Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 1

CON Unlocking the Value of Your Enterprise IT Assets Through APIs Tim E. Hall Vice President, Product Management Oracle Fusion Middleware

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 3 Program Agenda Overview of API Management – Trends and Challenges, Yesterday, Today, and Tomorrow – Choosing your Delivery Model & Terms of Service – People, Process, & Tools – Learning from the Past Unlocking the Value – Components of API Management – How to extend your investment to address API Management

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 4 New Requirements Mobile ComputingCloud Computing Business User Empowerment

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 5 – Streamlined Operations and Maintenance – Empower the Mobile Workforce – Improved Employee Productivity – Enable Better Customer Service – Enable Better Responsiveness – Capture New Revenue Opportunities Business Drivers for API Exposure Current Trends: Organizations Are Rapidly Leveraging REST-based APIs Security and Lifecycle Management are the primary barriers to adoption

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 6 Metadata What is a Service? What is an Service? API!? Terminology, style, and reach Policies Artifacts Metadata Policies

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 7 What to Offer? API or Mobile App? Offering? Mobile App: Closed Consumption API: Open Consumption

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 8 What to Offer? API or Mobile App? Offering? Mobile App: Closed Consumption API: Open Consumption Offering Services Mobile App? API? Hybrid? How much of the user-experience do you want to control? How do you provide access for Developers? Do you monetize your API?

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 9 Choosing Your Delivery Model & Terms of Service

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 10 Terms of Service Formal Agreement is Required Defines the Responsibilities of the API Developer such as: Security & Testing Use Limits Financial Obligations ($) Defines the Responsibilities of the API Provider such as: Uptime & Availability Response Time Support Limitation of Liability

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 11 Monetization of APIs Should I charge for my API? Free API Fee-Based Content Capability Content Capability Free – Provide unfettered access to content because it drives business – Deliver a capability and monetize the transaction itself Fee-based – Content itself has value – you cant give it away – Premium capability or revenue sharing

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 12 Example: Content Free – Location Information – Product Catalog Monetizing APIs Fee-Based – Digital Media – Financial Data – Other High Value Data

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 13 Example: Capability Free – Simple offerings – Indirect monetization (Ads) – B2B Supply Chains Monetizing APIs Fee-Based – Premium offering – Proprietary Network Services – Payment Gateways

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 14 People, Process, & Tools

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 15 Capabilities & Tools What is API Management? Lifecycle Management Security API Management Breakdown the various aspects of the solution; requirements Determine which parts you have Determine which parts you need

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 16 Capabilities & Tools What is API Management? Lifecycle Management Security API Management Identity Mgmt Audit Design Time Runtime Mgmt & Monitoring Breakdown the various aspects of the solution; requirements Determine which parts you have Determine which parts you need

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 17 Capabilities & Tools What is API Management? AuthN Analytics Definition Creation Content Mgmt Community Mgmt Problem Isolation Container Orchestration Virtualization Gateway AuthZ Provisioning Key/Token Mgmt Lifecycle Management Security API Management Identity Mgmt Audit Design Time Runtime Mgmt & Monitoring Breakdown the various aspects of the solution; requirements Determine which parts you have Determine which parts you need

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 18 Capabilities & Tools What is API Management? AuthN Analytics Definition Creation Content Mgmt Community Mgmt Problem Isolation Container Orchestration Virtualization Gateway AuthZ Provisioning Key/Token Mgmt Lifecycle Management Security API Management Identity Mgmt Audit Design Time Runtime Mgmt & Monitoring Billing Capacity Breakdown the various aspects of the solution; requirements Determine which parts you have Determine which parts you need

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 19 Comparing API Management & SOA Governance Terminology & Perspectives Platform ExternalInternal Lifecycle Security Monitoring SOA Governance Catalog of available assets, services, artifacts Automation to support creation process Transaction-level drill-down and issue triage Organization dictates technology options & alternatives API Management Catalog of available APIs Automation to support consumption by developer Developer specific usage reporting Limited infliction of technology on consumers

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 20 What is the core issue? People! API Management and SOA Governance share the same goal CommunicationEngagement Examples Social MediaForums Doc.BlogsSupportOn-boarding Terms of Service Access Mgmt Error Handling Version Mgmt PricingEvents Developer Community Management

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 21 Process: Adoption Patterns & Stakeholders For Initial Projects Project Execution Portfolio Architecture Service/API Ownership Lifecycle ManagementEnforce Service Levels Enforce Policies Blueprints & Patterns Operations DRIVEN BY PROJECTS ERP, Legacy App Portfolios Artifacts

