How can we help API platform teams ensure that their organizations make and use secure, reliable, and easy-to-use APIs? This is a question that we’ve been asking on my team at Google, and in September I shared some conclusions that we were drawing from research and interviews of teams that were working to improve the quality and security of the APIs in their large organizations. The presentation, Governing APIs at Scale, walked through twelve requirements for an API governance platform, i.e. the software tools that these teams would use to be more productive.

1. Governing APIs at Scale
How can we help API platform teams ensure
that their organizations make and use
secure, reliable, and easy-to-use APIs?
Tim Burks / timburks@google.com / @timburks

3. About suffering they were never wrong,
The old masters: how well they understood
Its human position: how it takes place
While someone else is eating or opening a window
or just walking dully along;
How, when the aged are reverently, passionately waiting
For the miraculous birth, there always must be
Children who did not specially want it to happen, skating
On a pond at the edge of the wood: They never forgot
That even the dreadful martyrdom must run its course
Anyhow in a corner, some untidy spot
Where the dogs go on with their doggy life
and the torturer's horse
Scratches its innocent behind on a tree.
Landscape with the Fall of Icarus
Pieter Bruegel the Elder c. 1650
In Breughel's Icarus, for instance: how everything turns away
Quite leisurely from the disaster; the ploughman may
Have heard the splash, the forsaken cry,
But for him it was not an important failure; the sun shone
As it had to on the white legs disappearing into the green
Water, and the expensive delicate ship that must have seen
Something amazing, a boy falling out of the sky,
Had somewhere to get to and sailed calmly on.
Musee des Beaux Arts - W. H. Auden (1907-1973)

6. Governing helps people work together
1 2 3
Quality Consistency Productivity

7. 12 Requirements for an
API Governance Platform

8. 1. Inclusion
McNamara Fallacy
We have a tendency to make
the measurable important
rather than the important
measurable

9. 2. Shared
Language
API Specifications
API Versions
Version 1 …
Spec 1
APIs
API 1 API 2 API n
…
API Deployments
Deployment 1 …
…

10. 3. Revision Histories
Deployment 1@m Deployment 1@n …
Spec 1@i Spec 1@j Spec 1@k
…
…

11. 4. Metadata (Labels and Artifacts)
Artifacts
1 2
n
…
…

12. 5. Lifecycle Model

13. 6. Search

14. 7. Style Guides
name: google-aip
display_name: Google API Improvement Proposals
mime_types:
- application/x.protobuf
guidelines:
- name: aip126
display_name: Enumerations
description: This guideline governs enum objects in proto files.
rules:
- name: upperSnakeCaseEnumValues
description: All enum values must use UPPER_SNAKE_CASE.
linter: api-linter
linter_rulename: upper-snake-values
severity: ERROR
- name: unspecifiedEnumSuffix
description: >
The first value of the enum should be the name of the enum itself
followed by the suffix _UNSPECIFIED.
linter: api-linter
linter_rulename: unspecified
severity: WARNING
…
linters:
- name: api-linter
uri: https://github.com/googleapis/api-linter

15. 8. Scoring

16. 9. Policies and Controls
name: "test-manifest"
generated_resources:
- pattern: apis/-/versions/-/specs/-/artifacts/complexity
dependencies:
- pattern: $resource.spec
filter: "mime_type.contains('openapi')"
action: "registry compute complexity $resource.spec"

17. 10. Integrations

18. 11. Open Source

19. 12. Enterprise-Readiness

20. 1. Inclusion
2. Shared Language
3. Revision Histories
4. Metadata
5. Lifecycle Model
6. Search
12 Requirements for an API Governance Platform
7. Style Guides
8. Scoring
9. Policies and Controls
10. Integrations
11. Open Source
12. Enterprise-Readiness

21. github.com/apigee/registry