1. Bolster your digital transformation with Azure API Management

2. APIs Your Systems Your Users LOB Systems Cloud SAAS Data Stores
Partner Systems
Developers
Mobile Apps
Web Sites
Your Users

3. Key problem areas with publishing APIs…
How do you project your backend API?
How do you protect your core business systems?
How do you enforce your IT and business policies?
How do you engage with developers?
How do you reduce the time to first API call?
How do you measure their use and impact?

4. Consume Mediate Publish
Your Systems
LOB Systems
Cloud SAAS
Data Stores
API Management
APIs
Partner Systems
Developers
Mobile Apps
Web Sites
Your Users

5. Azure API Management basics

6. API Management - a hub for enterprise APIs
Discover
Learn
Get access
Try
Get help
SDKs and samples
1st and 3rd party apps
Abstract
Secure & protect
Manage lifecycle
Monitor & measure
Onboard developers
Monetize
Consume
Publis h
Mediate
Azure portal
Gateway
Developer portal
[AMNIMATED SLIDE]
As we established, APIs are becoming strategic business assets and should be treated accordingly - viewed as products, carefully managed, reliably protected, carefully measured but also be easily discoverable and consumable.
We believe that API Management is a foundational component enabling digital transformation. APIM is a cloud-based, fully managed “hub” for custom APIs. Its purpose is to help unlock enterprise’s treasures and make them readily available to developers. On the right side, there are API managers and developers who work together to expose various business capabilities as APIs to internal, partner and public developers shown on the left. These APIs may abstract core systems or data, higher level business processes or be purpose-built to enable various user experiences. They could be hosted on Azure, on-premises or in other clouds. APIM’s ability to create API facades, secure and protect them, target APIs to particular app developer categories, monitor, analyze and manage API lifecycle are critical on the publishing side. App developers, on the left side, discover APIs and build awesome apps that consumes them. Here, APIM helps them find an appropriate API, learn how to use the API from an interactive reference, make a first successful call in seconds without writing a line of code, download code snippets and client SDKs, get support and keep an eye on their usage. The value gets realized when end users use the apps, and here APIM gateway plays the key role. It serves as a single front door to all of the APIs behind it, tracks usage, applies policies to secure, protects and transform the APIs, improves latency by caching responses, and more. Hopefully, this gives you an idea of what APIM is and the jobs it performs.
API managers and developers
App developers
APIs on Azure and outside

7. There is a policy for that
Encapsulate common API management functions
Access control, Protection, Transformation, Caching, …
Mutate request context or change API behavior
Applied at a variety of scopes or on error
Which APIs are affected
Composed into a pipeline from effective scopes
Degree of control over inheritance of scopes, i.e. <base/> element
Set in the inbound and outbound directions

8. Advanced concepts

9. Security and protection
Username/Password
Microsoft account
Google account
Facebook account
Twitter account
Delegated (custom)
Azure AD
Azure AD B2C
Developer portal
Consume
Not available
in Basic tier
App developers
Key
OAuth 2
OpenID Connect
Client certificate
IP filter
Rate limits and quotas
HTTP Basic
Mutual certificate
Shared secret
IP filter
VNET/NSG
Gateway
Mediate
1st and 3rd party apps
Azure portal
Azure account
RBAC
APIs on Azure and outside
Publish
API managers and developers

10. Managing change

11. Everyone has an opinion on versioning
Version or not?
Semantic versioning?
What is a breaking change?
Where to place version information?
Path? Query? Header? Media type?
How to identify version?
Number? Date? Name?
Versioning debates haven’t been definitively settled. Some advocate immutability. Others, different kinds of versioning approaches, e.g. semantic versioning. Even a seemingly simple question of what constitutes a breaking change is a subject of many arguments. Each way of conveying version information has its pros and cons.

12. Our approach to versioning
Versioning is an opt-in
Natively understand versions at the system level
Offer versioning scheme options
Inform developers about the changes
Control when the changes get adopted
Versions
Revisions
Consumers choose when to adopt
Providers choose when to deploy
“I found this approach refreshing, as it provides a more pragmatic approach to API versioning while steering clear of semantic versioning that doesn’t necessarily map directly to HTTP-based APIs.”
From “A guide for when (and how) to version your API”
In light of that, we decided to provide a mechanism and leave the job of setting a “policy” to customers. First off, we don’t force anyone into versioning. We offer a selection of popular versioning schemes. We classify changes into two categories and treat each as a first-class concept in the system. Revisions allow API publishers to make, validate and apply, usually non-breaking, changes to an API without fear of breaking its consumers. Versions enable API publishers to evolve the API in more significant ways and allow app developers to opt-in into those changes whenever they are ready.

13. Versions and revisions in API Management
Service Instance
API
Version
Operation
Revision
/v1
;rev=1
;rev=2
;rev=3
;rev=4
foo
[ANIMATED SLIDE]
Here is the pre-version API model. Everyone is leaving in it now and can continue to do so. But there is a richer model if you decider to take advantage of versions and revisions. As you can see, each API can have multiple versions. And each version, multiple revisions. At any given time only a single revision is active - marked in red. Revisions can be “online” for testing (solid green) or “offline” (light green).
/v2
;rev=1
/events
/speakers
/sessions
/venues
;rev=2

14. Power BI solution template

15. Azure API Management Analytics Power BI Solution Template
Runs on your subscription for less than $10/day
Provisioned automatically
Event Hubs, Stream Analytics, Azure SQL are all scalable to meet high traffic demands
Don’t like it? Just remove the APIM Policy and delete the resource group
All source shared and maintained on GitHub
Tell us what works and what you need!

19. 2/15/ :52 PM
Q&A
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.