1.
Votre API passe-t-elle
le contrôle technique ?

2.
François-Guillaume RIBREAU
@FGRibreau

3.
François-Guillaume RIBREAU
@FGRibreau
Architect & Head of development @Ouest-France
! Available for consulting

4.
François-Guillaume RIBREAU
@FGRibreau
Architect & Head of development @Ouest-France
🌟 SaaS founder of
! Available for consulting

5.
François-Guillaume RIBREAU
@FGRibreau
Architect & Head of development @Ouest-France
🌟 SaaS founder of
! Available for consulting

6.
François-Guillaume RIBREAU
@FGRibreau
Architect & Head of development @Ouest-France
🌟 SaaS founder of
! Available for consulting

7.
<quick>
<history>

8.
https://bit.ly/2pMI7aJ
“
”
— Christopher Strachey, 1969 (50 yrs ago)

9.
I am quite convinced that in fact computing will
become a very important science.
https://bit.ly/2pMI7aJ
“
”
— Christopher Strachey, 1969 (50 yrs ago)

10.
I am quite convinced that in fact computing will
become a very important science.
But at the moment we are in a very
primitive state of development; we don't
know the basic principles yet and we must
learn them first.
https://bit.ly/2pMI7aJ
“
”
— Christopher Strachey, 1969 (50 yrs ago)

11.
I am quite convinced that in fact computing will
become a very important science.
But at the moment we are in a very
primitive state of development; we don't
know the basic principles yet and we must
learn them first.
If universities spend their time teaching the
state of the art, they will not discover
these principles and that, surely, is what
academics should be doing.
https://bit.ly/2pMI7aJ
“
”
— Christopher Strachey, 1969 (50 yrs ago)

12.
http://bit.ly/2CenmM7
Application Programming Interface (API)

13.
'60s
API (only) for libraries
http://bit.ly/2CenmM7
Application Programming Interface (API)

14.
'60s
API (only) for libraries
'80-90s
Remote access to procedural API (MoM/Queuing emerges)
http://bit.ly/2CenmM7
Application Programming Interface (API)

15.
'60s
API (only) for libraries
'80-90s
Remote access to procedural API (MoM/Queuing emerges)
'00s
REpresentational State Transfer (REST, Roy Fielding)
http://bit.ly/2CenmM7
Application Programming Interface (API)

16.
'60s
API (only) for libraries
'80-90s
Remote access to procedural API (MoM/Queuing emerges)
'00s
REpresentational State Transfer (REST, Roy Fielding)
'10s
Public APIs, platforms emerge, hipster RPC protocols...
http://bit.ly/2CenmM7
Application Programming Interface (API)

17.
</history>
</quick>

18.
Votre API passe-t-elle
le contrôle technique ?

19.
Contrôle Technique (kɔ̃.tʁol tɛk.nik)
“Porte sur 9 fonctions déclinées en
131 points de contrôle et 410 défaillances.”

20.
“A type of job aid used to reduce failure by
compensating for potential
limits of human memory and attention.”
Checklist (/ˈtʃɛklɪst/)
Contrôle Technique (kɔ̃.tʁol tɛk.nik)
“Porte sur 9 fonctions déclinées en
131 points de contrôle et 410 défaillances.”

