SlideShare una empresa de Scribd logo
1 de 11
Descargar para leer sin conexión
Careful - APIs Inside
Testing and Monitoring for API Driven Apps
Steven Willmott
3scale Inc.
@njyx, @3scale
Behind (Almost) Every App
is a Great API
3scale is…
API
Infrastructure
Provider
!

Power 350+
APIs
!

110,000
Developers
writing Apps

(Selection)

!
API Tech Operations

API Business
Operations

Developer Support

3scale.net
Apps Depend on API Backends
Your App

Direct

Indirect

Proxy

Your Backend
Creates Problems
Development
Time

Run Time

OAuth

Bad Docs
Weird HTTP
Errors

Rate Limit
Problems

High Latency
Version
Changes

APIs Can Waste Time

Old Versions

Random
Failures

Poor SDKs

Rate
Limit Failures

APIs Can Kill Your App
Development Time Tools
HTTP Problems
•

•

•
•

!

HTTP is Easy until it’s not (Caching,
Verbs, Headers, Hashes, Media
Types)
Use HTTP Sniffers (HTTPScoop,
Fiddler) + network sniffers (e.g.
Wireshark)
Check & use caching headers
CORS, Cross Site Problems

HTTPScoop

Auth Problems
oAuth Libraries & Documentation
• beware oAuth “variants”
• Try:
• oAuthbible.com
• oauth.io
• Other Authentication:
• Try to use provided SDKs
• Unit Test heavily for custom
integrations
•

http://www.slideshare.net/synedra/demystifying-restruby
Development Time Tools
Provider Problems
•

•
•
•
•

!

Bad Documentation: look for
interactive docs (swagger active
docs, iodocs, apiary)
Unspecified Rate Limits (when do
they kick in?)
Old Versions
Different Production and Test
Environments
Unit test mocks

Pro Tip
How to ask An API Provider a
!
question
!
!

“I was doing the following with
you API, I was expecting this
… to happen, to my dismay,
this other thing happened
instead …”(*)

(* - credit Kirsten Hunter)
Active Docs

http://developer.flightstats.com (via 3scale)
Operations Time Tools
The Old
•
•
•
•

Pingdom et. al. Provide standard
HTTP alerts,
Webmetrics: step by step test
execution primarily for SOAP APIs
Nagios, Monit, Munin, SENSU etc. in
your own infrastructure
Splunk et. al. for log analysis.
!

The New

!

How to ask An API Provider a
!
question
!

•
•
•

Runscope
Smartbear
3scale APITools

!
•

!

New tools: proxy transform, step by
step unit testing, authentication
tests, API specific analytics

!
!
!

http://www.soapui.org/Dojo/overview.html
Where is the Fun & Profit?
API Testing is getting easier
APIs are more stable over time
Mocks & Proxies Help a Lot
Happy Users are More Fun
& Generate More Profit!
Thank You
Contact:

http://www.3scale.net
@njyx - steve@3scale.net

Más contenido relacionado

La actualidad más candente

Speed upyourtest with_appium
Speed upyourtest with_appiumSpeed upyourtest with_appium
Speed upyourtest with_appium
VodqaBLR
 
An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...
An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...
An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...
Abhay Bhargav
 

La actualidad más candente (20)

DAST in CI/CD pipelines using Selenium & OWASP ZAP
DAST in CI/CD pipelines using Selenium & OWASP ZAPDAST in CI/CD pipelines using Selenium & OWASP ZAP
DAST in CI/CD pipelines using Selenium & OWASP ZAP
 
Intro to DefectDojo at OWASP Switzerland
Intro to DefectDojo at OWASP SwitzerlandIntro to DefectDojo at OWASP Switzerland
Intro to DefectDojo at OWASP Switzerland
 
Web and App Performance: Top Problems to avoid to keep you out of the News
Web and App Performance: Top Problems to avoid to keep you out of the NewsWeb and App Performance: Top Problems to avoid to keep you out of the News
Web and App Performance: Top Problems to avoid to keep you out of the News
 
OWASP DefectDojo - Open Source Security Sanity
OWASP DefectDojo - Open Source Security SanityOWASP DefectDojo - Open Source Security Sanity
OWASP DefectDojo - Open Source Security Sanity
 
Security as Code: DOES15
Security as Code: DOES15Security as Code: DOES15
Security as Code: DOES15
 
Optimize your delivery and quality with the right release methodology and too...
Optimize your delivery and quality with the right release methodology and too...Optimize your delivery and quality with the right release methodology and too...
Optimize your delivery and quality with the right release methodology and too...
 
