API Management lets an organisation publish, protect and measure its APIs from a single layer placed in front of its back-end systems. In SAP Integration Suite it has five components: API Portal, Developer Hub, API Runtime, API Analytics and API Designer.
Company systems now open data to partners, mobile apps and cloud services as well. Exposing every back end directly means solving authentication, versioning and usage tracking separately in each system. API Management brings these concerns into one layer placed in front of the back end.
01 / 05
What API Management does
Design and documentation: APIs are defined and documented with OpenAPI.
Security: Access is controlled with OAuth 2.0, API keys, basic authentication or SAML.
Traffic control: Quotas and spike limits protect the back end.
Performance: Response caching and load balancing across several back ends.
Monitoring: Call counts, latency and error data.
Monetisation: Per-call or tiered rate plans can be attached to products.
02 / 05
API Management components in SAP Integration Suite
According to SAP's documentation, API Management in SAP Integration Suite consists of five components:
API Management in SAP Integration Suite: components and the path of a callThe client app calls the API proxy running in API Runtime, not the back end; rules are applied on the proxy as policies and the call is passed to one or more API providers.
03 / 05
The path of a call: proxies and policies
The client calls the API proxy, not the back end. The proxy decouples the API from changes in the back end: if the back end moves or changes version, the address the client calls stays the same. Rules are applied on the proxy as policies:
Policy
What it does
Verify API Key, OAuth v2.0
Identifies the caller and checks its authorisation
Quota
Counts how many requests an application may send in a given period
Spike Arrest
Protects the back end from sudden load; keeps no counter
Response Cache
Keeps responses in a cache
XML and JSON Threat Protection
Stops suspiciously structured payloads before they reach the back end
XSL Transform, JSON to XML
Transforms the payload
An API proxy can be connected to several API providers with load balancing; if the additional providers are unavailable, traffic goes to the chosen fallback server. This option does not exist for on-premise type providers.
If the API provider is SAP CPI (new name: SAP Integration Suite, Cloud Integration) or SAP Gateway, services can be discovered directly. This way an iFlow endpoint is published as an API protected by policies.
04 / 05
For teams using SAP PI/PO
In SAP's definition SAP PO consists of AEX, SAP NWBPM and SAP BRM; API management is not among them. SAP's migration guide for SAP PO names API Management as the counterpart of the Services Registry in SAP NetWeaver: a developer portal with try and subscribe, analytics on API traffic, and metering.
