API Gateway

Our API Management product, DigitMarket^TM API Manager (DM-APIM) is a complete package to help manage your APIs and turn them into tools that propel your business forward. It has four components that work in unison to provide the following basic runtime functionality:

The API Publisher Portal

This portal allows API publishers to configure the APIs, API packs, usage plans, usage policies, etc. Key features include:

• Create secure API proxies
• Create API packs from multiple APIs
• Advanced Policy library with the facility to share policies across multiple APIs
• Workflow/approval cycles on policy lifecycle
• Configure transformations at API and resource levels
• Ability to create multiple usage plans with a different set of runtime policies for each plan. For instance, Basic, Gold, Silver, Platinum, etc.
• Ability to selectively deploy and manage plans on different API gateway runtime instances from a single screen
• Near-real-time statistics visualization
• Advanced and highly granular role-based access control for all features - API visibility, management, publishing, and consuming

The API Developer Portal

The Developer Portal helps developers discover, explore, try out and subscribe to the publishers’ APIs. The publisher can tailor the appearance of the developer portal as per their needs. Key features include:

• Developer self-registration
• Ability to search and navigate the API developer portal with the same user experience of an online store; with a clear listing of most popular APIs, What's new, API price, description, etc.
• Facility to manage the subscriptions through an easy-to-use interface
• The ability for internal and external developers and API providers to quickly view statistics of their API usage
• Facility for API providers to easily expose/create APIs by proxying existing endpoints and attaching policy templates
• Help/support ticket system built-in for API developers to report issues, bugs, etc.

The API Gateway

The API gateway enforces the policies defined by the publishers, validates the subscriptions, collects metrics, and enforces quotas. The API management gateway is configured and managed using the publisher portal. No coding or customization is required. Key features include:

• The event-driven paradigm used to implement the API gateway, easily achieving high concurrencies
• Policy enforcement (details of each policy is described in our answer to the next question)
• Cluster-wide policy enforcement
• Quota overrun alerts with configurable threshold
• Transaction recording for analytics
• Multi-gateway runtime architecture to support isolation of high-traffic, high-volume APIs. Configuration and management is central though
• Subscription validation and auto-renewal facility

OAuth Authentication Server

The OAuth authorization server is a software system that implements network protocol flows that allow a client software application to act on behalf of a user. Key features include:

• Token management
• Supports OAuth custom grant types

The gateway architecture supports very high concurrency as it is significantly different from traditional HTTP engine architecture. A traditional HTTP engine uses thread pools to handle request-response pairs. Each request is allocated a dedicated thread from the thread pool. Most of the requests involve an external interface, such as a database request or a third-party service call.

When the thread waits for a response from external interfaces, it is idle, as it cannot be re-used to perform other tasks. Each thread consumes operating system resources such as CPU and memory, so there is a physical limitation to the number of threads in a pool to support concurrent requests.

Our microservice gateway is built on Vert. X, which follows a different architectural approach. It uses an event bus instead of a thread pool. Any request that involves waiting for a response is pushed to the event bus and does not consume OS resources. The event resumes asynchronously when a response is received from an external interface. Therefore, there is no wastage of OS resources when HTTP requests are being processed, thereby significantly increasing the concurrency for a very high volume of requests.

The same architecture is used by the security engine to perform OAuth and other policy enforcements, so security-heavy, high-volume transactions are supported without requiring high-end hardware.

The API gateway deployment architecture supports “Auto-Scale” capability, where thresholds can be configured for each gateway virtual machine. Once the threshold increases the limits, the system automatically clones a new gateway virtual machine and attaches it to the cluster. The system is horizontally scalable when the “Auto-Scaling” is configured in the target Cloud environment, such as AWS, or on a private Cloud environment such as VM-Ware or OpenStack.

The API gateway component of DigitMarket^TM API Manager can function both as a central gateway and multiple instances of microservice gateways. It can be deployed on separate containers/machines and function as a service mesh. The micro gateway instances can be configured and monitored via the common Admin UI of the DigitMarket^TM API publisher portal. It supports hybrid management topologies; i.e. central management and distributed management at the same time. No need to worry about hefty API gateway pricing as you can set usage quotas, rate limits, and request time-outs.