3scale

Cloud Security Panel Article / Programmable Web

Steve — Thu, 10 May 2012 18:32:47 +0000

Andreas Krohn from Dopter provided a cool writeup of the Cloud Security panel at infosec over at programmableweb in case people missed it.

Indeed the lesson that stood out most of all is that organisations are used to having close control over the clients for their internal assets but that with many APIs now powering mobile applications and third party access this control is dissipated, requiring new levels of care for user level security. Protocols such as openAuth are key to this shift but their adoption means clear thinking is needed as to who the parties are, where they come from and how to structure access rights.

(Participants in the panel were Travis Spencer from Ping Identity, Steven Willmott from 3Scale, Per Hägerö from Technology Nexus and Andreas Krohn from Dopter. Moderator was David Terrar from Eurocloud UK).

3scale

Welcome to the New 3scale – more power to you!

Steve — Mon, 07 May 2012 21:23:07 +0000

We’re happy to announce the release of our new revised API platform today which we think you’ll love. The official press release is here (3scale platform release) but we wanted to give you some insights here too. The new systems are now live for signup.

The team has been hard at work and we’re exited about the update because it makes a lot of new tools available for APIs and at the same time makes the platform more accessible. There are UI changes all over to make 3scale easier to use and an all new support portal as well. The biggest new features are:

A new improved more powerful developer portal system which extends our previous enterprise solution – and is now available in all 3scale accounts! So you can run your developer portal with a fully-fledged CMS that provides full control over branding, content and developer signup workflows.
Powerful Interactive “Active Docs” API documentation based on the Swagger Framework which allows developers to explore APIs live from documentation web pages.
An easy to install open-source on-premise API Traffic manager based on the Varnish proxy that enforces API traffic rules and integrates seamlessly with 3scale’s infrastructure – see our deployment options now on the support portal and Varnish here.

You’ll find a lot of new tweaks such as control of the authentication types of your API (API Keys, OpenAuth and others) to fine grained rate limit alerts and control over all outgoing emails to your developers.

The new 3scale Free platform is available up to 50,000 API transactions per day and can scale as your API grows up to 100′s of Million of calls per day with the Enterprise offering including enterprise grade SLAs, support and additional features and tools.

Watch this space for more info on the new features packed into this release – better yet, get a free account and let us know what you think!

3scale

3scale Democratizes APIs With New Free Self-Service API Management Infrastructure

Guillaume — Mon, 07 May 2012 20:37:14 +0000

With 3scale New Infrastructure Open, Distribute and Manage APIs in Just Three Easy Steps

SAN FRANCISCO, CA- (May 7, 2012) – 3scale (www.3scale.net), one of the leading players in the API infrastructure market, today announced their new free self-service API management infrastructure platform. The platform removes many of today’s barriers to launch and operate web APIs — enabling any company to provide access to their APIs whilst staying in full control of data volumes, audience and usage.

Web APIs are fast becoming key to many web businesses as companies seek to open their data and services to others for integration, to power mobile applications and enable powerful ecosystems around their products. “3scale mission is to make it fast and easy for everybody on the web to distribute and operate APIs — something we see as the underpinnings of where the Web is going,” says Steven Willmott — co-founder and CEO of the company. “To date, API Management solutions have been expensive and inaccessible for general use — but as APIs become more critical we wanted to make sure best of breed solution was available to everybody.”

3scale API Management infrastructure provides companies and developers out-of-the-box API Key Management, Access Control, Rate Limiting, Analytics, Developer Portal, Tools and Monetization.
The new platform updates much of 3scale’s existing infrastructure and as well as adding key new features such as:

Your developer portal at developer.yourdomain.com driven with a fully-fledged CMS which provides full control over branding, content and developer signup workflows.

Powerful Interactive “Active Docs” API documentation based on the Swagger Framework which allows developers to explore APIs live from documentation web pages.

An easy to install open-source and on-premise API Traffic manager based on the Varnish proxy that enforces API traffic rules and integrates seamlessly with 3scale’s infrastructure.

3scale powers 100+ APIs and has over 60,000 developers writing applications using these APIs. Current 3scale customers) and new APIs launching about to launch are already taking advantage the new 3scale API Management platform.

“The new platform brings together the best solutions in a single API Management platform that enables almost anybody to distribute an API — with as few barriers to entry as possible and scalability all the way up to enterprise grade high volume APIs,” says Guillaume Balas, CMO at 3scale. “Providing these tools for free will means more companies and individuals can open APIs and in turn help power the API economy as it grows.”