21.
control points70+

22.
control points
BUSINESS REQUIREMENTS
ON-CALL RESPONSABILITY
RISKS
CRITICITY
DATA-PRIVACY (PIA/AIDP)
DEFINE SERVICE NAME
HTTPS
HSTS HEADER
IAM
AUTHORIZATION
ACCESS
VERSIONING
CHANGELOG
BACKWARD-COMPATIBILITY
MAX SIMULTANEOUS
CONNECTIONS LIMIT
RATE-LIMITING
QUOTA
TIMEOUTS/RETRIES/CIRCUIT-
BREAKERS FOR EVERY CALL
CONFIGURE CORS
X-CONTENT-TYPE: NOSNIFF
X-FRAME-OPTIONS: DENY
CONTENT-SECURITY-POLICIES
FINGERPRINT
PAGINATION
SEARCH, SORTING AND
FILTERING
SUPPORT FIELD SELECTION
SUPPORT FIELD EXPANSION
UUID INSTEAD OF AUTO-INC
USE SEMANTIC SHORTCUTS
USE ASYNC HANDLING WHEN
NECESSARY
SUPPORT PUSH
OVERALL CONSISTENCY
OVERALL ERROR
CONSISTENCY
REMOVE SENSITIVE DATA
RETURN MINIMUM OUTPUT
DEFINE INDIRECTIONS
MODEL WITH USAGE IN MIND
SUPPORT I18N/G11N
FUNCTIONAL ERRORS
USE CDN
HMAC
SPLIT STATE AND LOGIC
IMMUTABLE DATA
AUDITABILITY
SUPPORT PROD/TEST MODE
SUPPORT MULTI-TENANT
LEVERAGE TESTS
POST-DEPLOY TESTS
SMOKE-TESTS
GENERATE DOCUMENTATION
TEST DOCUMENTATION
SDK/CLIENTS
COST-EFFICIENCY
CONTINUOUS DEPLOYMENT
MULTI-REGION & GEO-DNS
CACHING
LOG
SYSTEM USAGE MONITORING
API USAGE MONITORING
BUSINESS USAGE
MONITORING
PROFILING
ERROR REPORTING
ALERTING, WRITE RUNBOOKS
HEALTH-CHECK
TRACING
STATUS PAGE
BUG-BOUNTY
SECURITY.TXT
PORTAIL
70+

23.
“Mettre le plus
de contraintes en amont”

24.
# Français “C'est en forgeant que l ’on devient forgeron.”
“Mettre le plus
de contraintes en amont”

25.
# Français “C'est en forgeant que l ’on devient forgeron.”
$ Finnois kukaan ei ole seppä syntyessään
(personne n'est né forgeron)
“Mettre le plus
de contraintes en amont”

26.
# Français “C'est en forgeant que l ’on devient forgeron.”
% Allemand Übung macht den Meister
(L’exercice/habitude fait le maître)
$ Finnois kukaan ei ole seppä syntyessään
(personne n'est né forgeron)
“Mettre le plus
de contraintes en amont”

27.
# Français “C'est en forgeant que l ’on devient forgeron.”
% Allemand Übung macht den Meister
(L’exercice/habitude fait le maître)
$ Finnois kukaan ei ole seppä syntyessään
(personne n'est né forgeron)
& Japonais NaraWaNu Kyô Ha YoMeNu
(Il est impossible de réciter un soûtra sans l'apprendre auparavant)
“Mettre le plus
de contraintes en amont”

28.
Before development

29.
What are your goals?

30.
What are your goals?

31.
Define business requirements

32.
Define business requirements

33.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Objectives (SLO)
Define business requirements

34.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Objectives (SLO)
“Must be measurable, with a time period and specify where and how to
measure it.
Define business requirements

35.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Objectives (SLO)
“Must be measurable, with a time period and specify where and how to
measure it.
Drives your dashboards and alerts.”
Define business requirements

36.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Objectives (SLO)
“Must be measurable, with a time period and specify where and how to
measure it.
Drives your dashboards and alerts.”
Define business requirements
“95% of chart generation requests
latency will be lower than 400ms
over the month”

37.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Indicators (SLI)
Define business requirements

38.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Indicators (SLI)
Define business requirements
Metrics.
e.g. error ratios, latency, query per
seconds, response time, uptime

39.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Agreements 💰 (SLA)
Define business requirements

40.
https://landing.google.com/sre/sre-book/chapters/service-level-objectives/
https://engineering.bitnami.com/articles/implementing-slos-using-prometheus.html
Service Level Agreements 💰 (SLA)
Define business requirements
"an explicit or implicit contract with your users
that includes consequences of meeting (or
missing) the SLOs they contain"
— SRE Book

41.
Consider risks, data-privacy

42.
Risks
Consider illegitimate access to data. What risks? Likelihood?
Consider illegitimate data change. What risks? Likelihood?
Consider data disappearance. What risks? Likelihood?

