What is an API?

APIs represent real back-end APIs (Application Programming Interfaces). An API is also known as a service, which offers a HTTP, REST or SOAP interface that can be invoked remotely by a client.

An API consists of a set of meta data including name and description as well as an external endpoint defining the API implementation. The external API implementation endpoint includes:

• The type/protocol of the endpoint (REST or SOAP).

• The endpoint content type (XML or JSON).

• The endpoint location (URL) so that the API can be properly proxied to at runtime.

Scheer PAS API Management provides a way to turn unmanaged (raw) back-end APIs into managed APIs by attaching policies to them. Any policies configured on an API will be applied at runtime, regardless of the client and API contract. Therefore authentication is a common policy configured at the API level.

An API has to be fully configured, including policies, implementation and plans to be published. If the API has been published to the gateway it can be consumed by clients.

API Contracts and API Keys

Only public APIs can be accessed by any consumer. The only way for a client to consume a private API is by using an API contract. An API contract is a link between a client and an API through a plan offered by that API.

API contracts can only be created between clients and published APIs which are offered through at least one plan. An API contract cannot be created between a client and a public API.

When an API contract is created, the system generates a unique API Key. This key is unique per client and the same for all contracts of this client. All requests made to the API by a client through the gateway must include this API Key. The API Key is used to create the runtime policy chain from the policies configured on the API, plan and client.