Download as PDF, PPTX
![Ensure backward-compatibility
Twitter
"Diffy [...] catch bugs without requiring developers to write many tests"
https://github.com/twitter/diffy](https://image.slidesharecdn.com/20190312-190410154206/85/Votre-API-passe-t-elle-le-controle-technique-95-320.jpg)
Uploaded byFrançois-Guillaume Ribreau
⛳️ Votre API passe-t-elle le contrôle technique ?
The document discusses the evolution and best practices of application programming interfaces (APIs), emphasizing the importance of technical checks and adherence to established guidelines for reliability and performance. It outlines various control points, business requirements, and necessary security measures, including service level objectives (SLOs) and privacy considerations. The document also stresses the significance of maintaining backward compatibility and performance metrics for API development.
More Related Content
![[BreizhCamp, format 15min] Construire et automatiser l'ecosystème de son Saa...](https://cdn.slidesharecdn.com/ss_thumbnails/20170418construireetautomatiserlecosystemedesonsaasgraceaunespecificationswagger-170426174720-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BreizhCamp, format 15min] Une api rest et GraphQL sans code grâce à PostgR...](https://cdn.slidesharecdn.com/ss_thumbnails/20170418uneapirestetgraphqlsanscodegraceapostgrestsub0etpostgresql-170426174719-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to ⛳️ Votre API passe-t-elle le contrôle technique ?
⛳️ Votre API passe-t-elle le contrôle technique ?
- 1. Votre API passe-t-elle lecontrôle technique ?
- 2.
- 3. François-Guillaume RIBREAU @FGRibreau Architect &Head of development @Ouest-France ! Available for consulting
- 4. François-Guillaume RIBREAU @FGRibreau Architect &Head of development @Ouest-France 🌟 SaaS founder of ! Available for consulting
- 5. François-Guillaume RIBREAU @FGRibreau Architect &Head of development @Ouest-France 🌟 SaaS founder of ! Available for consulting
- 6. François-Guillaume RIBREAU @FGRibreau Architect &Head of development @Ouest-France 🌟 SaaS founder of ! Available for consulting
- 7.
- 8. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey,1969 (50 yrs ago)
- 9. I am quiteconvinced that in fact computing will become a very important science. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey, 1969 (50 yrs ago)
- 10. I am quiteconvinced that in fact computing will become a very important science. But at the moment we are in a very primitive state of development; we don't know the basic principles yet and we must learn them first. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey, 1969 (50 yrs ago)
- 11. I am quiteconvinced that in fact computing will become a very important science. But at the moment we are in a very primitive state of development; we don't know the basic principles yet and we must learn them first. If universities spend their time teaching the state of the art, they will not discover these principles and that, surely, is what academics should be doing. https://bit.ly/2pMI7aJ “ ” — Christopher Strachey, 1969 (50 yrs ago)
- 12.
- 13. '60s API (only) forlibraries http://bit.ly/2CenmM7 Application Programming Interface (API)
- 14. '60s API (only) forlibraries '80-90s Remote access to procedural API (MoM/Queuing emerges) http://bit.ly/2CenmM7 Application Programming Interface (API)
- 15. '60s API (only) forlibraries '80-90s Remote access to procedural API (MoM/Queuing emerges) '00s REpresentational State Transfer (REST, Roy Fielding) http://bit.ly/2CenmM7 Application Programming Interface (API)
- 16. '60s API (only) forlibraries '80-90s Remote access to procedural API (MoM/Queuing emerges) '00s REpresentational State Transfer (REST, Roy Fielding) '10s Public APIs, platforms emerge, hipster RPC protocols... http://bit.ly/2CenmM7 Application Programming Interface (API)
- 17.
- 18. Votre API passe-t-elle lecontrôle technique ?
- 20. Contrôle Technique (kɔ̃.tʁoltɛk.nik) “Porte sur 9 fonctions déclinées en 131 points de contrôle et 410 défaillances.”
- 21. “A type ofjob aid used to reduce failure by compensating for potential limits of human memory and attention.” Checklist (/ˈtʃɛklɪst/) Contrôle Technique (kɔ̃.tʁol tɛk.nik) “Porte sur 9 fonctions déclinées en 131 points de contrôle et 410 défaillances.”
- 22.