43.
Risks
Consider illegitimate access to data. What risks? Likelihood?
Consider illegitimate data change. What risks? Likelihood?
Consider data disappearance. What risks? Likelihood?
Data-Privacy (e.g. PIA - Privacy Impact Assessment)
Does the API collect sensitive data?
(e.g. political opinion, sexual orientation…)
Does the API evaluate or note people?
Does the API handle data about vulnerable people?
...

44.
Define service name

45.
“There are only two hard things in CS:
cache invalidation and naming things”
— Phil Karlton
Define service name

46.
Define service name

47.
ups (
Define service name

48.
ups (
rcpu 🤷
Define service name

49.
ups (
rcpu 🤷
ghostbusters *
Define service name

50.
ups (
rcpu 🤷
ghostbusters *
thanos-service 🙎
Define service name

51.
ups (
rcpu 🤷
ghostbusters *
thanos-service 🙎
user-preference ✅
Define service name

52.
“Le nommage doit être ennuyeux”
✅ Descriptive & unambiguous
✅ Transparent
✅ Respect SSoT/SoC

53.
During development

54.
Use an
Identity & Access
Management service
(IAM)

55.
IAM
🎭 Authentication
👮 Authorization
🗂 Audit
#SSoT #SoC

56.
http://bit.ly/2TW4s6Q

57.
http://bit.ly/2TW4s6Q

58.
http://bit.ly/2TW4s6Q

59.
http://bit.ly/2TW4s6Q

60.
http://bit.ly/2TW4s6Q

61.
http://bit.ly/2TW4s6Q
Charts
Product Team
CMS
Product Team
BP-Editorial
Product Team
BP-Services
Product Team

62.
http://bit.ly/2TW4s6Q
“L'entreprise est une plateforme
sur laquelle reposent les équipes”
Charts
Product Team
CMS
Product Team
BP-Editorial
Product Team
BP-Services
Product Team

63.
#SSoT #SoC
http://bit.ly/2FdJk2v
API
IAM
Policy Administration Point

64.
http://bit.ly/2UFvPPZ

65.
http://bit.ly/2UFvPPZ
SaaS tools (outside perimeter) 🕳

66.
http://bit.ly/2UFvPPZ
SaaS tools (outside perimeter) 🕳
Employee 💻 malware/trojans

67.
We don't live in the '90s anymore.
Build with untrusted network in mind.
Forget the unsafe trusted network paradigm.
You do want Application Segmentation (zero trust).
http://bit.ly/2UFvPPZ
SaaS tools (outside perimeter) 🕳
Employee 💻 malware/trojans

68.
Set versioning
Update changelog

69.
Use semver

70.
Use conventional commits

71.
client api
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
Version your API
accept: application/vnd.github.v3+json
...through mime headers (standard)

72.
client api
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
... sub-domain
{version}.domain.com
Version your API
accept: application/vnd.github.v3+json
...through mime headers (standard)

73.
client api
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
... sub-domain
{version}.domain.com ... path (mainly RPC over HTTP)
api.twitter.com/v1/
api.twitter.com/1.1/
api.twilio.com/2010-04-01/
Version your API
accept: application/vnd.github.v3+json
...through mime headers (standard)

74.
client api
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
... sub-domain
{version}.domain.com ... path (mainly RPC over HTTP)
api.twitter.com/v1/
api.twitter.com/1.1/
api.twilio.com/2010-04-01/
Version your API
... query-string
/?v={version}
accept: application/vnd.github.v3+json
...through mime headers (standard)

75.
client api
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
Version your API

76.
client api
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
Version your API
...and then there is

77.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
client api
1) authenticated
api request
API reverse-engineered