Access to the new platform is via instant signup at www.3scale.net

About 3scale:
3scale is one of the world’s leading cloud-based API infrastructure providers and enables developers, and enterprises to securely open, control, manage and monetize their APIs. 3scale unique suite of infrastructure services brings API providers unprecedented control, visibility on API activity and peace of mind.
For more information www.3scale.net or contact sales@3scale.net

3scale

Stackoverflow Day Barcelona

Steve — Sun, 29 Apr 2012 00:31:38 +0000

A shout out to everybody who attended the Stackoverflow Day Barcelona – organised by Robotmedia with a bit of help from us – after a hard week we skipped the presentation and just chilled out + had some video fun:

Hope we’ll get some video from other #SOMeetups around the world – http://blog.stackoverflow.com/2012/04/tips-for-planners-of-meetups/.

3scale

The API Economy – Tapping into Identity and the Inside-Out Enterprise

Steve — Fri, 27 Apr 2012 12:11:42 +0000

APIs are increasingly being recognized as one of the most important infrastructure trends for enterprises in the next few years as more companies seek to open up their internal systems to customers, partners and other third parties. The API Economy Session at EIC 2012 last week was a great snapshot of both he potential and the challenges involved in such a transformation.

Craig Burton (KuppingerCole) provided an an excellent overview of the opportunities of the API Economy and there were presentations and inputs from Fulup Ar Foll (KuppingerCole), Kim Cameron (Microsoft) and Martin Kuppinger (KuppingerCole). The day before Ping identity’s Andre Durand also highlighted Cloud APIs as one of the most important new frontiers for Identity in his keynote.

Our slides on the provider view are here:

The API Economy: API Provider Perspective / European Identity Summit 2012

View more presentations from 3SCALE

Reflecting on the event, many of the challenges organizations will face in taking advantage of these new opportunities revolve around the fact that they are authenticating and authorizing new types of users to their systems and this is happening in two dimensions simultaneously:

From Internal to External: Many of today’s identity management solutions focus on the internal systems of the enterprise – which employees, divisions and systems are permitted to access which systems. This is an extremely challenging problem. However, it becomes even more challenging when access must provided to external parties as is generally the case with Open API – often the external parties are trusted to an extent but not completely and different levels of access are needed to determine who gets what, furthermore user directories are no longer fully under the control of the owner of the data or service in question.
From Human to Machine: Today’s systems are primarily concerned with granting “Human access” to systems with interfaces accessible in the Browser or through some other UI. This means certain types of authentication are appropriate and the expected capacity of users is reasonably well understood. For API’s however, this changes radically since access is generally granted to software systems developed by external third parties – software systems which might be orders of magnitude faster or more data hungry than human users.

Given these trends and the economic imperative for open APIs, the next few years are likely to see a powerful trend towards managing identity across organizational boundaries and – viewing enterprises as a collection of services they expose and manage access to, rather than as a set of end products they produce.

3scale

Infosecurity Europe 2012 Cloud API Security Panel

Guillaume — Tue, 24 Apr 2012 16:37:58 +0000

Steven Willmott, co-founder and CEO of 3scale on the Infosecurity Cloud API Security Panel

Abstract:

The cloud and mobile are changing our societies in phenomenal ways. The increased usage of smartphones, tablets, and cloud computing is presenting organizations with new business opportunities and challenges. Companies worldwide in every industry are finding that they can expose new and existing data as Application Programming Interfaces (APIs) to open up new markets and penetrate deeper into existing ones. By exposing info as machine-consumable APIs, organizations are transforming themselves into platforms that third-parties can build rich, mobile applications on top of. By implementing these APIs using cloud computing technologies, innovators are able to expose data in ways that scale elastically as the need arises. The multitenant, self-service nature of the cloud also allows data to be made available to smartphones and tablets with less investment and development.

Securing Cloud APIs is an absolute necessity. Figuring out the best way to do so can be difficult though. To shorten the learning curve, to understand how Cloud APIs are different from SOA and Web 2.0, and to learn how to securely launch and run a Cloud API, this expert panel will provide you with advice, knowledge, and recommended best practices. These will help you quickly take advantage of the new possibilities while simultaneously managing the associated risks.

