An overview of current Web API's world, with standards, styles, best practices and monetization paradigms Kings of Code conference, 19 Sept 2011, Amsterdam

1. Web API's World
Michele Zonca

2. Application Programming Interface
A set of rules and specifications
followed by software programs to
communicate
Kings Of Code, Sept 19, 2011 Amsterdam

3. Which kind of Software?
● Applications
● Libraries
● Programming Languages
● Operating Systems
Every!
Kings Of Code, Sept 19, 2011 Amsterdam

4. Communication?
● Send/receive low-level signals
● Ask access to resources
● Define object and classes
● Query remote data
● Integrate functionalities
Kings Of Code, Sept 19, 2011 Amsterdam

5. Let's talk about Web!
● A W3C working group to create Web Services
● Backed by big companies
● Early 2000
● A complete standard
● How to discover (UDDI)
● How to describe (WSDL)
● How to serialize data (SOAP)
Kings Of Code, Sept 19, 2011 Amsterdam

6. Too complex!!
Let's try something
different..
Kings Of Code, Sept 19, 2011 Amsterdam

7. Welcome to the Jungle
Kings Of Code, Sept 19, 2011 Amsterdam

8. Representational State Transfer
● Term created by Roy Fielding in his Doctoral
Dissertation, 2000
● Deep use of HTTP
● HTTP Verbs
● Status codes
● URLs
● Not a standard but a style, a set of constraints
Kings Of Code, Sept 19, 2011 Amsterdam

9. REST Constraints
● Client-Server (not only HTTP)
● Uniform interface
● Stateless
● Cacheable
● Layered System
Kings Of Code, Sept 19, 2011 Amsterdam

10. Resource Oriented Architecture
● Collection of resources
/resources
● Resource
/resources/id
Kings Of Code, Sept 19, 2011 Amsterdam

11. Methods - Actions
POST CREATE
GET READ
PUT UPDATE
DELETE DELETE
(Are you using PUTs?)
Kings Of Code, Sept 19, 2011 Amsterdam

12. Adoption
image from programmableweb
Kings Of Code, Sept 19, 2011 Amsterdam

13. Representational State Transfer
Order in the Jungle?
Kings Of Code, Sept 19, 2011 Amsterdam

14. NO!
● Bad/Partial implementations
● Lack of constraints
● Interpretation
● BTW, is not so simple
Kings Of Code, Sept 19, 2011 Amsterdam

15. Format
http://website.com/resources/id.xml
http://website.com/resources/id.json
BAD! Isn't it the same resource?
Kings Of Code, Sept 19, 2011 Amsterdam

16. Use the 'Accept' header, Luke!
● Used to specify
acceptable media
types for the response
● RFC 2616, HTTP 1.1
● It's hard to test in a
browser
Kings Of Code, Sept 19, 2011 Amsterdam

17. Format
● Twitter: extension (.json, .xml)
● Github: JSON
● Facebook Graph API: JSON
● Twilio: default XML, (extension .json, .csv, .html)
● Foursquare: JSON
● Stack Overflow: JSON
Kings Of Code, Sept 19, 2011 Amsterdam

18. Searching
● Global
/search?q=search+parameters
● Scoped
/resources/search?q=search+parameters
Kings Of Code, Sept 19, 2011 Amsterdam

19. Searching
● Twitter
● global = tweets → /search?q=
● scoped for users search → /users/search?q=
● Facebook Graph API
● global → /search?q=
● scoped via “type” parameter → /search?
q=..&type=user
● Linkedin: by fields → ?keywords=..&last-name..
Kings Of Code, Sept 19, 2011 Amsterdam

20. Results Pagination
● Linkedin: start + count
● Github: page + per_page
● Twilio: Page + PageSize
● Twitter: page + rpp
● Facebook: offset + limit
● StackOverflow: page + pagesize
Kings Of Code, Sept 19, 2011 Amsterdam

21. Versioning
URL ACCEPT Header
/v1/resources/id Best solution for custom
isn't the same formats:
resource available at
/v2/resources/id ? Accept:
application/vnd.mycomp
any.myapp-v2+xml
Kings Of Code, Sept 19, 2011 Amsterdam

22. Errors
● SOAP: HTTP code 200 and error message in
envelop's body (FAULT element)
● REST: HTTP codes + message
Warning:
HTTP Codes could be intercepted and handled by your client
Kings Of Code, Sept 19, 2011 Amsterdam

23. Authentication
Stateless: auth per call, not session-based
● ApiKey over HTTPS
● BasicHTTP Authentication
● ApiKey to get token
● OAuth (buzzword but not always the right
solution)
Kings Of Code, Sept 19, 2011 Amsterdam

24. Authentication
● Github: OAuth 2 / Basic HTTP / Basic HTTP with
token
● Twitter: OAuth 1.0a
● Facebook Graph API: OAuth 2
● SimpleGeo: OAuth / JSONP Tokens
Kings Of Code, Sept 19, 2011 Amsterdam

25. So, what should I use?
SCENARIO
SCENARIO
SCENARIO
Kings Of Code, Sept 19, 2011 Amsterdam

26. So you have your API..
Now??
Kings Of Code, Sept 19, 2011 Amsterdam

27. Money
● It's hard to monetize
API
● API = Product? A
growing market!
● API as viral strategy
● Is there a “one size
fits all” monetization
paradigm?
Kings Of Code, Sept 19, 2011 Amsterdam

28. Monetization
Kings Of Code, Sept 19, 2011 Amsterdam

29. Today
● At Mashape, we believe this is today's best paradigm
Kings Of Code, Sept 19, 2011 Amsterdam

30. Tomorrow?
We strongly believe “revenue sharing” model will be
huge
● It's a win-win
● API's distribution problem solved?
● CEO of Indeed.com:
“We tried charging for our API without much success.
Then we paid developers to use it and it took off.”
Kings Of Code, Sept 19, 2011 Amsterdam

31. Questions ?
Thanks for coming!
e: mike@mashape.com
t: @shatsar
Kings Of Code, Sept 19, 2011 Amsterdam