- 23. control points BUSINESS REQUIREMENTS ON-CALLRESPONSABILITY RISKS CRITICITY DATA-PRIVACY (PIA/AIDP) DEFINE SERVICE NAME HTTPS HSTS HEADER IAM AUTHORIZATION ACCESS VERSIONING CHANGELOG BACKWARD-COMPATIBILITY MAX SIMULTANEOUS CONNECTIONS LIMIT RATE-LIMITING QUOTA TIMEOUTS/RETRIES/CIRCUIT- BREAKERS FOR EVERY CALL CONFIGURE CORS X-CONTENT-TYPE: NOSNIFF X-FRAME-OPTIONS: DENY CONTENT-SECURITY-POLICIES FINGERPRINT PAGINATION SEARCH, SORTING AND FILTERING SUPPORT FIELD SELECTION SUPPORT FIELD EXPANSION UUID INSTEAD OF AUTO-INC USE SEMANTIC SHORTCUTS USE ASYNC HANDLING WHEN NECESSARY SUPPORT PUSH OVERALL CONSISTENCY OVERALL ERROR CONSISTENCY REMOVE SENSITIVE DATA RETURN MINIMUM OUTPUT DEFINE INDIRECTIONS MODEL WITH USAGE IN MIND SUPPORT I18N/G11N FUNCTIONAL ERRORS USE CDN HMAC SPLIT STATE AND LOGIC IMMUTABLE DATA AUDITABILITY SUPPORT PROD/TEST MODE SUPPORT MULTI-TENANT LEVERAGE TESTS POST-DEPLOY TESTS SMOKE-TESTS GENERATE DOCUMENTATION TEST DOCUMENTATION SDK/CLIENTS COST-EFFICIENCY CONTINUOUS DEPLOYMENT MULTI-REGION & GEO-DNS CACHING LOG SYSTEM USAGE MONITORING API USAGE MONITORING BUSINESS USAGE MONITORING PROFILING ERROR REPORTING ALERTING, WRITE RUNBOOKS HEALTH-CHECK TRACING STATUS PAGE BUG-BOUNTY SECURITY.TXT PORTAIL 70+
- 24. “Mettre le plus decontraintes en amont”
- 25. # Français “C'esten forgeant que l ’on devient forgeron.” “Mettre le plus de contraintes en amont”
- 26. # Français “C'esten forgeant que l ’on devient forgeron.” $ Finnois kukaan ei ole seppä syntyessään (personne n'est né forgeron) “Mettre le plus de contraintes en amont”
- 27. # Français “C'esten forgeant que l ’on devient forgeron.” % Allemand Übung macht den Meister (L’exercice/habitude fait le maître) $ Finnois kukaan ei ole seppä syntyessään (personne n'est né forgeron) “Mettre le plus de contraintes en amont”
- 28. # Français “C'esten forgeant que l ’on devient forgeron.” % Allemand Übung macht den Meister (L’exercice/habitude fait le maître) $ Finnois kukaan ei ole seppä syntyessään (personne n'est né forgeron) & Japonais NaraWaNu Kyô Ha YoMeNu (Il est impossible de réciter un soûtra sans l'apprendre auparavant) “Mettre le plus de contraintes en amont”
- 29.
- 30. What are yourgoals?
- 31. What are yourgoals?
- 32.
- 33.
- 34.
- 35. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Objectives(SLO) “Must be measurable, with a time period and specify where and how to measure it. Define business requirements
- 36. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Objectives(SLO) “Must be measurable, with a time period and specify where and how to measure it. Drives your dashboards and alerts.” Define business requirements
- 37. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Objectives(SLO) “Must be measurable, with a time period and specify where and how to measure it. Drives your dashboards and alerts.” Define business requirements “95% of chart generation requests latency will be lower than 400ms over the month”
- 38.
- 39. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Indicators(SLI) Define business requirements Metrics. e.g. error ratios, latency, query per seconds, response time, uptime
- 40.
- 41. https://landing.google.com/sre/sre-book/chapters/service-level-objectives/ https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html Service Level Agreements💰 (SLA) Define business requirements "an explicit or implicit contract with your users that includes consequences of meeting (or missing) the SLOs they contain" — SRE Book
- 42.
- 44. Risks Consider illegitimate accessto data. What risks? Likelihood? Consider illegitimate data change. What risks? Likelihood? Consider data disappearance. What risks? Likelihood?
- 45. Risks Consider illegitimate accessto data. What risks? Likelihood? Consider illegitimate data change. What risks? Likelihood? Consider data disappearance. What risks? Likelihood? Data-Privacy (e.g. PIA - Privacy Impact Assessment) Does the API collect sensitive data? (e.g. political opinion, sexual orientation…) Does the API evaluate or note people? Does the API handle data about vulnerable people? ...
- 46.
- 47. “There are onlytwo hard things in CS: cache invalidation and naming things” — Phil Karlton Define service name
- 48.