Participants

David Terrar, Director of EuroCloud UK as Moderator
Per Hägerö, CTO, Technology Nexus as Panelist
Andreas Krohn, API Evangelist & blogger, Dopter as Panelist
Travis Spencer, Sr. Technical Architect, Ping Identity as Panelist
Steven Willmott, CEO, 3scale as Panelist

3scale

Opening Data for Fun and Profit

Steve — Tue, 03 Apr 2012 19:56:42 +0000

One of the big themes at today’s Data 2.0 Summit is definitely around opening data in various ways – a topic close to our hearts. Here’s our presentation from the day.

Opening Data for Fun and Profit

View more presentations from 3SCALE

To see what 3scale infrastructure can do to help, there’s info here and you can get a free account and try it out.

3scale

API Management Solution: “As a Service” vs. “Perpetual” licensing model

Guillaume — Sun, 26 Feb 2012 14:00:58 +0000

API is a 3 letters acronym that you will have seen all over the Tech Blogs and Tech Media, especially during these last months. Why? Because APIs are the glue between today’s Internet applications, services and technologies. They are the key underlying piece of infrastructure for mobile apps, for enterprise software integration and B2B. APIs are currently redefining how companies develop their products and execute their business.

And just as for any other critical connectivity or integration brick, you will want to control and monitor your API to ensure QoS and SLAs. And as for any new business line you would launch, you will want to and need to define, implement and operate a business model.
3scale provides a Cloud API Management Platform & Infrastructure to achieve precisely this task: enabling developers and companies that want to securely open, control, manage, operate and eventually monetize their API to 3rd parties.

The differences between 3scale and its competitors are twofold: (1) the “as a service” vs. “perpetual” licensing and (2) the way 3scale integrates with your existing infrastructure.

Solutions competing with 3scale are built around a fully proprietary software component which must either be licensed and hosted within your own operational infrastructure or hosted by the API provider in the cloud and have all API traffic redirected through it.

3scale’s model on the other hand works as a set of backend cloud services that can be called from many different integration points. Integration options include software plugins integrated directly in your application, deployment within popular high performance open source proxies such as Varnish or powerful CDN architectures such as Akamai or CDNetworks.

Before opting for a proprietary proxy-based API management solution service offering, consider the implications carefully.

The Proprietary Proxy Issues

A proprietary proxy when deployed on-premise will filter traffic as it goes in and out of your corporate network and when deployed “as a service” in the cloud will funnel traffic through before it reaches your corporate network.

The on premise proprietary proxy approach has 2 major problems:

Cost: licensing costs for even a minimal on-premise installation begin at $10’s of thousands and often reach more commonly $100’s of thousand’s.

Agility/Integration: an on premise install will conflict with your existing systems for security, load balancing, etc. Additionally it involves forcing all traffic through one (or a small number) of traffic ingress points – centralizing it when actually most companies at scale:
- Operate multiple data centers,
- Multiple units deploy services,
- Already have security gateways and filters in place (e.g. Vordel, IBM Data Power, Cisco Gateway).

Therefore you either have to buy many licenses (generating more cost) or create another unwanted front-end bottleneck.

The “as a service” proprietary proxy (aka cloud hosted gateway) approach suffers from very similar problems (minus the TCO hit you take for hosting the actual machines) and a few more since all of your API traffic would be going through a third party:

Added Latency
Bandwidth cost
QoS & SLA: if the third party fails your API service will fail too.
Security: the cloud proxy potentially has visibility on the entire API call payload, including information that is sensitive and confidential

The 3scale Advantages

At 3scale we believe you should be in full control of your API stack – and pull in extra API services exactly as, when and where you need them! No bottlenecks, no big upfront costs and no magic black boxes.

A Free Open Source Traffic Management Gateway
3scale provides the traffic management gateway itself free of charge as open source. You can deploy it locally and connect it to 3scale to provide you out-of-the-box operation: access control, analytics, monitoring, and billing/payments thus making the proxy become a commodity.
More information >>

High Performance
By routing API traffic through a proxy before getting to the source of the data, you introduce indirection. Indirections in turn increase latency.
3scale introduces no latency in that the traffic management plugin/gateway caches active policies and applies them locally.
Additionally you can deploy this cache wherever you want in you infrastructure stack, providing you with complete control over your Enterprise IT environment with no enforced bottlenecks.

Elasticity & Scalability
3scale’s Cloud API Management solution “as a service” has a unique architecture based on a set of APIs that:

Provides elasticity and scale on-demand
Makes it easy to implement without losing the ability to control your underlying infrastructure solution.

