What is API management?

API management is the set of means by which an organisation exposes its APIs, controls access to them and their usage, and steers their lifecycle. Concretely, it is a platform layer placed between the consumers of an API and the services that implement it.

That layer delivers three things no business service can deliver on its own. It decouples: the contract exposed to consumers stays stable while implementations change. It pools the cross-cutting controls: authentication, quotas and logging are applied once, in one place, instead of being reimplemented in every service. And it gives visibility: who consumes what, at what rate, with what error rate.

The scope goes well beyond the gateway. A gateway with no governance and no portal applies rules to traffic nobody can describe. It is a web server mistaken for a website.

The five pillars

Five functions describe what a platform has to deliver. They serve as a grid for evaluating a product, and as a diagnosis for a platform already in place.

• Discovery: how does one find what exists, and how does one make a first call?
• Observability: what is happening, and where is the cause when it degrades?
• Governance: how does an API evolve, and how is it retired?
• Mediation: what does the platform do between the call and the service?
• Access: who is calling, with what proof, and how far?

Each pillar degrades independently of the others, and the cost of that degradation does not surface in the same place. Weak discovery is paid in weeks of integration work at the consumer's end. Weak governance is paid on the day an API used by forty applications has to be retired. The overview is on the pillars page.

The three components

Three technical building blocks carry those five functions. They share neither the same operating regime nor the same criticality, and most commercial offerings sell them under a single name.

The gateway is on the path of every call. It authenticates, applies quotas, routes and logs, within a budget of a few milliseconds. When it fails, traffic stops.

The control plane is where APIs, policies and contracts are declared. It sees no traffic at all, and the gateway has to keep serving if it goes down.

The portal is the visible face for consumers: documentation, getting credentials, first try. Its quality is measured by the delay between a developer arriving and their first successful call.

Going further

The guide takes each of these subjects in detail. How many gateways to run and where to place them is covered in architecture. Moving from console configuration to a versioned pipeline is covered in industrialise. To situate a platform that already exists, start with where do you stand.