This talk will dive deep into API Management in the IoT space and discuss: Device registration Exposing devices as APIs Applying API management best practices to manage device APIs Discuss why OAuth2 is a natural fit for authorizing access to devices Demo of a device exposed as a managed API The session was presented at APIDays + APIStrat & Practice Berlin 2015.

1. IoT & API Management-
A Match Made in Heaven
Sumedha Rubasinghe
Director – API Architecture
@sumedha_ruba
April 26, 2015

2. **
Things, Devices, IoT
Source: http://www.control4.com/blog/2014/03/the-internet-of-things-and-the-connected-home

3. **
M2M, IoT
Source: http://community.arm.com/groups/internet-of-things/blog/2014/06

4. **
IoT Device Eco System

5. **
IoT Device Eco System

6. **
IoT Platform Challenges
Device Registration & Management
Integration
Security - Data
Scalability
Event Management
App/Firmware Management
Security – Device Access

7. *

8. **
IoT Platform – Reference Blueprint

9. **
Applying principals of API world into IoT

10. **
IoT Device
● Piece of hardware
● Built for a purpose
● Capable of a limited functionality
● Control interface
● Input/output
● Consumes power
● Constrained Environment
Characteristics
Summary
● Functional Capabilities (Actuators)
● Administration Capabilities (Management)
● Monitoring Capabilities (Sensor Data)

11. **
Modeling Device as an API
● eg : HTTP API (not limited to)
○ Lock
■ GET http://{ip}/{locationid}/sensors/door1lock/staus
■ POST http://{ip}/{locationid}/sensors/door1lock/lock
○ Temperature Sensor
■ GET http://{ip}/{locationid}/sensors/temperature1
○ Motor
■ POST http://{ip}/{locationid}/actuators/motor1/rotate/{turns}/{direction}
■ GET http://{ip}/{locationid}/actuators/motor1/status

12. **
Advantages - Devices as APIs
● APIs - Standard Integration Pattern
○ Heterogenous devices
■ protocols, access control mechanisms, data formats
● App Developers - Already familiar programming
paradigm
● Seamless Integration with existing systems
● Ability to re-user known patterns for securing,
hardening APIs
● API Economy

13. **
Open APIs | Managed APIs

14. **
Device API – Open | Managed ?

15. **
Devices Need More Capabilities..
● Throttling
● Caching
● Request Routing
● Buffering
● Stats collection & monitoring (Passive Analysis)
● Alerting (Real time Analysis)
● Decision Making (Predictive Analysis)

16. **
Sounds familiar?
● Throttling
● Caching
● Request Routing
● Buffering
● Stats collection & monitoring (Passive Analysis)
● Alerting (Real time Analysis)
● Decision Making (Predictive Analysis)
Similar requirements in
API Management world

17. **
Mapping Oauth(2) -> IoT Device Access
● Device capabilities -> resources
● OAuth (2.0) tokens -> authorize access
● Tokens -> expire, grant/revoke access

18. **
IoT Device Eco System + API World
Creating a new Device API (versioning)
Registering a new Device Type (OAuth2
application -> consumer key)
Device Owner Registering a Device (obtaining
access token)
Device Publishing Sensor Data
App Accessing Device (Controls)
Device Polling for Pending Actions
Writing Apps for Device APIs
Virtualization (for testing)
Controlling and Monitoring Devices

19. **
Registering a New Device Type

20. **
Owner Claiming a Device

21. **
Device Publishing Sensor Data

22. **
App Accessing Device

23. **
Device Polling for Pending Actions

24. **
WSO2- Reference Architecture for IoT

25. **
Thank You