- 49.
- 50. ups ( rcpu 🤷 Defineservice name
- 51. ups ( rcpu 🤷 ghostbusters* Define service name
- 52. ups ( rcpu 🤷 ghostbusters* thanos-service 🙎 Define service name
- 53. ups ( rcpu 🤷 ghostbusters* thanos-service 🙎 user-preference ✅ Define service name
- 55. “Le nommage doitêtre ennuyeux” ✅ Descriptive & unambiguous ✅ Transparent ✅ Respect SSoT/SoC
- 56.
- 57. Use an Identity &Access Management service (IAM)
- 58. IAM 🎭 Authentication 👮 Authorization 🗂Audit #SSoT #SoC
- 59.
- 60.
- 61.
- 62.
- 63.
- 64. http://bit.ly/2TW4s6Q Charts Product Team CMS Product Team BP-Editorial ProductTeam BP-Services Product Team
- 65. http://bit.ly/2TW4s6Q “L'entreprise est uneplateforme sur laquelle reposent les équipes” Charts Product Team CMS Product Team BP-Editorial Product Team BP-Services Product Team
- 66.
- 67.
- 68. http://bit.ly/2UFvPPZ SaaS tools (outsideperimeter) 🕳
- 69. http://bit.ly/2UFvPPZ SaaS tools (outsideperimeter) 🕳 Employee 💻 malware/trojans
- 70. We don't livein the '90s anymore. Build with untrusted network in mind. Forget the unsafe trusted network paradigm. You do want Application Segmentation (zero trust). http://bit.ly/2UFvPPZ SaaS tools (outside perimeter) 🕳 Employee 💻 malware/trojans
- 71.
- 72.
- 73.
- 74. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html Version yourAPI accept: application/vnd.github.v3+json ...through mime headers (standard)
- 75. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html ... sub-domain {version}.domain.com Versionyour API accept: application/vnd.github.v3+json ...through mime headers (standard)
- 76. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html ... sub-domain {version}.domain.com... path (mainly RPC over HTTP) api.twitter.com/v1/ api.twitter.com/1.1/ api.twilio.com/2010-04-01/ Version your API accept: application/vnd.github.v3+json ...through mime headers (standard)
- 77. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html ... sub-domain {version}.domain.com... path (mainly RPC over HTTP) api.twitter.com/v1/ api.twitter.com/1.1/ api.twilio.com/2010-04-01/ Version your API ... query-string /?v={version} accept: application/vnd.github.v3+json ...through mime headers (standard)
- 78.
- 79. client api https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html Version yourAPI ...and then there is
- 80. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api 1) authenticated apirequest API reverse-engineered
- 81. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate apprequest 1) authenticated api request API reverse-engineered
- 82. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate apprequest 3) get active app version 1) authenticated api request API reverse-engineered
- 83. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate apprequest 3) get active app version 4) down-migration middlewares 1) authenticated api request API reverse-engineered
- 84. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate apprequest 3) get active app version 4) down-migration middlewares 5) execute request 1) authenticated api request API reverse-engineered
- 85. https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html client api IAM 2) authenticate apprequest 3) get active app version 4) down-migration middlewares 5) execute request 6) up-migration middlewares 1) authenticated api request API reverse-engineered
- 86.
- 87.
- 88.
- 89.
- 90. “Be conservative inwhat you send, be liberal in what you accept” — Postel's law (the Robustness Principle) Ensure backward-compatibility
- 91.
- 92. Ensure backward-compatibility API =Application Programming Interface
- 93. Ensure backward-compatibility API =Application Programming Interface Interface ∈ Contract
- 94. Ensure backward-compatibility API =Application Programming Interface Interface ∈ Contract Find a way to test contracts
- 95. Ensure backward-compatibility Twitter "Diffy [...]catch bugs without requiring developers to write many tests" https://github.com/twitter/diffy
- 96.
- 97. Support pagination Support search Supportsorting Support filtering Support field selection Support field expansion
- 98.
- 99. Support pagination ⚠ "yeah...maybe later" ⚠ O(n) 3
- 100. Support pagination “Tout limiterdans l'espace et dans le temps” ⚠ "yeah... maybe later" ⚠ O(n) 3
- 101. https://www.youtube.com/watch?v=UKrS_eXZfHw “Choisir entre uneAPI RPC, SOAP, REST, GraphQL et si le problème était ailleurs ?”
- 102. “Mettre le plus decontraintes en amont”
- 103.
- 104.