78.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
client api
IAM
2) authenticate
app request
1) authenticated
api request
API reverse-engineered

79.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
client api
IAM
2) authenticate
app request
3) get active
app version
1) authenticated
api request
API reverse-engineered

80.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
client api
IAM
2) authenticate
app request
3) get active
app version
4) down-migration middlewares
1) authenticated
api request
API reverse-engineered

81.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
client api
IAM
2) authenticate
app request
3) get active
app version
4) down-migration middlewares
5) execute request
1) authenticated
api request
API reverse-engineered

82.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
client api
IAM
2) authenticate
app request
3) get active
app version
4) down-migration middlewares
5) execute request
6) up-migration middlewares
1) authenticated
api request
API reverse-engineered

83.
https://stripe.com/blog/api-versioning
Version your API

84.
Define backward-compatibility

85.
https://stripe.com/docs/upgrades
Define backward-compatibility

86.
Ensure backward-compatibility

87.
“Be conservative in what you send, be
liberal in what you accept”
— Postel's law
(the Robustness Principle)
Ensure backward-compatibility

88.
Ensure backward-compatibility

89.
Ensure backward-compatibility
API = Application Programming Interface

90.
Ensure backward-compatibility
API = Application Programming Interface
Interface ∈ Contract

91.
Ensure backward-compatibility
API = Application Programming Interface
Interface ∈ Contract
Find a way to test contracts

92.
Ensure backward-compatibility
Twitter
"Diffy [...] catch bugs without requiring developers to write many tests"
https://github.com/twitter/diffy

93.
Ensure backward-compatibility
https://pact.io

94.
Support pagination
Support search
Support sorting
Support filtering
Support field selection
Support field expansion

95.
Support pagination

96.
Support pagination
⚠ "yeah... maybe later" ⚠ O(n) 3

97.
Support pagination
“Tout limiter dans l'espace et
dans le temps”
⚠ "yeah... maybe later" ⚠ O(n) 3

98.
https://www.youtube.com/watch?v=UKrS_eXZfHw
“Choisir entre une API RPC, SOAP, REST, GraphQL
et si le problème était ailleurs ?”

99.
“Mettre le plus
de contraintes en amont”

100.
(HTTP specific headers)

101.
Access-Control-Allow-Origin: ...
(HTTP specific headers)

102.
Access-Control-Allow-Origin: ...
x-content-type: no-sniff
(HTTP specific headers)

103.
Access-Control-Allow-Origin: ...
x-content-type: no-sniff
x-frame-options: deny
(HTTP specific headers)

104.
Access-Control-Allow-Origin: ...
x-content-type: no-sniff
x-frame-options: deny
Content-Security-Policy: ...
(HTTP specific headers)

105.
Remove fingerprints 👁
- nginx/apache/framework name & versions
- load-balancer/proxy/CDN

106.
Split state & logic

107.
Split state & logic
Save data as immutable

108.
Split state & logic
Save data as immutable
Support auditability

109.
Leverage an
object storage for files
(AWS S3 / GCP Storage / Riak S2 / Minio)
Split state & logic

110.
Support multi-tenant

111.
dev
api-talks
Talks

112.
dev
api-talks
staging
IAM
Talks IAM

113.
dev
api-talks
staging
IAM
Talks IAM

114.
dev
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter

115.
dev
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)

116.
dev
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)

117.
dev
staging
api-talks
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)

118.
dev
staging
api-talks
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)

119.
dev
staging
api-talks
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)
talks-
staging
(app)

120.
dev
staging
api-talks
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)
talks-
staging
(app)

121.
production
dev
staging
api-talks
api-talks
api-talks
staging
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)
talks-
staging
(app)

122.
production
dev
staging
api-talks
api-talks
api-talks
production
staging
IAM
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)
talks-
staging
(app)

123.
production
dev
staging
api-talks
api-talks
api-talks
production
staging
IAM
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)

124.
production
dev
staging
api-talks
api-talks
api-talks
production
staging
IAM
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)

