Tackling OpenAPI Drift

Tackling OpenAPI Drift Lessons from the ‘AcmeFS’ Experience Ikenna Nwaiwu
@ Ikenna Consulting Apidays Paris 2024

Questions and feedback: Slido #2191713 API Drift Survey: Slido #3437921
About Me 2

Author & Independent Consultant 3

API Governance problems I help my clients solve: •API sprawl •API drift •High API delivery lead time 4 Advisory to API providers and API tool vendors.

Agenda •Is API Drift a Problem? •The AcmeFS API Drift Problem •Countermeasures considered •AcmeFS’ implementation plan •The Result •Lessons learnt •Summary 5

Is API Drift a problem? 6

Survey question: Our published API documentation matches our API behaviour 30% 66% 4% Strongly disagree / Disagree / Neither Agree nor disagree Agree / Strongly Agree Not applicable 7 Results from Berlin API conferences in Belgium and Berlin.

75% Non-Conformant endpoints Source: OpenAPI Specifications in the Real World, August 2024. 8 Credit: Ralfs Blumbergs

25% Absolutely no endpoints in the API conform to docs Source: OpenAPI Specifications in the Real World, August 2024. 9 Credit: Borna Bevanda

100% 100% 89% 86% 67% 20% 0% 0% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% UK Legacy Banks Stripe GitHub Twilio Intercom Zoom Box Pivotal Tracker Selected API Endpoint Conformance Rate Source: OpenAPI Specifications in the Real World, August 2024. 10

So, if many popular APIs suffer API drift, is it really an issue? 11

The AcmeFS Drift Problem Story: 12

BigBank1 is a strong prospect. 13 Proof of Concept (PoC) stage.

AcmeFS Platform OpenAPI validation in BigBank1 API gateway BigBank1 services BigBank1 14

API Drift Detected! •Missing response schema fields and objects •Incorrect HTTP response codes •Incorrect data format in response schema •Incorrect data format in request schema 15

No Deal 16

What should AcmeFS do? Another prospect, BigBank2. PoC in two weeks. 30% of endpoints in the customer workflow had API drift. 17

Countermeasures Considered 18

#1: Generate OpenAPI descriptions from code. springdoc-openapi https://springdoc.org / 19

#2: Generate Spring Boot code from OpenAPI ? Possible Long-Term Solution Short-term solution? OpenAPI Generator 20

#3: Generate OpenAPI descriptions and code from Language-oriented API dev tools? TypeSpec 21

#4: Use consumer-driven contract (CDC) testing? Spring Cloud Contract 22

#5: Use bi-directional contract (BDC) testing? Pactflow 23

#6: Use provider-driven contract (PDC) testing with code-based schema tests? Rest Assured Atlassian swagger-request-validator https://bitbucket.org/atlassian/swagger-request-validator Possible Long-Term Solution 24 https://github.com/karatelabs/karate Short-term solution?

#7: Use provider-driven contract (PDC) testing with generated schema tests? Schemathesis Possible Long-Term Solution 25 Short-term solution?

#8: OpenAPI validation in API Gateway + OpenAPI Validation Policy / Plugin 26

#9: Use provider-driven contract (PDC) testing with a validating proxy? 27 https://github.com/pb33f/wiretap https://github.com/stoplightio/prism

Implementation Plan 28

AcmeFS Platform Processed OpenAPI file Existing User workflow Postman Collection 29

Join (combine) multiple OpenAPI files into one Inject additionalProperties=false Filter unused components Filter legacy endpoints 30

The Result 31

70% 100% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Before API Drift Fix After API Drift Fix API Conformance 32

BigBank2 PoC Successful. Deal signed. 33

Lessons Learnt 34

Use the Product and Client Solution (Dev Roles) roles to write user journey collections, which can be used in automated contract tests! 35 # 1

github.com/usebruno/bruno 36

When fixing API drift, consider starting from the most common user workflows 37 # 2

Pipeline to transform OpenAPI was crucial. Join (combine) multiple OpenAPI files into one Filter unused components Filter legacy endpoints Inject additionalProperties=false 38 # 3

Summary 39

• Many APIs suffer API drift • For some APIs, drift is a deal breaker • Request Collections + PDC + Transformed OpenAPI 40

Q&A 41 Rate this talk Slido: 2191713 The End

Tackling OpenAPI Drift

Tackling OpenAPI Drift

More Decks by Ikenna Nwaiwu

Featured

Transcript