Speed upyourtest with_appium
Speed upyourtest with_appiumSpeed upyourtest with_appium
Speed upyourtest with_appium
 
The Rounds Project: Growing from thousands to millions - Berry Ventura & Yoah...
The Rounds Project: Growing from thousands to millions - Berry Ventura & Yoah...The Rounds Project: Growing from thousands to millions - Berry Ventura & Yoah...
The Rounds Project: Growing from thousands to millions - Berry Ventura & Yoah...
 
Architecture of automated test cases for legacy applications
Architecture of automated test cases for legacy applicationsArchitecture of automated test cases for legacy applications
Architecture of automated test cases for legacy applications
 
OWASP WTE - Now in the Cloud!
OWASP WTE - Now in the Cloud!OWASP WTE - Now in the Cloud!
OWASP WTE - Now in the Cloud!
 
An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...
An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...
An Attacker's View of Serverless and GraphQL Apps - Abhay Bhargav - AppSec Ca...
 
Making security-agile matt-tesauro
Making security-agile matt-tesauroMaking security-agile matt-tesauro
Making security-agile matt-tesauro
 
JavaOne 2015: Top Performance Patterns Deep Dive
JavaOne 2015: Top Performance Patterns Deep DiveJavaOne 2015: Top Performance Patterns Deep Dive
JavaOne 2015: Top Performance Patterns Deep Dive
 
SauceCon 2017: Testing @ the Speed of Concurrency
SauceCon 2017: Testing @ the Speed of ConcurrencySauceCon 2017: Testing @ the Speed of Concurrency
SauceCon 2017: Testing @ the Speed of Concurrency
 
SeleniumCamp 2015 Andrii Soldatenko
SeleniumCamp 2015 Andrii SoldatenkoSeleniumCamp 2015 Andrii Soldatenko
SeleniumCamp 2015 Andrii Soldatenko
 
Spring insight what just happened
Spring insight   what just happenedSpring insight   what just happened
Spring insight what just happened
 
Monitoring at Facebook - Ran Leibman, Facebook - DevOpsDays Tel Aviv 2015
Monitoring at Facebook - Ran Leibman, Facebook - DevOpsDays Tel Aviv 2015Monitoring at Facebook - Ran Leibman, Facebook - DevOpsDays Tel Aviv 2015
Monitoring at Facebook - Ran Leibman, Facebook - DevOpsDays Tel Aviv 2015
 
Using Machine Learning on K8s Logs to Find Root Cause Faster
Using Machine Learning on K8s Logs to Find Root Cause FasterUsing Machine Learning on K8s Logs to Find Root Cause Faster
Using Machine Learning on K8s Logs to Find Root Cause Faster
 
Let's Jira do the work
Let's Jira do the workLet's Jira do the work
Let's Jira do the work
 
Metrics Driven DevOps - Automate Scalability and Performance Into your Pipeline
Metrics Driven DevOps - Automate Scalability and Performance Into your PipelineMetrics Driven DevOps - Automate Scalability and Performance Into your Pipeline
Metrics Driven DevOps - Automate Scalability and Performance Into your Pipeline
 

Similar a Careful - APIs Inside: Testing and Monitoring for App Development

Similar a Careful - APIs Inside: Testing and Monitoring for App Development (20)

Scaling with swagger
Scaling with swaggerScaling with swagger
Scaling with swagger
 
Building A Great API - Evan Cooke, Cloudstock, December 2010
Building A Great API - Evan Cooke, Cloudstock, December 2010Building A Great API - Evan Cooke, Cloudstock, December 2010
Building A Great API - Evan Cooke, Cloudstock, December 2010
 
API workshop: Introduction to APIs (TC Camp)
API workshop: Introduction to APIs (TC Camp)API workshop: Introduction to APIs (TC Camp)
API workshop: Introduction to APIs (TC Camp)
 
Api FUNdamentals #MHA2017
Api FUNdamentals #MHA2017Api FUNdamentals #MHA2017
Api FUNdamentals #MHA2017
 
Api crash
Api crashApi crash
Api crash
 
Api crash
Api crashApi crash
Api crash
 
Api crash
Api crashApi crash
Api crash
 
Api crash
Api crashApi crash
Api crash
 
Api crash
Api crashApi crash
Api crash
 
Api crash
Api crashApi crash
Api crash
 
Api crash
Api crashApi crash
Api crash
 
Создание API, которое полюбят разработчики. Глубокое погружение
Создание API, которое полюбят разработчики. Глубокое погружениеСоздание API, которое полюбят разработчики. Глубокое погружение
Создание API, которое полюбят разработчики. Глубокое погружение
 