125.
production
dev
staging
api-talks
api-talks
api-talks
production
staging
IAM
IAM
Talks IAM
Twitter
API
Twitter
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
🤔

126.
production
dev
staging
IAM
IAM
production
dev
staging
api-talks
api-talks
api-talks
production
dev
staging
IAM
IAM
IAM
Talks IAM
Twitter
API
Twitter
TeamTeam
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
Team

127.
production
dev
staging
IAM
IAM
production
dev
staging
api-talks
api-talks
api-talks
production
dev
staging
IAM
IAM
IAM
Talks IAM
Twitter
API
Twitter
TeamTeam
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
Team

128.
production
dev
staging
IAM
IAM
production
dev
staging
api-talks
api-talks
api-talks
production
dev
staging
IAM
IAM
IAM
Talks IAM
Twitter
API
Twitter
TeamTeam
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
Team
PrivatePublic

129.
production
dev
staging
IAM
IAM
production
dev
staging
api-talks
api-talks
api-talks
production
dev
staging
IAM
IAM
IAM
Talks IAM
Twitter
API
Twitter
TeamTeam
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
Team
PrivatePublic

130.
production
dev
staging
IAM
IAM
production
dev
staging
api-talks
api-talks
api-talks
production
dev
staging
IAM
IAM
IAM
Talks IAM
Twitter
API
Twitter
TeamTeam
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
Team
“Les équipes pointent sur la
production des autres”
PrivatePublic

131.
production
dev
staging
IAM
IAM
production
dev
staging
api-talks
api-talks
api-talks
production
dev
staging
IAM
IAM
IAM
Talks IAM
Twitter
API
Twitter
TeamTeam
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
Team
“Les équipes pointent sur la
production des autres”
production
(realm)
talks-
staging
(realm)
talks-
dev
(realm)

132.
production
dev
staging
IAM
IAM
production
dev
staging
api-talks
api-talks
api-talks
production
dev
staging
IAM
IAM
IAM
Talks IAM
Twitter
API
Twitter
TeamTeam
talks-
dev
(app)
talks-
staging
(app)
talks-
production
(app)
Team
“Les équipes pointent sur la
production des autres”
production
(realm)
talks-
staging
(realm)
talks-
dev
(realm)
production
(????)

133.
dev
staging
production
api-talks
production
(organization)
api-talks
api-talks
Support multi-tenant

134.
dev
staging
production
api-talks
production
(organization)
api-talks
api-talks
Design primitives
(e.g. realm, app, organization, website)
to unleash your teams productivity 😇
and business opportunities 💵
Support multi-tenant

135.
Your company is a platform, everything can be sold.

136.
Your company is a platform, everything can be sold.
Your company is a user — like anyone else — of your API.

137.
Your company is a platform, everything can be sold.
Your company is a user — like anyone else — of your API.
Use your IAM Luke!
Morpheus
(not sure about this one)

138.
https://amzn.to/2TfqaOI

139.
"How do I run my system/e2e tests?"
https://amzn.to/2TfqaOI

140.
"How do I run performance tests?"
"How do I run my system/e2e tests?"
https://amzn.to/2TfqaOI

141.
"How do I run performance tests?"
"How do I run my system/e2e tests?"
https://amzn.to/2TfqaOI

142.
Support test/prod mode

143.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
Support test/prod mode

144.
https://blog.fgribreau.com/2015/03/braindump-versioning-http-api.html
Support test/prod mode

145.
IAM

146.
Hash-based
Message
Authentication
Code HMAC

147.
Media server
https://media.my-website.com/images/{uuid}.{png|webp}
?width=700
&height=300
Job done? 🍾

148.
Media server
https://media.my-website.com/images/{uuid}.{png|webp}
?width=700
&height=300
Nope. 🦹

149.
Media server
https://media.my-website.com/images/{uuid}.{png|webp}
?width=700
&height=300
&sign={signature}
Job done? 🍾

150.
Media server
https://media.my-website.com/images/{uuid}.{png|webp}
?width=700
&height=300
&sign={signature}
Nope. #multi-tenant

151.
Media server
https://media.my-website.com/images/{uuid}.{png|webp}
?width=700
&height=300
&client_id={tenant_id}
&sign={signature}
Job done.