Additionally 3scale’s cloud based API Management solution on one hand removes the maintenance hassle from your company and on the other hand offers more reliability thanks to the multiple levels of failover implemented: zone, region, and network.

Return on Investment
3scale’s API Management solution is also significantly cheaper than those offered by others:

No initial investment
“Grow as you Go” Model: enabling you to “trial”, start small and grow your API business at your own pace.
Cheaper cost per call: 3scale only sees a management trace of your traffic

Agility, Integration
3scale enables API providers to deploy its traffic management plugin/gateway in at any location that makes sense and do this just with a software download (no long sales process or up front cost).

Finally, like Salesforce, Zendesk, Intuit or Netsuite, 3scale’s API Management architecture includes a set of APIs (Traffic, Account, Analytics and Billing Management) enabling you to create all the external facing connections you need, and keep track of operations while linking to your existing IT infrastructure such as identification systems, business intelligence, an existing web portal or a billing system.

About 3scale:
3scale provides a Cloud API management Platform & Infrastructure for developers, and companies to securely open, control, manage, operate and monetize their API to 3rd parties (e.g. developers, business partners, etc).

3scale API management platform is Plug and Play, configurable, flexible and scalable and brings API providers an unparalleled level of ownership, control and configuration to ensure QoS, SLA and a great user experience.

3scale’s technology powers Skype, Wine.com, Viadeo, JustAnswer.com, and the API [R]evolution

3scale has offices in the Silicon Valley, the UK and Spain. For more information on 3scale, visit: www.3scale.net or contact us at sales@3scale.net

3scale

Publishers and B2B v’s B2C API Value

Steve — Fri, 24 Feb 2012 21:08:19 +0000

Jack Marshall at Digitimes posted a great article this week on Publishers entering the API Era – definitely worth a read. We’re seeing many of the same dynamics across APIs 3scale manage also (both in text media, data, video and music). It’s interesting to see various trends play out andth ere are arguably two distinct high level types of APIs emerging in the publishing space which are not always distinguished:

Business-to-Business Data Publishing: companies such as Reuters, Bloomberg and Lexis Nexis have long published data in a Business-to-Business sense and are increasingly turning to APIs to help make this process seamless for their customers. The data can be sliced and diced by API in ways which via previous means such as terminal access just wasn’t possible. Business models also clearly revolve around the sale of access to data (the Data is the main event).

Direct to Consumer Media Content Publishing: the second broad class is for media companies who reach consumers more directly and effectively provide an end product such as the Wall Street Journal, the New York Times and others. While the sale of content itself is an important element of these businesses, at least as important are associated revenue streams such as advertising and syndication that monetise the other key assets these companies have – namely the their readership and public brand value.

These two types of business are often talked about together with respect to APIs but they are actually very different.

Business-to-Business data publishing is seeing significant year on year growth according to analysts such as Outsell (4-7% depending on the category) and the switch to digital is accelerating. APIs are enabling finer grained distribution of this data, tighter integration to specific providers and the ability to open access to mid-sized and smaller customers (one of the key drivers of Bloomberg’s recent announcements). APIs will no doubt act as an enabling mechanism for companies in the Business-to-Business Data space to make their data available to wider audiences.

On the direct to consumer side, things are arguably more complex and the business environment is significantly more challenging. Direct to consumer publishers have two key assets – their content and their audience and face an increasing struggle against loosing touch with their audience as distribution channels such as Apple’s iTunes store, Google, Facebook and Amazon become the main points of user access to content. While such channels deliver volume, they risk disintermediating publishers from their audiences (See GigaOm/Businessweek’s take on this for example) – something which would substantially harm the ability to deliver crucial revenue via channels such as advertising (the less you know about your user, the weaker your ability to deliver relevant advertising against your content). This creates a conundrum – easing access to data so that it can more easily flow into these channels or trying to retain a connection the audience.

For both objectives, APIs have a strong role to play – as programs such as those from the Guardian and the New York times have shown, APIs can drive innovation in how content reaches the consumer and in what forms they experience it – particular on mobile platforms. This opens up the number of potential distribution channels and potentially spreads risk from dependence on just a few key channels.