- 105. Access-Control-Allow-Origin: ... x-content-type: no-sniff (HTTPspecific headers)
- 106. Access-Control-Allow-Origin: ... x-content-type: no-sniff x-frame-options:deny (HTTP specific headers)
- 107. Access-Control-Allow-Origin: ... x-content-type: no-sniff x-frame-options:deny Content-Security-Policy: ... (HTTP specific headers)
- 108. Remove fingerprints 👁 -nginx/apache/framework name & versions - load-balancer/proxy/CDN
- 110. Split state &logic
- 111. Split state &logic Save data as immutable
- 112. Split state &logic Save data as immutable Support auditability
- 113. Leverage an object storagefor files (AWS S3 / GCP Storage / Riak S2 / Minio) Split state & logic
- 114.
- 116.
- 117.
- 118.
- 119.
- 120.
- 121.
- 122.
- 123.
- 124.
- 125.
- 126.
- 127.
- 128.
- 129.
- 130.
- 131.
- 132.
- 133.
- 134.
- 135.
- 136. production dev staging IAM IAM production dev staging api-talks api-talks api-talks production dev staging IAM IAM IAM Talks IAM Twitter API Twitter TeamTeam talks- dev (app) talks- staging (app) talks- production (app) Team “Les équipespointent sur la production des autres” production (realm) talks- staging (realm) talks- dev (realm)
- 137. production dev staging IAM IAM production dev staging api-talks api-talks api-talks production dev staging IAM IAM IAM Talks IAM Twitter API Twitter TeamTeam talks- dev (app) talks- staging (app) talks- production (app) Team “Les équipespointent sur la production des autres” production (realm) talks- staging (realm) talks- dev (realm) production (????)
- 138.
- 139. dev staging production api-talks production (organization) api-talks api-talks Design primitives (e.g. realm,app, organization, website) to unleash your teams productivity 😇 and business opportunities 💵 Support multi-tenant
- 141. Your company isa platform, everything can be sold.
- 142. Your company isa platform, everything can be sold. Your company is a user — like anyone else — of your API.
- 143. Your company isa platform, everything can be sold. Your company is a user — like anyone else — of your API. Use your IAM Luke! Morpheus (not sure about this one)
- 144.
- 145. "How do Irun my system/e2e tests?" https://amzn.to/2TfqaOI
- 146. "How do Irun performance tests?" "How do I run my system/e2e tests?" https://amzn.to/2TfqaOI
- 147. "How do Irun performance tests?" "How do I run my system/e2e tests?" https://amzn.to/2TfqaOI
- 148.
- 149.
- 150.
- 151.
- 152.
- 153.
- 154.
- 155.
- 156.
- 157.
- 158. Verifying webhooks X-Shopify-Hmac-SHA256 HTTPheader Stripe-Signature HTTP headersigned_request HTTP POST variable
- 159.
- 160.
- 161.
- 162.
- 163.
- 164.
- 165. https://image-charts.com/chart ?chs=700x300 &chxt=x,y &chl=2018|2017|2015 &chd=t:60,40,20 &cht=pa &chdl=Image|Charts|Rocks &chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a, 0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1 &chan &icac=fgribreau &ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27 ✅ Signed URL ✅Removed watermark ✅ Available extra-features
- 166. https://image-charts.com/chart ?chs=700x300 &chxt=x,y &chl=2018|2017|2015 &chd=t:60,40,20 &cht=pa &chdl=Image|Charts|Rocks &chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a, 0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1 &chan &icac=fgribreau &ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27 ✅ Signed URL ✅Removed watermark ✅ Available extra-features ⚠ Caching
- 167. Define timeouts forevery call (pg: statement_timeout) Implement retries (e.g. exponential-backoff) Define circuit-breakers
- 168. Define timeouts forevery call (pg: statement_timeout) Implement retries (e.g. exponential-backoff) Define circuit-breakers “Tout limiter dans l'espace et dans le temps”
- 169. Leverage tests Write post-deploytests Write smoke-tests (black-box testing)
- 170.
- 171. Set max simultaneousconnections limit Set rate-limiting
- 172. Set max simultaneousconnections limit Set rate-limiting “Tout limiter dans l'espace et dans le temps”
- 173.
- 174.
- 175.
- 176. “Monitoring sans alerting nesert à rien” http://bit.ly/2JlncJ1
- 177.
- 178. Generate documentation Generate SDK/clients Testdocumentation 😑
- 179. https://www.youtube.com/watch?v=g6Yg2e1cDe8 “Construire et automatiserson SaaS grâce à une spécification OpenAPI/Swagger”
- 180.
- 181.
- 183.
- 184.
