API sprawl is a growing concern for developers and organizations alike, as the number of APIs used in modern applications continues to skyrocket. With so many APIs in play, it can be challenging to manage them all effectively and ensure they are secure and reliable.

What is API sprawl?

API sprawl refers to the phenomenon of having an excessive number of APIs in an organization or system. As software development has become more modular and distributed, APIs have become increasingly important for enabling different applications, services, and systems to communicate and exchange data with each other.

However, with the proliferation of APIs across various departments, teams, and applications, organizations can end up with a confusing and chaotic API landscape, where different APIs have different standards, formats, and protocols. This can make it difficult for developers to find and use the right APIs and can lead to inconsistencies, redundancies, and errors.

API sprawl can also have negative impacts on performance and especially security.

Let’s dive into a real-world example

To shed some light on this important topic, I had a back-and-forth with a senior API developer at a large publishing organization to discuss their approach to managing API sprawl and maintaining the security and reliability of their APIs.

Join us to level up your knowledge and learn how you can take steps to manage API sprawl in your API projects.

Before we dive deeper, can you tell us a bit about your role as an API developer?

Yes, of course. As an API developer, I am responsible for building and maintaining the API infrastructure that supports our company's websites and applications which included large news sites read by millions of people on a daily basis. My tasks involve configuring API infrastructure, setting up logging and monitoring solutions, and ensuring that our APIs are secure and scalable.

That sounds like a challenging role. One of the biggest challenges in API development is API sprawl, which can lead to security vulnerabilities and operational inefficiencies. How do you handle API sprawl in your day-to-day activities?

API sprawl is a concern for us, as we have many different APIs that support our various applications and services as well as internal private APIs as well as public APIs that can be consumed by other third-party developers with open documentation.

To address this, we have implemented an API governance framework that helps us manage our APIs more effectively. This includes using standardized data formats and protocols such as OpenAPI, documenting our APIs thoroughly, and versioning changes to our APIs over time relying on Postman.

Maintaining proper documentation for an organization's APIs is a critical task, especially when dealing with a large number of developers. How do you ensure that your API catalog is up-to-date and that all relevant documentation is readily available to developers within your organization?

Yes, documentation is a critical component of our API development process, and our API catalog must be maintained and updated regularly. To do this, we use a centralized API management platform that allows us to easily document and manage our APIs in a centralized location. We also use automated tools to generate API documentation and ensure that it is always up-to-date.

That sounds like a good approach. With such a large number of developers in your organization, how do you ensure that everyone is aware of the latest API documentation and best practices?

We have an internal portal that provides easy access to our API documentation and best practices. We also have regular training sessions and workshops where we share updates on our API development process and provide guidance on best practices. Additionally, we have a dedicated API development team that serves as a resource for developers throughout the organization, helping to answer questions and provide guidance as needed.

Maintaining proper API documentation and catalog is critical to the success of your API development process. Can you share any tips for other organizations looking to implement a similar approach?

Yes, my advice would be to invest in a robust API management platform that supports the documentation and cataloging of APIs. It's also important to establish clear guidelines and best practices for API development and to regularly communicate updates and changes to the broader development team. And of course, it's important to have a dedicated team that can serve as a resource for developers and ensures that everyone is following best practices and adhering to your organization's API development standards.

API versioning can be a challenging aspect of API development. How do you approach API versioning in your organization, and what are some best practices you recommend for others to follow?

Yes, API versioning is definitely a critical aspect of API development. In our organization, we follow the "semantic versioning" approach, where each API version is identified with a major, minor, and patch version number. Major version changes indicate breaking changes to the API, while minor version changes indicate new functionality, and patch version changes indicate bug fixes or minor changes that are backward-compatible.

One best practice we follow is to always include the API version number in the URL path, which makes it clear to consumers which version of the API they are accessing. We also recommend having a well-documented versioning strategy, so that developers and consumers of the API can easily understand how versioning works and what changes are expected with each version update.

It's also important to communicate version updates and changes to consumers of the API. This can be done through release notes or changelogs, and it's a good idea to give consumers ample notice before any major version changes occur.

That's great advice. What about managing deprecated versions of an API?

