Full lifecycle API management platform. APIM provides:
- API gateway: Single entry point for all backend services
- Developer portal: Self-service API documentation and testing
- Policy engine: Rate limiting, caching, transformation, authentication
- Analytics: Usage metrics, performance monitoring, and insights
API Management strategies
Policy framework
APIM policies are XML-based configurations applied at different scopes (global, product, API, operation):
A request through the policy pipeline
Inbound
- validate-jwt
- rate-limit-by-key
- cache-lookup
- rewrite-uri
Outbound
- set-header (remove)
- set-body (liquid)
- cache-store
Illustrative example
Inbound policies
Applied before request is forwarded to backend:
- Rate limiting and quota enforcement
- JWT validation and OAuth 2.0 authentication
- Request transformation and header manipulation
- IP filtering and CORS configuration
Backend policies and settings
Control backend communication:
- Service URL rewriting and load-balanced backend pools
- Circuit breaker rules on backend resources for fault tolerance
- Retry policies with exponential backoff
- Backend authentication (certificate, credentials)
Outbound policies
Applied before response is returned to client:
- Response transformation and data masking
- Response caching for performance
- Header filtering and CORS headers
- Find and replace in response body
Advanced APIM features
- API versioning: URL path, query parameter, or header-based versioning
- API revisions: Safe testing of API changes before making them current
- Self-hosted gateway: Deploy gateway on-premises or in other clouds
- Synthetic GraphQL: Create GraphQL APIs from existing REST endpoints
- Validation policies: OpenAPI schema validation for requests/responses
- Mock responses: Return example responses for API development
Developer portal customization
- Branding: Custom themes, logos, and styling
- Content management: Custom pages and documentation
- Interactive console: Try API operations with real credentials
- Subscription management: Self-service API key generation
- Code samples: Auto-generated samples in multiple languages
API-led integration
I structure APIs in three layers so that back-end systems can change without breaking the channels built on top of them.
Experience APIs
Channel-specific APIs tailored for specific consumers (mobile apps, web portals, chatbots). Provide optimized data structures and operations for each channel.
Process APIs
Business logic layer that orchestrates multiple system APIs. Implement business processes, data aggregation, and transformation logic.
System APIs
Low-level APIs that connect directly to backend systems (databases, SaaS, legacy systems). Provide standardized access to underlying data sources.