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 22 Process: Adoption Patterns & Stakeholders For SOA Governance & API Management (Broader Adoption) Project Execution Portfolio People Technology Architecture Service/API Portfolios Roles & Responsibilities Service/API Ownership Organizational Owner Lifecycle Management Shared Artifacts Enforce Service Levels Enforce Policies Shared Foundation APIs Enforce Platform Decisions Architectural Standards Blueprints & Patterns Operations DRIVEN BY INITIATIVES ERP, Legacy App Portfolios

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 23 Process: Adoption Patterns & Stakeholders Project Execution Financial Portfolio People Technology Architecture Service Usage Fees Service Funding Model Projects Portfolios ERP, Legacy App Portfolios End to End Platform FundingService/API Portfolios Roles & Responsibilities Service/API Ownership EA Group Organizational Owner Lifecycle Management Shared Artifacts Capacity Planning Enforce Service Levels Enforce Policies Strategic Platform Shared Foundation Srvcs Enforce Platform Decisions Reference Architectures Architectural Standards Blueprints & Patterns Information/Content Data Standards Data Quality Data Ownership Operations DRIVEN BY EXECUTIVES For SOA Governance & API Management (Increased Maturity)

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 24 Coordinate lifecycle setup across the infrastructure Restrict, throttle and manage Web services and REST APIs Coordinate on-boarding of developers Extend common Access and Authorization policies to all systems Connect mobile devices to existing enterprise systems Communicate, communicate, communicate… The Enterprise Architects Challenge

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 25 Learning from the Past

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 26 Does this sound familiar? Early Adoption of APIs eerily similar to Web services Lack of documentation Exposure of underlying data model Inconsistency of rules & behavior Security complexity Current API Adoption Challenges

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 27 Why invest in a catalog? We only have one API! Developer Community Management Start Simple Expand Over Time

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 28 Unlocking the Value of Your Enterprise IT Assets

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 29 Quick Review SOA Governance and Lifecycle Management Artifacts Metadata Policies Architects Business Owners IT Operations Release Management Designers Developers & Integrators Security Engineers Consumer Provisioning Definition Business/IT Alignment Creation Efficiency, Reuse & Consolidation Monitoring & Management Production Assurance for SLAs Security Systematic Enforcement of Policy

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 30 What we have today in Oracle Fusion Middleware 11g Support for RESTful services in Service Bus Mediate security and other protocol differences between mobile client and target services (e.g. expose SOAP web service via RESTful interface) Result caching of (read-mostly) target service invocations Throttling of traffic to target services Lifecycle Management and coordination across various infrastructure teams through Enterprise Repository Consumption reports available through EM Cloud Control What we have today in Oracle Fusion Middleware 11g Support for RESTful services in Service Bus Mediate security and other protocol differences between mobile client and target services (e.g. expose SOAP web service via RESTful interface) Result caching of (read-mostly) target service invocations Throttling of traffic to target services Lifecycle Management and coordination across various infrastructure teams through Enterprise Repository Consumption reports available through EM Cloud Control API Management Reference Architecture SOAP/REST and Legacy Web Services API Clients Developers Protocols HTTP, SOAP, REST, XML JMS FTP REST JWT OAM, SM Basic Auth, X.509 Security WS-Security, Basic Auth, Digest, X509, UNT, SAML, Kerberos Sign & Encrypt

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 31 API Management Reference Architecture Design-time Activities of Provider SOAP/REST and Legacy Web Services Service Bus Enterprise Repository Developers 1 Automated Harvesting of SOA Composites, Services, etc. created 2 Architect requests creation of REST-based proxy Protocols HTTP, SOAP, REST, XML JMS FTP 3 Automated Harvesting of REST-based proxy Architect adds terms of service, along with any additional documentation and metadata for REST- based API. API now ready for consumption! 4

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 32 API Management Reference Architecture Developer: Design-time Activities SOAP/REST and Legacy Web Services Service Bus Enterprise Repository Developers Protocols HTTP, SOAP, REST, XML JMS FTP API Portal 1 Developer browses the catalog and requests access to an API 2 Optional: Provider reviews & approves request for access 3 Access Token Returned to Developer

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 33 API Management Reference Architecture Runtime Activities SOAP/REST and Legacy Web Services API Clients Developers Protocols HTTP, SOAP, REST, XML JMS FTP REST JWT OAM, SM Basic Auth, X.509 Protocols HTTP, SOAP, REST, XML JMS FTP 2 User interacts with mobile app Usage Reports 1 Developer builds & publishes Mobile App 3 Usage reports can be accessed & reviewed