152.
Verifying webhooks
X-Shopify-Hmac-SHA256 HTTP header
Stripe-Signature HTTP headersigned_request HTTP POST variable

153.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
How to protect my API
monetization model?

154.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
How to protect my API
monetization model?

155.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
&icac=fgribreau
&ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27

156.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
&icac=fgribreau
&ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27

157.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
&icac=fgribreau
&ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27
✅ Signed URL

158.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
&icac=fgribreau
&ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27
✅ Signed URL
✅ Removed watermark

159.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
&icac=fgribreau
&ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27
✅ Signed URL
✅ Removed watermark
✅ Available extra-features

160.
https://image-charts.com/chart
?chs=700x300
&chxt=x,y
&chl=2018|2017|2015
&chd=t:60,40,20
&cht=pa
&chdl=Image|Charts|Rocks
&chf=ps0-0,lg,45,ffeb3b,0.2,f443367C,1|ps0-1,lg,45,8bc34a,
0.2,0096887C,1|ps0-2,lg,45,EA469E,0.2,03A9F47C,1
&chan
&icac=fgribreau
&ichm=68c82618eccc2f0a861473ef93e978beb0b018a3ce2c2b4b609aec1b27
✅ Signed URL
✅ Removed watermark
✅ Available extra-features
⚠ Caching

161.
Define timeouts for every call (pg: statement_timeout)
Implement retries (e.g. exponential-backoff)
Define circuit-breakers

162.
Define timeouts for every call (pg: statement_timeout)
Implement retries (e.g. exponential-backoff)
Define circuit-breakers
“Tout limiter dans l'espace et
dans le temps”

163.
Leverage tests
Write post-deploy tests
Write smoke-tests (black-box testing)

164.
Before production

165.
Set max simultaneous connections limit
Set rate-limiting

166.
Set max simultaneous connections limit
Set rate-limiting
“Tout limiter dans l'espace et
dans le temps”

167.
https://amzn.to/2HHlq2phttp://bit.ly/2HFZSTO
Define quota

168.
Configure alerting,
write runbooks

169.
http://bit.ly/2JlncJ1

170.
“Monitoring sans alerting
ne sert à rien”
http://bit.ly/2JlncJ1

171.
https://gitlab.com/gitlab-com/runbooks

172.
Generate documentation
Generate SDK/clients
Test documentation
😑

173.
https://www.youtube.com/watch?v=g6Yg2e1cDe8
“Construire et automatiser son SaaS grâce à une
spécification OpenAPI/Swagger”

174.
https://github.com/apiaryio/dredd

175.
Leverage CI/CD
😑

176.
"Restart" deployment

177.
"Restart" deployment
Blue/green deployment

178.
"Restart" deployment
Blue/green deployment
Rolling-updates deployment
(req. n-1 backward-compat)
(commodity: PaaS & CaaS)

179.
"Restart" deployment
Blue/green deployment
Rolling-updates deployment
(req. n-1 backward-compat)
(commodity: PaaS & CaaS)
Dark-launch + Canarying + rolling-updates
(req. n-1 backward-compat)
(commodity: GoReplay, Istio)

180.
After production

181.
Ensure cost-efficiency

182.
Expose api in status page
Promote bug-bounty
Expose .well-known/security.txt
Expose .well-known/dnt-policy.txt
Expose in portail