Protecting Your APIs Against Attack & Hijack
Protecting Your APIs Against Attack & Hijack Protecting Your APIs Against Attack & Hijack
Protecting Your APIs Against Attack & Hijack
 
Api fundamentals
Api fundamentalsApi fundamentals
Api fundamentals
 
Prometheus lightning talk (Devops Dublin March 2015)
Prometheus lightning talk (Devops Dublin March 2015)Prometheus lightning talk (Devops Dublin March 2015)
Prometheus lightning talk (Devops Dublin March 2015)
 
An introduction to the API for OnTime for IBM
An introduction to the API for OnTime for IBMAn introduction to the API for OnTime for IBM
An introduction to the API for OnTime for IBM
 
Owin from spec to application
Owin from spec to applicationOwin from spec to application
Owin from spec to application
 
VA Smalltalk Update
VA Smalltalk UpdateVA Smalltalk Update
VA Smalltalk Update
 
Building a Great Web API - Evan Cooke - QCON 2011
Building a Great Web API - Evan Cooke - QCON 2011Building a Great Web API - Evan Cooke - QCON 2011
Building a Great Web API - Evan Cooke - QCON 2011
 
Building a scalable API with Grails
Building a scalable API with GrailsBuilding a scalable API with Grails
Building a scalable API with Grails
 

Más de 3scale

Más de 3scale (20)

APISTRAT KEYNOTE: Surfing the Wave between Chaos and Innovation
APISTRAT KEYNOTE:  Surfing the Wave between Chaos and InnovationAPISTRAT KEYNOTE:  Surfing the Wave between Chaos and Innovation
APISTRAT KEYNOTE: Surfing the Wave between Chaos and Innovation
 
A Connector, A Container and an API Walk into a Bar… Microservices Edition
A Connector, A Container and an API Walk into a Bar… Microservices EditionA Connector, A Container and an API Walk into a Bar… Microservices Edition
A Connector, A Container and an API Walk into a Bar… Microservices Edition
 
A Connector, A Container and an API Walk Into a Bar: The Programmable World
A Connector, A Container and an API Walk Into a Bar: The Programmable World A Connector, A Container and an API Walk Into a Bar: The Programmable World
A Connector, A Container and an API Walk Into a Bar: The Programmable World
 
How to Survive the API Copyright Apocalypse
How to Survive the API Copyright ApocalypseHow to Survive the API Copyright Apocalypse
How to Survive the API Copyright Apocalypse
 
Inside mind of a successful platform architect / Gartner APPS 2016
Inside mind of a successful platform architect / Gartner APPS 2016 Inside mind of a successful platform architect / Gartner APPS 2016
Inside mind of a successful platform architect / Gartner APPS 2016
 
The Fundamentals of Platform Strategy: Creating Genuine Value with APIs
The Fundamentals of Platform Strategy: Creating Genuine Value with APIsThe Fundamentals of Platform Strategy: Creating Genuine Value with APIs
The Fundamentals of Platform Strategy: Creating Genuine Value with APIs
 
Build and Manage Serverless APIs (APIDays Nordic, May 19th 2016)
Build and Manage Serverless APIs (APIDays Nordic, May 19th 2016)Build and Manage Serverless APIs (APIDays Nordic, May 19th 2016)
Build and Manage Serverless APIs (APIDays Nordic, May 19th 2016)
 
APIs and the Bot Revolution (APIDays Nordic, May 18)
APIs and the Bot Revolution (APIDays Nordic, May 18)APIs and the Bot Revolution (APIDays Nordic, May 18)
APIs and the Bot Revolution (APIDays Nordic, May 18)
 
Take Control of your APIs in a Microservice Architecture
Take Control of your APIs in a Microservice ArchitectureTake Control of your APIs in a Microservice Architecture
Take Control of your APIs in a Microservice Architecture
 
API workshop by AWS and 3scale
API workshop by AWS and 3scaleAPI workshop by AWS and 3scale
API workshop by AWS and 3scale
 
The Swagger Format becomes the Open API Specification: Standardizing descript...
The Swagger Format becomes the Open API Specification: Standardizing descript...The Swagger Format becomes the Open API Specification: Standardizing descript...
The Swagger Format becomes the Open API Specification: Standardizing descript...
 