- 185. "Restart" deployment Blue/green deployment Rolling-updatesdeployment (req. n-1 backward-compat) (commodity: PaaS & CaaS)
- 186. "Restart" deployment Blue/green deployment Rolling-updatesdeployment (req. n-1 backward-compat) (commodity: PaaS & CaaS) Dark-launch + Canarying + rolling-updates (req. n-1 backward-compat) (commodity: GoReplay, Istio)
- 187.
- 188.
- 189. Expose api instatus page Promote bug-bounty Expose .well-known/security.txt Expose .well-known/dnt-policy.txt Expose in portail
- 190. control points BUSINESS REQUIREMENTS ON-CALLRESPONSABILITY RISKS CRITICITY DATA-PRIVACY (PIA/AIDP) DEFINE SERVICE NAME HTTPS HSTS HEADER IAM AUTHORIZATION ACCESS VERSIONING CHANGELOG BACKWARD-COMPATIBILITY MAX SIMULTANEOUS CONNECTIONS LIMIT RATE-LIMITING QUOTA TIMEOUTS/RETRIES/CIRCUIT- BREAKERS FOR EVERY CALL CONFIGURE CORS X-CONTENT-TYPE: NOSNIFF X-FRAME-OPTIONS: DENY CONTENT-SECURITY-POLICIES FINGERPRINT PAGINATION SEARCH, SORTING AND FILTERING SUPPORT FIELD SELECTION SUPPORT FIELD EXPANSION UUID INSTEAD OF AUTO-INC USE SEMANTIC SHORTCUTS USE ASYNC HANDLING WHEN NECESSARY SUPPORT PUSH OVERALL CONSISTENCY OVERALL ERROR CONSISTENCY REMOVE SENSITIVE DATA RETURN MINIMUM OUTPUT DEFINE INDIRECTIONS MODEL WITH USAGE IN MIND SUPPORT I18N/G11N FUNCTIONAL ERRORS USE CDN HMAC SPLIT STATE AND LOGIC IMMUTABLE DATA AUDITABILITY SUPPORT PROD/TEST MODE SUPPORT MULTI-TENANT LEVERAGE TESTS POST-DEPLOY TESTS SMOKE-TESTS GENERATE DOCUMENTATION TEST DOCUMENTATION SDK/CLIENTS COST-EFFICIENCY CONTINUOUS DEPLOYMENT MULTI-REGION & GEO-DNS CACHING LOG SYSTEM USAGE MONITORING API USAGE MONITORING BUSINESS USAGE MONITORING PROFILING ERROR REPORTING ALERTING, WRITE RUNBOOKS HEALTH-CHECK TRACING STATUS PAGE BUG-BOUNTY SECURITY.TXT PORTAIL 70+
- 191. Questions? @FGRibreau image-charts.com No more server-siderendering pain, 1 url = 1 chart redsmin.com Free plans for Redis administration & monitoring getnobullshit.com (Receive the 70+ points API checklist) 60 principes pratiques fondamentaux, applicables quotidiennement de la petite à la grande entreprise du développeur au CTO du tech-lead à l'architecte.
- 192.
- 193. modeling performance scalability security recoverability backward compatibility deployment monitoring reporting systemhealth troubleshooting reliability availability documenting categories13
- 194.
- 195.
- 196. Use UUID insteadof auto-increment Use semantic shortcuts Model with usage in mind
- 197. Configure health-check Log everything Configuresystem monitoring Configure API monitoring Configure business usage monitoring Configure profiling Implement error reporting Setup tracing 😑
- 198. Add server-side caching Leveragedefensive-caching (grace mode) Support client-side caching 😑
- 199.
- 200. ⚠ How do Ilet my S3 API users securely expose files/data?
- 201. ✅ Control dataaccess ✅ (optional) url expiration https://s3.amazonaws.com/{S3_BUCKET}/{path} ?Expires={expire_date} &AWSAccessKeyId={S3_ACCESS_KEY_ID} &Signature={signature} Note: signature through query string or Authorization header
- 202. Add HTTPS Add HSTSheader
- 203. https://mzl.la/2T863Cl add_header Strict-Transport-Security "max-age=31536000;includeSubDomains" always; Add HTTPS Add HSTS header
- 204. Questions? @FGRibreau image-charts.com No more server-siderendering pain, 1 url = 1 chart redsmin.com Free plans for Redis administration & monitoring getnobullshit.com (Receive the 70+ points API checklist) 60 principes pratiques fondamentaux, applicables quotidiennement de la petite à la grande entreprise du développeur au CTO du tech-lead à l'architecte.