)

Nordic APIs

Securty Testing For RESTful Applications

Source Conference

Viewers also liked (20)

API Management - The Value of the Management Part

3Q2016 LinkedIn MDM, RDM & Data Governance special interest group analysis

Tools for designing and building great APIs

Microservices vs History

Distribute and Monetize APIs

Versioning strategy for a complex internal API (Konstantin Yakushev)

Apinf Open Api Management

Lessons Learned from Building Enterprise APIs (Gustaf Nyman)

TDD for APIs in a Microservice World (Michael Kuehne Schlinkert)

Platform Security that will Last for Decades (Travis Spencer)

Introduction to The 6 Insights of API Practice (Bill Doerrfeld)

New General Data Protection Regulation (Agnes Andersson Hammarstrand)

Microservices architecture overview v2

Elastically scalable architectures with microservices. The end of the monolith?

API Management - Why it matters!

APIs as The Source of Truth (Zane Claes)

Definitive Guide to API Management

Building a serverless API in the cloud

The adventure of enabling API management in a large enterprise (Josh Wang)

Securty Testing For RESTful Applications

Similar to Rapid Api Prototyping

PiterPy 2016: Parallelization, Aggregation and Validation of API in Python

Max Klymyshyn

JSON REST API for WordPress

Taylor Lovett

Struggling to document your APIs? Still using a wiki page to do it? Watch this presentation and learn the secrets of documenting REST APIs! One of the secrets to a successful Microservices application is the quality of its APIs - so using a decent tool to help develop them is essential; without the right tool, producing APIs can become as tedious as reading through a dump file. This presentation introduces a selection of opensource tools intended to help with not just documenting APIs but designing and testing them as well. Tools covered will include: Swagger, RAML, Spring RestDocs and Apiary.

Zen and the Art of REST API documentation - MuCon London 2015

Steve Judd

Battle of NoSQL stars: Amazon's SDB vs MongoDB vs CouchDB vs RavenDB

Jesse Wolgamott

JHipster Conf 2018 : Connect your JHipster apps to the world of APIs with Ope...

chbornet

We live in a interconnected world, were every day new devices, systems, and applications are connected to share information or interact between them. Thus, the importance of designing systems prepared to offer their services and data to a wide range of customers, that could discover, navigate and use their API in a standard and easy way to be consumed. But designing a headless platform to be used easily through their services is not straightforward. In this talk we will go over the challenges that we've found in adding headless nature to our platform and the foundations and tools that we have

David Gómez G. - Hypermedia APIs for headless platforms and Data Integration ...

Codemotion

Cdm mil-18 - hypermedia ap is for headless platforms and data integration

David Gómez García

APIdays Zurich 2019 - Specification Driven Development for REST APIS Alexande...

apidays

APIdays Helsinki 2019 - Specification-Driven Development of REST APIs with Al...

apidays

Development in the could: How do we do it(Cloud computing. Microservices. Faas)

Preply.com

Ibm_interconnect_restapi_workshop

Shubhra Kar

CSG 2012

Scotty Logan

INTERFACE by apidays_Automating style guides for REST, gRPC, or GraphQL by Ph...

apidays

CIS14: I Left My JWT in San JOSE

CloudIDSummit

Java Script Based Client Server Webapps 2

kriszyp

Couchdb: No SQL? No driver? No problem

delagoya

Scaling an API

Ciaran Rooney

Isomorphic App Development with Ruby and Volt - Rubyconf2014

ryanstout

The architectural pattern of Command and Query Responsibility Segregation (CQRS) and Event Sourcing segregates write (command) and read (query) operations. This splits structures typically lumped together in architectures built on top of read/write databases. Developers can easily run the rather small parts resulting from such a split within light weight cloud based functions. Within the JobMatchMe startup we build such a CQRS/Event Sourced system based on building blocks provided by the Amazon Cloud (AWS). Core elements are JavaScript based Lambda functions that connect with a DynamoDB database as the event store and prepare or present event projections via a fast redis cache. The talk will detail why the rapid conquering of the core business domain tackled by our startup and the machine learning behind our matching platform made CQRS and Event Sourcing look like a reasonable choice. The resulting system demonstrated an extreme resilience with regards to the changes required to go along with our increasing knowledge of our domain. At the same time the system has been extremely low cost from a financial point of view. But as no architectural choice comes without costs this retrospective of our current implementation provides not only a view on the benefits earned but also the drawbacks we experienced or foresee. The talk will also detail the core technical choices made. In addition it will provide some guidelines to replicate our approach in your own implementation of a CQRS/Event Sourced system on AWS if you choose to do so.

Cqrs and event sourcing in the aws cloud

Gunnar Wrobel

A good API specification isn’t just about writing API documentation well. I want to share examples of how one can: - Make unit tests simpler and more reliable; - Set up user input preprocessing and validation; - Automate serialization and ensure response consistency, and event - Enjoy the benefits of static typing; This approach is a compilation of different discrete ideas, all based on the smart use of an API specification.

Specification-Driven Development of REST APIs by Alexander Zinchuk

OdessaJS Conf

Similar to Rapid Api Prototyping (20)