SmartBear announced today it plans to acquire Stoplight, a provider of tools for editing and governing application programming interfaces (APIs).
Sean Butler, vice president of product management for SmartBear, said the deal, once finalized, will add a set of complementary tools and open source software that extends the core API catalog platform that SmartBear provides to manage APIs. The open source software provided by Stoplight includes Prism, an HTTP mock server that emulates API behavior; Spectral, an API style guide enforcer and linter; and Elements, an API Documentation tool.
The governance capabilities are especially critical as organizations begin to deploy hundreds, even thousands, of APIs that are used to integrate the microservices that are at the core of modern cloud-native applications, noted Butler.
As those applications are deployed, the management of APIs is naturally becoming more challenging. Organizations, for example, might have a different set of rules for APIs that are externally facing than they do for internal APIs. However, it’s not uncommon for internal APIs to be made externally facing without updating them when a new use case is discovered.
SmartBear is advocating a “design first” approach to the building of APIs that ultimately serves to make them simpler to manage, said Butler. In fact, good governance provides the foundation upon which API security can be achieved and maintained at a time when the number of cyberattacks seeking to exfiltrate data via API endpoints is starting to increase, noted Butler.
Unfortunately, too many developers are still prone to building and deploying rogue APIs, many of which turn into zombie APIs that developers forget to remove long after the function they were designed to enable is no longer required.
It’s not clear how many organizations are adopting a design-first approach to building APIs before they write application code, but as more APIs are deployed, the way IT is managed is rapidly changing. Application services are essentially becoming more disposable, so long as the APIs used to expose them to other applications remain stable. In fact, it’s now only a matter of time before most organizations fully appreciate the degree to which their entire IT strategy now revolves around their APIs.
The challenge is that it’s not always clear who within an IT organization is responsible for API management. Although an API is created by a developer, that developer eventually moves on to other projects. Therefore, responsibility for managing and updating APIs often winds up shifting to DevOps teams that were not part of the API development process.
One way or another, the management of APIs will need to improve once legislation that holds organizations more accountable for how data is managed becomes law. The issue that many organizations will soon discover as they move to address those requirements is: A general lack of visibility into both the number of APIs they have and, just as importantly, how they are being employed.
Hopefully, advances in artificial intelligence (AI) will one day soon make it simpler to manage APIs. In the meantime, however, a modicum of governance applied today should go a long way to preventing a problem that otherwise is all but inevitable.
