Businesses have been investing in APIs for some time now and this trend is only increasing. As cloud adoption increases, organisations are realising the potential of untapped data using the new services available.

API’s provide a gateway to that data and can generate new revenue streams or simply allow systems to communicate with each other in a more efficient manner.

As API usage grows and businesses reap the rewards, the need for a centralisation has become apparent. Solutions are often hosted on different platforms and architectures, making it difficult to achieve security best practices. This is also the case for monitoring, where reliable analytics are critical to providing insights into API usage for performance and billing purposes.

Azure API Management centralises your APIs wherever they are, giving you full visibility and control to manage and monitise your API estate.

Some of the benefits are:

  • Detailed monitoring including real time usage analytics
  • Deliver APIs securely through a single endpoint using a custom hostname
  • Import and transform your backend APIs from inside your corporate network
  • Apply security polices to restrict access and protect data being exposed

Let’s have a look at what consume, mediate and publish actually mean.

Consume

APIs are delivered to the consumer via the developer portal, which is essentially a website hosted within the API management service. Here developers sign in to view the published APIs and read any associated documentation.

To use an API, developers need a subscription key and without it any requests will fail. Access to this key is granted by subscribing to a product, which is a logical collection of APIs defined by the publisher.

Mediate

Mediation is applied through the API Management gateway, where all API calls pass through. At this point, transformations and polices are applied to meet any requirements that the original API may not comply with. The mediation layer applies flexibility to your existing APIs without having to modify them.

Some key examples are

  • Transformation polices to remove backend info returned in a request
  • Access restriction policies to limit call rate or restrict caller IPs
  • Caching to improve response times

Publish

The Azure portal is the place where API managers go to publish and monitor their APIs. Here you administer the APIs, products, policies and access controls.

New APIs can be added from WADL, WSDL and OpenAPI definitions but also from Azure services directly, such as Function and Logic Apps using HTTP based triggers. In fact, you could expose any service with a REST endpoint for interaction, such as Azure blob storage.

Once the API is created you can then utilise publishing features such as

  • Revisions – Make non-breaking changes to your API and set as ‘current’ when ready for consumption
  • Versions – Provide new features for testing and an optional upgrade path for end users

The monitoring options include leveraging Application Insights, Log Analytics and sending to EventHub for ingestion by other services. However, the portal itself includes detailed analytics of all API operations with no additional setup.

Using detailed logging is essential for accurate billing when monitising your APIs. After all, if you don’t know the APIs usage, you can’t bill accordingly. The topic of how to connect API Management to a billing platform is subject to another blog post, so stay tuned.

Next Steps for API Management

If your organisation is looking to better govern existing APIs or just want to start off on the right foot, Silversands can help. We provide guidance and implementation to help you exploit any existing backend solutions and achieve a unified approach to API security and monitoring. Please get in touch by filling out the form below and join one of our regular workshops and webinars providing the latest updates and expert advice about Microsoft 365, Cloud and Hybrid IT, security, compliance and partner tools. We also post regular blogs so please do follow us.

Other Resources