What is API management?

APIs–Application Programming Interfaces–are the building blocks of modern technology and business infrastructure. At its most basic level, an API is a piece of software that allows two applications to talk to each other. APIs connect apps to apps, apps to servers, and apps and servers to consumers. As apps, software, and the cloud have proliferated to dominate the modern technology and business landscape, the number of APIs that companies use and manage have skyrocketed.

The design, development, testing, deployment, governance, security, monitoring, and monetization of APIs have become an important part of the software development lifecycle (SDLC), and a large and growing sector of the technology ecosystem. API management is the set of software and processes that support all stages of an API’s - and an API consumer’s - life cycle.

To learn more about API management, read about Google Cloud’s API management platform Apigee.

Get started for free Learn about Apigee

API management defined

API management is the process of developing, designing, monitoring, testing, securing, and analyzing APIs for organizations. API management platforms provide a robust set of software and processes with this functionality, hosted on premises, in the cloud, or a hybrid environment.

API management enables organizations to make both their public and private APIs consumable and scalable. A full-lifecycle API management platform offers these benefits by including functionality for developers to easily discover and use APIs, while also enabling organizations to control access, analyze usage, and enforce security & governance policies of APIs.

In effect, API management platforms are used to govern an enterprise’s entire API ecosystem, managing the API lifecycle from beginning to end.

What are API management tools?

A full featured API management platform typically includes the following tools:

Developer portals: A site where developers can find the information and credentials required to use APIs in their client apps. A developer portal can provide interactive documentation, developer-facing analytics, monetization information, app approval status, and other tools and services for developers.

Design and development: A developer experience and set of tools for designing and building API products, and for enabling APIs to be used by existing systems.

Testing: Allows for a wide range of testing, from mock testing to functional testing, performance and security testing of APIs.

API gateways: An API gateway performs mediation and enforcement of API calls at runtime.

Analytics and monitoring: Operational metrics, such as usage over time, allow developers to increase speed of API deployment and reliability. Monetization and business metrics, such as the revenue driven through a particular API, let organizations measure the business health of their API ecosystem.

Policy management: Policies define the operation of an API, including how often it caches data, how it translates protocols, and quotas for its use. Managing these policies is an important facet of maintaining an API.

Security and governance: APIs require consistent standards for authorization, authentication, abuse prevention, and connecting identity to client and developer credentials.

Benefits of API management

One of the most powerful use cases for APIs: they can become products for developers. APIs should be managed like any software product, including established security protections, continually optimizing performance, and iterating new versions based on user feedback. The tools within an API management platform allow organizations to provide developers a quality experience and optimal utility when working with APIs.

Other benefits of an API management platform include:

Multilayer security and privacy

API management tools make it easier to secure APIs because they often include identity and access management features, and can help manage encryption keys and configure governance policies.

Easy detection of API anomalies

API management products leverage AI-powered automation that make it easier to predict traffic patterns, and to detect and respond to anomalies in real time.

Global reach

API catalogs can be hosted on the cloud to reach a global audience of developers whether they are internal, external, or a mixture.

Performance and reliability

API management platforms can be connected to other aspects of the cloud, such as Content Delivery Networks (CDNs), to provide increased performance and reliability across the globe.

Unlock legacy applications

Deliver new experiences and services with an API management platform as an abstraction layer on top of existing services, and easily connect legacy technologies to new cloud-native systems and products via hybrid API architectures.

Create new business channels

Monetize valuable data and services by making them available to developers as APIs.

API monitoring tools

API monitoring tools are used to gather and analyze data about the performance of an API. API monitoring tools allow for full evaluation of the performance and usage metrics of a single API, an API platform, or even an entire API ecosystem; these inform developers, API product managers, and business stakeholders alike, and enable maximum agility and performance optimization.

Analytics help with end-to-end reporting on all aspects of the API program such as developer engagement, geolocation of consumers, errors, latency, performance and more. In particular, analytics allows project managers to optimize API program adoption and performance by providing granular visibility and reporting. API monitoring ensures that the APIs are available and performing as expected to maintain a seamless experience for your consumers. A full-featured API management platform should include API monitoring tools to perform the following functions:

Traffic analysis

Analyze overall traffic across various geographies, looking for traffic and usage metrics like the success rate of API responses, common error codes, or transactions per second.

Traffic analysis tools can identify the source of traffic and determine which application is generating traffic. For instance, is the traffic coming from a bot, a browser, or a library? What device is the traffic coming from?

API tracing and observability

Help with troubleshooting and monitoring API proxies running on an API management platform. API tracing lets you probe the details of each step through an API proxy flow, and observability helps developers understand the latency, performance and execution from each step as it is performed in real-time.

Performance analysis

Performance analysis tools can measure API response time, target response time, and error count across geographies while determining latencies of API proxies and targets. API performance monitoring analyzes error codes and error composition across proxies and targets.

Availability and performance monitoring

API monitoring tools track the availability and performance of APIs across the entire value chain with granular levels of detail. Monitoring tools can generate alerts when errors occur and reduce resolution times by identifying the source of errors, whether in the developer application, proxy layer, or backend target.

Developer engagement

API monitoring tools can also analyze how developers are interacting with APIs. For instance, which developers are generating the most API traffic? How are they consuming APIs? Did they read the documentation in the developer portal?

Security health

One of the prime functions of an API management platform is to secure APIs and data from bad actors, so API monitoring tools should always be scanning for risks, malicious behavior, and the overall security health of the API ecosystem.

Security monitoring tools should be able to review API configurations to ensure APIs adhere to the business’s security policies and compliance requirements. They should also be able to identify anomalies in traffic patterns, distinguish secure traffic versus potential threats, and learn who is accessing and exporting sensitive data such as developer information, trace sessions, and API keys.