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 34 API Management Reference Architecture Questions at the edge Protocols HTTP, SOAP, REST, XML JMS FTP Developer Portal API Gateway

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 35 API Management Reference Architecture Developer Portal Protocols HTTP, SOAP, REST, XML JMS FTP Enterprise Repository Service Bus API Gateway Custom API Portal Custom Portal invokes exposed APIs for: Developer Facing Content, User Registration, Application Registration, custom workflows 1

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 36 API Management Reference Architecture Extended Solution with Oracle API Gateway Protocols HTTP, SOAP, REST, XML JMS FTP Enterprise Repository Service Bus API Portal Oracle API Gateway

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 37 Oracle API Gateway XML/API Threat Protection Client-based throttling REST API security (JSON schema validations, OAuth 2.0 Authorization server and client etc.) API Key Management Access control for heterogeneous deployment environments (.NET, Microsoft AD, Kerberos to SAML scenarios etc.) Native and out-of-box integration with Oracle Access Management (OAM 11gR2 / OES 11gR2 etc.) and non-Oracle Access Management solutions (CA, IBM, RSA, Entrust, Microsoft etc.) Support for Multiple Protocols (FTP/SFTP/JMS etc.) Key Capabilities

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 38 API Management Reference Architecture SOAP/REST and Legacy Web Services Service Bus API Gateway API Portal API Clients Developers 4 2 Protocols HTTP, SOAP, REST, XML JMS FTP REST JWT OAM, SM Basic Auth, X Oracle Service Bus Directly accessed by internal clients, provides: Access enforcement Routing, mediation, service throttling, response caching, versioning - abstracts backend services Rich connectivity Heavy duty payload transformations API virtualization, protocol & security translation for internal apps 2 Oracle API Gateway Exposes APIs to the external world, provides: API Key generation/validation Access enforcement Rate Limiting / Client Throttling Response caching API virtualization in the DMZ Security token & protocol mediation Firewalling, method/parameter whitelisting API aggregation & mash-up API usage measurement & reporting 3 Oracle Enterprise Repository Provides: Back-office API catalog, content prep environment API-Service dependency analysis API lifecycle management 4 API Portal External developer portal, sits on top of API repository & API gateway - provides: API marketplace Self service registration, onboarding API documentation, forums, blogs, support API testing tools API Key delivery Visualization of runtime usage metrics / monitoring Bill presentment Security WS-Security, Basic Auth, Digest, X509, UNT, SAML, Kerberos Sign & Encrypt Repository 3 1

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 39 D E M O N S T R A T I O N

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 40 Oracle Enterprise Repository The System of Record

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 41 Sample API Developer Portal Simplified Access Sample API Developer Portal

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 42 Sample API Developer Portal User Registration Sample API Developer Portal

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 43 Sample API Portal Integration with OER User Management

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 44 Leverage OER for Asset/Artifact Model Simplified Access

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 45 Leverage OER as Content Repository for Portal Lifecycle Management

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 46 Sample API Developer Portal API Browsing – Content from OER

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 47 Sample API Developer Portal API Browsing

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 48 Sample API Developer Portal Testing

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 49 Sample API Developer Portal Testing

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 50 Sample API Developer Portal Reference Architecture Sample API Developer Portal Custom RESTful Wrapper for OER REX APIs Oracle Enterprise RepositoryEJB Legacy Implementation (Test Instances) Oracle Service Bus w/ Proxy Services (Test Instances) Oracle Fusion Middleware Products Leveraged Custom Code

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 51 SOA Sessions - Thursday Session ID TitleStartRoomSpeakers CON9651Application Store Development with Oracle Enterprise Repository 11:00 AM Moscone West Glenn Cruickshank (Deloitte), Edward Lane (U.S. Army), Mala Ramakrishnan (Oracle)

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 52 Fusion Middleware Innovation Award Oracle OpenWorld San Francisco 2013

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 53 Join the Integration Community Twitter twitter.com/OracleSOA Facebook facebook.com/oraclesoa Oracle Blogs blogs.oracle.com/soa oracle.com/us/products/middleware/soa LinkedIn Oracle SOA Oracle Technology Network Oracles Public Help Forums SOA:forums.oracle.com/community/developer/en glish/fusion_middleware/soa_%26_process_mana gement/soa_suite_3

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 54 Graphic Section Divider

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 55