Today's enterprise technology landscape revolves around modern digital platforms that engage with internal and external customers more than ever before by exposing their assets, such as data and services, using Application Programming Interfaces (APIs). APIs have become a tremendous opportunity for organizations to expand their business to new horizons.

According to Harvard Business Review (https://hbr.org/2015/01/the-strategic-value-of-apis), Salesforce.com (https://searchsecurity.techtarget.com/news/2240222882/API-gateways-emerge-to-address-growing-security-demands) generates 50% of its revenue through APIs, for Expedia.com (https://www.slideshare.net/faberNovel/why-shouldicareaboutap-is4/45) it's 90%, and for eBay (https://www.programmableweb.com/news/ebay-opens-platform-to-3rd-party-developers/2008/06/16) it's 60%. Salesforce.com has a marketplace (AppExchange) for apps created by hundreds of its partners. Expedia exposes its APIs to third-party applications for booking flights, hotels, and cars. eBay generates revenue by exposing APIs to list auctions, get customer information, retrieve information about the items listed, collect feedback, and more.

This data clearly shows that organizations have realized the significance of APIs in the modern era, and the trend is becoming so prominent that any organization without a proper API strategy is like an organization without an internet connection.

Huge growth in exposing services and information to internal and external customers brings various challenges and risks in terms of building, managing, maintaining, and securing APIs. The following are some important challenges in managing APIs:

• Security: Since enterprises expose their services and information through APIs, it is essential to be vigilant against potential threats and hacks. It is also vital to ensure that the usage of APIs is throttled and controlled in a way that supports the load on the backend and monitoring policies. APIs also need to be compliant with regulatory guidelines, with proper authentication, authorization, and auditing capabilities.
• Exposing facades and versioning: Developers publish APIs to internal and external applications in an organization. These APIs need to evolve and adapt to changes, which can be either breaking or non-breaking. It is vital that publishers ensure that changes they make do not violate the applications that consume those APIs. To ensure this, they need to expose facades to customers and make changes at their backend. However, if the publisher can't avoid breaking changes, they need to ensure they publish a different version of the same API. Handling these breaking and non-breaking changes is a challenge for any organization.
• Faster onboarding and adoption: Organizations need to ensure that developers can access APIs easily and without manual intervention. Application developers should be able to get up to speed quickly with the help of interactive documentation, sample code, and a developer console. If the process involves manual steps, then developer productivity decreases, the adaption rate goes down, and APIs will not be able to meet the reach expected of them.
• API usage analytics: APIs are becoming bread and butter for organizations. As such, organizations need to keep a check on the usage, performance, and reliability of services exposed through APIs. A straightforward approach to getting analytics from exposed APIs is essential for ensuring healthy and efficient operations.

The following topics will be covered in this chapter:

• Various building blocks for API Management
• Developer Portal and Administrator Portal
• Policies in API Management
• Handling large messages in hybrid integration scenarios