It's important to have a clear policy for deprecating and retiring older versions of an API. We typically give consumers of the API a reasonable amount of time to transition to the new version before retiring the old one. During this transition period, we may continue to support the old version with bug fixes or security updates, but we will not introduce new features or functionality.

We also recommend having a well-documented deprecation process that outlines the timeline for deprecation and retirement, and the steps that consumers should take to transition to the new version. By communicating these changes clearly and proactively, we can ensure a smooth transition to new API versions and minimize any disruption to consumers.

Can you share any examples of security threats you have faced in your API development work?

Yes, one example comes to mind where attackers were actively scanning for older versions of our API and attempting to bypass authentication measures. We had deprecated an older version of our API, but we were still supporting it with security updates and bug fixes. However, the authentication method used in the older version was less secure than in the current version.

Attackers were able to identify which customers were still using the older version, and then tried to exploit the less secure authentication method to gain unauthorized access to customer data. Fortunately, we were able to detect and block these attacks before any data was compromised thanks to Akamai's insights into security events.

To address this issue, we immediately retired the older version of the API and communicated with customers who were still using it to transition to the newer, more secure version. We also implemented additional security measures to prevent similar attacks in the future.

That's a great example of the importance of properly managing API versions and maintaining strong security measures. What advice would you give to other API developers to protect against similar attacks?

My advice would be to regularly review and audit your API versions and authentication methods and to retire older versions as soon as possible. It's also important to implement strong authentication and authorization measures, such as multi-factor authentication and access control lists, to prevent unauthorized access to sensitive data.

In addition, it's important to monitor your API traffic and logs for any suspicious activity, such as repeated failed login attempts or unusual access patterns. By being proactive and vigilant in our security measures, we can minimize the risk of successful attacks and protect our customers' data.

That's great to hear. Another big challenge in API development is preventing API attacks. How do you protect against these types of attacks?

Of course, we rely heavily on Akamai's App and API Protector to prevent API attacks. This solution provides us with real-time visibility into API traffic and can automatically detect and block malicious requests. It also includes a range of security features, such as rate limiting, geo-blocking, and token-based authentication.

That's impressive. Can you share any other anecdotes about how attackers have tried to break through your API defenses in the past?

Yes, we have had several instances where attackers have tried to break through our paywall, which is implemented on our website for reading news articles. One common tactic that attackers use is to use automated bots to scrape our website for premium content. To prevent this, we use Akamai's Bot Manager, which can detect and block bots in real time.

That's interesting. It sounds like Akamai's solutions are a critical part of your API development and security strategy. For other developers who may be struggling with API sprawl or preventing API attacks, what advice would you give them?

My advice would be to implement a robust API governance framework, use standardized data formats and protocols, and work with a trusted partner like Akamai to ensure that your APIs are secure and scalable. It's also important to stay up-to-date on the latest security threats and vulnerabilities and to proactively monitor your APIs for any signs of suspicious activity.

This has been a great conversation on API sprawl and the various strategies and tools that can be used to manage it. For developers who are looking to learn more about this topic, where can they go for additional resources?

There are several resources available online that can help developers stay up-to-date on the latest best practices for managing API sprawl and ensuring API security. One excellent resource is the OWASP API Security Top 10, which provides a comprehensive list of the top security risks associated with APIs and strategies for mitigating those risks.

In addition to the OWASP API Security Top 10, there are also several online communities and forums where developers can connect with others who are working on API development projects. These communities can be great resources for getting advice, sharing best practices, and learning about new tools and technologies.

That's great advice. Can you recommend any specific online communities or forums that you find particularly useful?

Sure, some of my favorites include TheHackerNews site and the API Developer Weekly newsletter. These resources provide a wealth of information on API development, as well as opportunities to connect with other developers and stay up-to-date on the latest industry news and trends.

I want to thank the source for sharing their insights with us. It's clear that API development and security is a complex and ever-changing field, and it's great to hear how these challenges are being addressed in this real-world example.

Disclaimer: For full transparency, yes, I am employed at Akamai Technologies as a Senior Developer Advocate, and the API developer I talked to works at a publishing company that is a customer of Akamai. The goal of this article is to educate you on API security topics but if you are interested in learning more about Akamai's App and API Protector, Bot Manager, and other solutions for API security, please visit the Akamai website.