183.
control points
BUSINESS REQUIREMENTS
ON-CALL RESPONSABILITY
RISKS
CRITICITY
DATA-PRIVACY (PIA/AIDP)
DEFINE SERVICE NAME
HTTPS
HSTS HEADER
IAM
AUTHORIZATION
ACCESS
VERSIONING
CHANGELOG
BACKWARD-COMPATIBILITY
MAX SIMULTANEOUS
CONNECTIONS LIMIT
RATE-LIMITING
QUOTA
TIMEOUTS/RETRIES/CIRCUIT-
BREAKERS FOR EVERY CALL
CONFIGURE CORS
X-CONTENT-TYPE: NOSNIFF
X-FRAME-OPTIONS: DENY
CONTENT-SECURITY-POLICIES
FINGERPRINT
PAGINATION
SEARCH, SORTING AND
FILTERING
SUPPORT FIELD SELECTION
SUPPORT FIELD EXPANSION
UUID INSTEAD OF AUTO-INC
USE SEMANTIC SHORTCUTS
USE ASYNC HANDLING WHEN
NECESSARY
SUPPORT PUSH
OVERALL CONSISTENCY
OVERALL ERROR
CONSISTENCY
REMOVE SENSITIVE DATA
RETURN MINIMUM OUTPUT
DEFINE INDIRECTIONS
MODEL WITH USAGE IN MIND
SUPPORT I18N/G11N
FUNCTIONAL ERRORS
USE CDN
HMAC
SPLIT STATE AND LOGIC
IMMUTABLE DATA
AUDITABILITY
SUPPORT PROD/TEST MODE
SUPPORT MULTI-TENANT
LEVERAGE TESTS
POST-DEPLOY TESTS
SMOKE-TESTS
GENERATE DOCUMENTATION
TEST DOCUMENTATION
SDK/CLIENTS
COST-EFFICIENCY
CONTINUOUS DEPLOYMENT
MULTI-REGION & GEO-DNS
CACHING
LOG
SYSTEM USAGE MONITORING
API USAGE MONITORING
BUSINESS USAGE
MONITORING
PROFILING
ERROR REPORTING
ALERTING, WRITE RUNBOOKS
HEALTH-CHECK
TRACING
STATUS PAGE
BUG-BOUNTY
SECURITY.TXT
PORTAIL
70+

184.
Questions?
@FGRibreau
image-charts.com
No more server-side rendering pain,
1 url = 1 chart
redsmin.com
Free plans for Redis
administration & monitoring
getnobullshit.com
(Receive the 70+ points API
checklist)
60 principes pratiques
fondamentaux,
applicables quotidiennement
de la petite à la grande entreprise
du développeur au CTO
du tech-lead à l'architecte.

185.
categories13

186.
modeling
performance
scalability
security
recoverability
backward compatibility
deployment
monitoring
reporting system health
troubleshooting
reliability
availability
documenting
categories13

187.
BONUS

188.
Define indirections

189.
Use UUID instead of auto-increment
Use semantic shortcuts
Model with usage in mind

190.
Configure health-check
Log everything
Configure system monitoring
Configure API monitoring
Configure business usage monitoring
Configure profiling
Implement error reporting
Setup tracing
😑

191.
Add server-side caching
Leverage defensive-caching (grace mode)
Support client-side caching
😑

192.
Expose functional errors
http://bit.ly/2uf53Cr

193.
⚠
How do I let my S3 API users
securely expose files/data?

194.
✅ Control data access
✅ (optional) url expiration
https://s3.amazonaws.com/{S3_BUCKET}/{path}
?Expires={expire_date}
&AWSAccessKeyId={S3_ACCESS_KEY_ID}
&Signature={signature}
Note: signature through query string or Authorization header

195.
Add HTTPS
Add HSTS header

196.
https://mzl.la/2T863Cl
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Add HTTPS
Add HSTS header

197.
Questions?
@FGRibreau
image-charts.com
No more server-side rendering pain,
1 url = 1 chart
redsmin.com
Free plans for Redis
administration & monitoring
getnobullshit.com
(Receive the 70+ points API
checklist)
60 principes pratiques
fondamentaux,
applicables quotidiennement
de la petite à la grande entreprise
du développeur au CTO
du tech-lead à l'architecte.