API management
On this page 9 topics
Overview
Topics
- Gateways
- developer portals
- governance
- quotas
Learn first
3 h of practice (estimate)
Learning outcomes
- Decide what an API management layer provides (gateway, developer portal, keys, quotas, analytics) and whether a solution needs one.
- Design API governance: style guide, review, versioning, and lifecycle.
- Set quotas and access tiers for internal, partner, and public consumers.
- Treat APIs as products with owners and consumers.
Lessons
Lab and exercises
Lab
ARC-025-LAB1 · Partner API program
Outcomes: 1–4 · Time: ~3 h
- List the consumers (mobile app, marketplace partners, internal systems) and what each needs.
- Define three APIs as products with owner, SLA, and support.
- Decide which API management capabilities Larkspur needs now and later.
- Design consumer tiers, quotas, and key handling.
- Design onboarding through the developer portal and the versioning and deprecation policy.
- Review with a role-played partner manager and security lead.
Acceptance: reviewed by a role-played partner manager and security lead.
Exercises (case-based; five exercises)
| ID | Outcome | Task |
|---|---|---|
| ARC-025-EX01 | 1 | Decide whether a solution with one internal consumer needs an API management platform; write the reasons. |
| ARC-025-EX02 | 2 | Write six rules for a style guide and a five-step review flow. |
| ARC-025-EX03 | 3 | Create a tier table for internal, partner, and public consumers with quotas and data scope. |
| ARC-025-EX04 | 4 | Write the product card for the Stock availability API. |
| ARC-025-EX05 | 2, 3 | A partner's integration breaks after you remove a field. Write the incident summary and the policy that would have prevented it. |
Show solutions
- EX01 Probably no: few consumers, trusted network, low risk; use a simple gateway for authentication and logging and revisit when partners arrive.
- EX02 Consistent naming, standard error format, pagination, auth defaults, idempotency for writes, versioning; flow: design, lint, peer review, security check, publish.
- EX03 Internal: service identity, high limits; partner: contracted quota, key and OAuth client, selected fields; public: low limit, read-only, no personal data.
- EX04 Owner team, consumers, SLA and availability, rate limits, support channel, version, deprecation notice period.
- EX05 Removal is a breaking change; policy: additive changes only within a version, notice period, deprecation headers, consumer notification via portal, contract tests with major consumers.
All outcomes are also covered by the lab review.
Workplace evidence: an API program or governance process you designed or improved.
Quiz
Outcomes: O1 what API management provides · O2 governance and lifecycle · O3 quotas and tiers · O4 APIs as products.
A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.
Practical part
API program review: a role-played partner manager and security lead question tiers, quotas, onboarding, and deprecation. Pass: quiz at least 8/10, all five exercises correct, and a program with separate tiers and a written deprecation path.
Common mistakes
A gateway without governance; one quota for all consumers; no deprecation path.
Assessment
API program review.
Workplace evidence
An API program or governance process you designed or improved.
Career relevance
API management choices recur in almost every integration-heavy solution.