{"id":3300,"date":"2022-02-22T12:28:02","date_gmt":"2022-02-22T06:58:02","guid":{"rendered":"https:\/\/www.cloudnowtech.com\/blog\/?p=3300"},"modified":"2022-02-22T12:28:02","modified_gmt":"2022-02-22T06:58:02","slug":"apis-avoid-the-sprawl","status":"publish","type":"post","link":"https:\/\/www.cloudnowtech.com\/blog\/apis-avoid-the-sprawl\/","title":{"rendered":"APIs, APIs, APIs… avoid the Sprawl!"},"content":{"rendered":"

Whether you are checking the weather on your phone or booking a ticket, watching your stock ticker, or speaking with a chatbot, chances are you\u2019re interacting with an API, or Application Programming Interface<\/a>. In fact, the total number of public and private APIs in use is almost a whopping <\/span>200 million<\/span><\/a>!<\/span><\/p>\n

This huge number of APIs and the physical spread of the distributed infrastructure locations has created a challenge known as an \u201cAPI sprawl\u201d.<\/span><\/p>\n

American technology company F5 recently released a <\/span>study<\/span><\/a> that looks at the challenges and opportunities that an API-driven economy presents. The authors say, \u201cIf data is the new oil, then APIs could, unfortunately, become the new plastic, with by-products wreaking havoc on the ecosystem. To stay healthy and thrive in the API-driven economy, it\u2019s time for organizations to get serious about creating, using, and managing APIs responsibly.\u201d<\/span><\/p>\n

Why does API sprawl exist?<\/span><\/h3>\n

API sprawl is as continuous as the application lifecycle process itself. There are many kinds of APIs, from public productized APIs (like Google Maps) to private or partner APIs (used by internal teams of companies).\u00a0<\/span><\/p>\n

APIs can be web-based, browser-based, or device-based as well as built to serve a single purpose or intended to aggregate multiple different data providers. Given the enormous number of APIs on the market, managing growth poses a challenge, especially if organizations do not follow best practices.<\/span><\/p>\n

Operational and security challenges\u00a0<\/span><\/h3>\n

Keeping track<\/b><\/p>\n

As the number of APIs grows, it becomes hard to keep track of where they are located. This can result in documentation issues, which impacts end-to-end connectivity. API documentation needs to be strong to effectively use, integrate, maintain, and update APIs, as well as to improve the experience for developers using the API, reduce time spent onboarding new users, and identify and resolve bugs faster.<\/span><\/p>\n

Versioning can be missed<\/b><\/p>\n

Since APIs are updated frequently, issues related to versioning \u2013 the practice of transparently managing changes to the API, so users know what to expect \u2013 may arise. If ignored by developers, APIs can become unsupported and hard to maintain. Sprawled APIs can thus lead to a reduction in service reliability.<\/span><\/p>\n

Potential security lapses<\/b><\/p>\n

APIs are also prone to fraud and malicious behavior, which is why external APIs must be validated for trust. A 2021 <\/span>report<\/span><\/a> issued by Salt Labs revealed a surge in API attacks over the past six months. Malicious traffic grew by 348%, underscoring the prevalence of cloud-native vulnerabilities. In fact, nearly half of all surveyed developers cite security concerns as a top worry as it delays application rollouts, tarnishes brand reputation, and may lead to revenue loss.<\/span><\/p>\n

Another <\/span>report<\/span><\/a>, which polled more than 300 IT decision-makers across the US, says that organizations struggle to detect, understand and control the APIs in their cloud-native apps, and that 40% of all organizations have no solution in production today for discovering and securing APIs. Over 70% of respondents said that security problems are exacerbated by the growing number of APIs and that cloud-native apps and Kubernetes deployments are particularly difficult to protect.<\/span><\/p>\n

How do you reduce the challenges posed by the API sprawl?<\/span><\/h3>\n

Existing app security solutions and strategies may not properly protect modern apps at the API level, as traditional point products were primarily created for app-to-web communication. Cloud-native environments on the other hand are defined by app-to-app and API-to-API communication.<\/span><\/p>\n