Entering the Platform Age: How to create genuine value for internal and exter...
Entering the Platform Age: How to create genuine value for internal and exter...Entering the Platform Age: How to create genuine value for internal and exter...
Entering the Platform Age: How to create genuine value for internal and exter...
 
APIs and the Creation of Wealth in the Digital Economy - APIDays Paris 2015 K...
APIs and the Creation of Wealth in the Digital Economy - APIDays Paris 2015 K...APIs and the Creation of Wealth in the Digital Economy - APIDays Paris 2015 K...
APIs and the Creation of Wealth in the Digital Economy - APIDays Paris 2015 K...
 
API Model Canvas for successful API strategies and programs
API Model Canvas for successful API strategies and programsAPI Model Canvas for successful API strategies and programs
API Model Canvas for successful API strategies and programs
 
Microservices in action: How to actually build them
Microservices in action: How to actually build themMicroservices in action: How to actually build them
Microservices in action: How to actually build them
 
The API-Application Semantic Gap
The API-Application Semantic GapThe API-Application Semantic Gap
The API-Application Semantic Gap
 
Integrating, exposing and managing distributed data with RESTful APIs and op...
Integrating, exposing and managing distributed data with RESTful APIs and op...Integrating, exposing and managing distributed data with RESTful APIs and op...
Integrating, exposing and managing distributed data with RESTful APIs and op...
 
Building Successful API Programs in Higher Education
Building Successful API Programs in Higher EducationBuilding Successful API Programs in Higher Education
Building Successful API Programs in Higher Education
 
APIs.JSON: Bootstrapping The Web of APIs
APIs.JSON: Bootstrapping The Web of APIsAPIs.JSON: Bootstrapping The Web of APIs
APIs.JSON: Bootstrapping The Web of APIs
 
API Model Canvas (APIDays Mediterranea 2015)
API Model Canvas (APIDays Mediterranea 2015)API Model Canvas (APIDays Mediterranea 2015)
API Model Canvas (APIDays Mediterranea 2015)
 

Último

Último (20)

2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 

Careful - APIs Inside: Testing and Monitoring for App Development

  • 1. Careful - APIs Inside Testing and Monitoring for API Driven Apps Steven Willmott 3scale Inc. @njyx, @3scale
  • 2. Behind (Almost) Every App is a Great API
  • 3. 3scale is… API Infrastructure Provider ! Power 350+ APIs ! 110,000 Developers writing Apps (Selection) ! API Tech Operations API Business Operations Developer Support 3scale.net
  • 4. Apps Depend on API Backends Your App Direct Indirect Proxy Your Backend
  • 5. Creates Problems Development Time Run Time OAuth Bad Docs Weird HTTP Errors Rate Limit Problems High Latency Version Changes APIs Can Waste Time Old Versions Random Failures Poor SDKs Rate Limit Failures APIs Can Kill Your App
  • 6. Development Time Tools HTTP Problems • • • • ! HTTP is Easy until it’s not (Caching, Verbs, Headers, Hashes, Media Types) Use HTTP Sniffers (HTTPScoop, Fiddler) + network sniffers (e.g. Wireshark) Check & use caching headers CORS, Cross Site Problems HTTPScoop Auth Problems oAuth Libraries & Documentation • beware oAuth “variants” • Try: • oAuthbible.com • oauth.io • Other Authentication: • Try to use provided SDKs • Unit Test heavily for custom integrations • http://www.slideshare.net/synedra/demystifying-restruby
  • 7. Development Time Tools Provider Problems • • • • • ! Bad Documentation: look for interactive docs (swagger active docs, iodocs, apiary) Unspecified Rate Limits (when do they kick in?) Old Versions Different Production and Test Environments Unit test mocks Pro Tip How to ask An API Provider a ! question ! ! “I was doing the following with you API, I was expecting this … to happen, to my dismay, this other thing happened instead …”(*) (* - credit Kirsten Hunter)
  • 9. Operations Time Tools The Old • • • • Pingdom et. al. Provide standard HTTP alerts, Webmetrics: step by step test execution primarily for SOAP APIs Nagios, Monit, Munin, SENSU etc. in your own infrastructure Splunk et. al. for log analysis. ! The New ! How to ask An API Provider a ! question ! • • • Runscope Smartbear 3scale APITools ! • ! New tools: proxy transform, step by step unit testing, authentication tests, API specific analytics ! ! ! http://www.soapui.org/Dojo/overview.html
  • 10. Where is the Fun & Profit? API Testing is getting easier APIs are more stable over time Mocks & Proxies Help a Lot Happy Users are More Fun & Generate More Profit!