Bridging an API gap

VARs should make more use of APIs to create new enterprise solutions, says Dimitri Sirota

Rotating GIFs and rainbow-coloured separation bars are no longer state of the art when it comes to websites. The web is now dynamic, interactive and social. It is also open to developers.

Microsoft learned early on how to make its OS easy to build on, and all those value-added applications made its OS indispensable. Much later, Apple transformed a touch phone into a whole new platform by similarly catering to developers.

The web is no different. Salesforce.com has transformed its offering from closed-point CRM into a business platform by opening itself up.

VARs can also help businesses create a platform that drives revenue, reach and retention by showing enterprises how to open up information assets in a secure, manageable and repeatable way.

Application programming interfaces (APIs) open applications up to other applications and to developers. REST – a web-like, XML-based API protocol – has emerged in the last couple of years as a widely accepted method of exposing web data and functionality in a programmatic way to developers.

Countless websites now provide REST APIs that allow any developer to pull specific information or processes from one or more web applications, and then deliver a new composite application or mash-up inside a browser or mobile app.

Opening its short messaging service remade Twitter from a simple SMS gateway and into a communications platform with global reach. Likewise, Facebook moved from being a closed social network to becoming an open platform that developers can build on.

This doesn't happen by chance, however.

You must articulate the potential risks that are introduced by opening APIs to outside developers, and explain how to combat them. Problems can and will arise when companies publish APIs without considering that developers can misuse the APIs. Developers can send corrupted requests, reduce availability by excessive calls, try to access information without authorisation, or even break websites by attacking the underlying application.

API proxies serve as an intermediation layer between external developers and the web APIs they are trying to use. Sometimes referred to as an XML gateway, an API proxy can provide a secure control point for managing access, privacy, integrity and availability to API end points.

Some can also be configured to guard against XML and protocol attacks that can bring down websites.

Enterprises must also manage how the API is discovered, life-cycled, metred and tracked.

An API publisher will need an operations dashboard to manage versions, track use statistics across all developers, define rate plans, and invoice based on usage (assuming their APIs are pay-for-use). This is accomplished through an API operations dashboard. Most API proxy vendors can supply this, or it can be engineered from various management pieces or parts.

Developers need to be provided with a way to discover information about the APIs, register to access different APIs, and manage their own use. This is often delivered as a self-service developer-centric portal.

Some enterprises custom-build this portal based on a web CMS product. Others use an off-the-shelf web portal from one of many API proxy vendors.

As trusted technology advisers, VARs have a privileged perspective on how technology can make customers more successful. Almost every organisation has a web presence of some sort, but few use it to its full potential. Bringing APIs online promises new possibilities for enterprise customers.

Dimitri Sirota is co-founder and vice president of marketing and alliances at Layer 7