14/12/2022 Ludovic Pourrat Apidays Paris 2022 Adding a mock as a service capability to your API strategy portfolio

1 · Ludovic Pourrat API Architect & API Catalyst | Platform Architect Lombard Odier Group Auxiliary Ski Instructor Ecole Suisse de Ski Verbier

2023 SERIES OF EVENT New York May 16&17 Australia October 11&12 Singapore April 12&13 Helsinki & North June 5&6 Paris SEPTEMBER London November 15&16 June 28-30 SILICON VALLEY March 14&15 Dubai & Middle East February 22&23

2 · Ludovic Pourrat Lombard Odier Group Private Bank in Switzerland since 1796 Main businesses • Private Clients • Asset Management • Technology for Banking Technology • Financial Software Solution Developer • BPO activity «Bank as a service»

3 · Ludovic Pourrat Banking Platform 4 functional development streams • Market, Front, Tax & Operations, Finance Modular Service oriented solution • ≈ 800 application components GX - Large Modernization Initiative started in 2020 • Functional (e.g. SMF, Order Management) • Technical • OpenShift, GitOps, APIOps - Kong, Kafka, Vault, Consul, … • Angular micro-frontends • Migration Program - SpringBoot and Quarkus • Service Now, APM & OTEL, OIDC • Cloud - development environments

APIs / APIOps & API Mocking

5 · Ludovic Pourrat APIs Styles Most widely used specification format that fit a wide range of use cases. Open API Designed by Facebook to provide a data query and manipulation language. GraphQL Specification format for asynchronous communications like messaging and event sourcing Async API Designed by Google for low latency services and optimized data transfers GRPC

6 · Ludovic Pourrat API as a Product Governance Great API products Develop APIs with a product mindset API developer portal API products need a storefront to drive adoption API monitoring See how API products are used to improve our services

7 · Ludovic Pourrat About an API Developer Journey Browse our product driven API catalog and discover the range of provided services API Catalog API Sandbox Learn about how to create new APIs API Developer Documentation Start playing and consuming the services you need on the sandbox

8 · Ludovic Pourrat API Mocking Strategies This strategy is based on the API specification to drive the definition of the mock. STATIC This strategy is based on a complementary mock definition which relies on the mocking vendor. VIRTUALIZED This strategy is based on a runtime that implements a backend serving the API specification. BYOM 1 2 3 Easier to quick-start Best ROI Suited for high fidelity

9 · Ludovic Pourrat Our API Mocking Options API Strategy Vendor STATIC Accelerate API development with realistic mock servers, powered by OpenAPI documents. https://stoplight.io/open-source/prism STATIC Turn your API contract into live mocks in seconds. https://microcks.io STATIC Provide mock endpoints to test your APIs in development against your services. The Mocking plugin leverages standards based on the Open API Specification (OAS) for sending out mock responses to APIs. VIRTUALIZED Mockoon is the easiest and quickest way to design and run mock REST APIs. https://mockoon.com VIRTUALIZED Leverage Postman collections to enhance your mocking behavior. https://microcks.io VIRTUALIZED MockServer enables easy mocking of any system you integrate with via HTTP or HTTPS.

10 · Ludovic Pourrat Our API Mocking Options - continued API Strategy Vendor STATIC The Apollo Supergraph Platform. https://www.apollographql.com VIRTUALIZED Mock or extend your GraphQLAPI with faked data. No coding required. https://github.com/mschipperheyn/graphql-faker VIRTUALIZED Leverage Postman collections to enhance your mocking behavior. https://microcks.io STATIC Mock your APIs with MQTT, Kafka, WebSockets bindings. Add templating capabilities to your example definition. VIRTUALIZED Turn your API contract into live mocks in seconds. https://microcks.io

11 · Ludovic Pourrat APIOps Design Develop Secure Deploy Publish Monitor Analyze API design with tools, lint and design enforcements Continuous integration, lint and tests Security review against API policies Continuous deployment of the service Continuous deployment of the developer portal and the sandbox Capture telemetry information Review service level agreement and API usages Applied to both API specifications and API mock definitions Shorter design cycles More accurate mocks with production like SLAs Lighter testing dependencies

Our Sandbox as a Service Offering

13 · Ludovic Pourrat API Developer Portal (*) planned

14 · Ludovic Pourrat But ? You get a banana not found when trying out specifications …

15 · Ludovic Pourrat Kubernetes Native API Portal and Sandbox

16 · Ludovic Pourrat Kubernetes Native Provisioning In Action

Lessons Learned

18 · Ludovic Pourrat Lessons Learned  API server definition must be overridden at deployment on portal to automatically target your sandbox instances when staged.  API security definition might be changed depending on how your APIs are secured in production vs in your sandbox.  API specifications bundle become a must in your tooling capability to assembly API external references (external schemas, external markdown files for better and easier documentation).  GraphQL lacks for meta-data definition, so we encapsulated the GraphQL schema into an OpenAPI / AsyncAPI yaml like header definition.  We are then leveraging servers, info, security and extensions definitions.  The rise of AsyncAPI is coming but the tooling is quite limited.  AsyncAPI mocking is a niche at the moment and Microcks is handling that very well.  AsyncAPI external schemas in Avro requires to carry-on you specifications as multiple files.  Avro schemas dependency resolution is a challenge for your toolchain (when deploying them to the registry).

19 · Ludovic Pourrat Lessons Learned - continued  Automation and software as a service solutions for mocking are weak in the scope of the API vendors, especially in when dealing with the full scope of API styles.  Mocking is a strong enabler to speed up your specification cycles.  Most often specifications aren’t easy to understand where mocked examples can speak much more about your API design.  The API paths urbanization often differs from the developers point of view (base path being /), so the specifications must be amended at deployment to match how you are presenting your APIs.  Handling the API sandboxing capability can be expensive if it is managed as another deployment on top the of your application ones.  Automation, in the native Kubernetes way enabled us to streamline the API sandbox provisioning alongside the applications deployment.  To keep it efficient we have implement the vertical pod auto scaling feature to scope properly our resources, and we idled our mocked API deployments.  The centralized approach of Microcks provides built-in efficiency when dealing with hundreds of APIs.  Developers got their favorite mocking solutions and vendors so having a mocking catalog was well perceived.  It allowed us to experiment in advance with some aspects like the Kafka schema registry provisioning and some of the governance items of our API strategy.

20 · Ludovic Pourrat Q&A Wish you some [API]ness at Apidays ! Better skiers have more fun.

No content