Furthermore, APIs provide the ability to deliver content in “multi-channel” way to multiple locations – potentially based on a single subscriber identity (3scale’s systems allow API providers to do this) – this is a crucial ability that opening the door for publishers to take closer control of which users are accessing their content independent of the channel. The notion of a channel independent content subscription (or at least user identifier) is likely to be a central element in enabling publishers to maintain their connection with their audience.

Companies such as PeekYou, Peoplebrowsr, Klout and others now also provide valuable data by APIs which can help understand users and add value to their experience while accessing content.

3scale

Getting the right proxy for your API

Josep — Wed, 15 Feb 2012 16:12:36 +0000

Proxy or no proxy for your API? That’s not the question. One of the common debates when setting up an API management system is whether to proxy your traffic in some way before it reaches your application stack – and there are pros and cons to different architectures. however that’s not the goal of this post.

If a proxy based architecture fits your requirements the next question remaining is what proxy should we put in place? Yes, there are options, in fact there are many. On one hand there are the closed proprietary proxies offered by different vendors. On the other hand there are open-source proxies like Varnish, Squid, Apache, Nginx, etc.

Proxies are basic components of today’s technological stack, just like web servers or load balancers. At 3scale we believe that is better to integrate, extend and support open source solutions rather than reinventing the wheel and charge for it. Is your API using a proprietary web server? Probably not. Apache and Nginx alone have more than 75% market share as of 2012. Why proxies should be different?

Open source is not a matter of licence costs, let alone a matter of being cool. Is a matter of production ready software, proven high-performance, reliability, community support, plenty of documentation and examples and public scrutiny to detect and fix security vulnerabilities, etc.

So, which open source proxy should you look at? There is no right or wrong answer here. It depends on your current stack, on the expertise on a particular framework, it even depends on personal taste. What is important is that there are terrific solution readily available. Squid is one, the proxy modules for both Apache and Nginx are also very interesting specially if you are already using Apache or Nginx for your web server. But perhaps the most famous one is Varnish, never heard of it? Time to get updated.

Varnish is part of the infrastructure at power-houses such as Twitter, Facebook, Heroku, LinkedIn. But proxy/caching is not a used widely, also beyond the biggest sites; Softonic, Peoplebrowsr, Magento among many others also use it to power-up their backend.

According to Varnish’s web page,

Varnish is a web application accelerator. You install it in front of your web application and it will speed it up significantly.

This one-liner on their main page does not make justice on how powerful Varnish is. Architecturally Varnish is a proxy that stays in front on your HTTP stack (roughly speaking, the tech stack that ends up serving web pages and/or API requests).

Varnish usually is placed in front of a web server like Apache, Nginx, Tomcat, IIS, Thin, etc. Whatever web server you use, you can stick a Varnish in front of it like that

After the initial setup, which takes minutes to have up and running, Varnish will cache the heck out of your application, whether it is web pages or API calls. The caching layer is extremely configurable and can be used to serve both write or read heavy workloads. The must read blog High Scalability has a recent entry on Varnish that says it all, and better.

Can we use varnish to scale our API? Absolutely, in fact, you should. API requests are web content and as long as you don’t have a write only API the benefits of an open, well maintained and secure proxy + caching layer will save you on the load of your servers at the expense of less revenue for Amazon/Rackspace/Softlayer.

Our API does not have scalability problems as of today, we are still low on traffic. True, you don’t have to use it, but serving a request from the varnish cache can be order of magnitude faster than if the API request has to go all the way down to your application code. Latency matters, and you don’t want your API to be “slowish”.

So if your API needs a proxy, can you use 3scale? Absolutely, if your choice of proxy is Varnish you only have to add the new 3scale module for it, available on github. With the 3scale module for Varnish basically we are adding the 3scale management and control layer to our API at the level of the proxy.

Once the 3scale varnish module is installed Varnish will check against 3scale for the validity of the API request. If positive, Varnish will serve the result from its cache or fetch the data from your origin server, finally Varnish will report to 3scale to maintain the consistent state and real-time analytics. Needless to say that the connection between your local Varnish proxy and 3scale’s backend can be done asynchronously so that latency is kept at a minimum, again thanks to Varnish’s caching abilities.

In follow up posts we will give a step by step guide on how to integrate your API with Varnish. Also, we will dig further on the powerful VCL (Varnish configuration language) and its third-party modules support. Besides making it extremely easy to integrate your API with external services like 3scale. Varnish can also be helpful in domain specific tasks like basic transformation and security.

Stay tuned.

3scale