API Gateways

🧠 Free Recall ❓ Quiz 🔍 Cues 🔮 Simulation 🥷 ShadowBox 📐 Encode Cards

An API gateway is an API management tool that sits between a client and a collection of backend services.
An API gateway acts as a reverse proxy to accept all application programming interface (API) calls, aggregate the various services required to fulfill them, and return the appropriate result.
Most enterprise APIs are deployed via API gateways. It’s common for API gateways to handle common tasks that are used across a system of API services, such as user authentication, rate limiting, and statistics.
Check out this on-demand API management and security demo
Why use an API gateway?
At its most basic, an API service accepts a remote request and returns a response. But real life is never that simple. Consider your various concerns when you host large-scale APIs.
You want to protect your APIs from overuse and abuse, so you use an authentication service and rate limiting. 
You want to understand how people use your APIs, so you’ve added analytics and monitoring tools.
If you have monetized APIs, you’ll want to connect to a billing system.
You may have adopted a microservices architecture, in which case a single request could require calls to dozens of distinct applications.
Over time you’ll add some new API services and retire others, but your clients will still want to find all your services in the same place.
Your challenge is offering your clients a simple and dependable experience in the face of all this complexity. An API gateway is a way to decouple the client interface from your backend implementation. When a client makes a request, the API gateway breaks it into multiple requests, routes them to the right places, produces a response, and keeps track of everything.
An API gateway’s role in API management
An API gateway is one part of an API management system. The API gateway intercepts all incoming requests and sends them through the API management system, which handles a variety of necessary functions.
Exactly what the API gateway does will vary from one implementation to another. Some common functions include authentication, routing, rate limiting, billing, monitoring, analytics, policies, alerts, and security.
How an API gateway supports DevOps and serverless environments
In organizations that follow a DevOps approach, developers use microservices to build and deploy apps in a fast-paced, iterative way. APIs are one of the most common ways that microservices communicate.
Additionally, modern cloud development, including the serverless model, depends on APIs for provisioning infrastructure. You can deploy serverless functions and manage them using an API gateway.
In general, as integration and interconnectivity become more important, so do APIs. And as API complexity increases and usage grows, so does the value of an API gateway.

https://www.redhat.com/en/topics/api/what-does-an-api-gateway-do#:~:text=An%20API%20gateway%20is%20an,and%20return%20the%20appropriate%20result.

Building Microservices Using an API Gateway
For most microservices‑based applications, it makes sense to implement an API gateway, because it acts as a single entry point into the system. The API gateway is responsible for request routing, composition, and protocol translation, and can streamline the system. With an API gateway, each of the application’s clients gets a custom API. The API gateway handles some requests by simply routing them to the appropriate backend service, and handles others by invoking multiple backend services and aggregating the results. If there are failures in the backend services, the API gateway can mask them by returning cached or default data.

The Role of API Gateways in Microservice Architectures
An API gateway is the conductor that organizes the requests being processed by the microservices architecture to create a simplified experience for the user. It’s a translator, taking a client’s many requests and turning them into just one, to reduce the number of round trips between the client and application. An API gateway is set up in front of the microservices and becomes the entry point for every new request being executed by the app. It simplifies both the client implementations and the microservices app.

https://www.nginx.com/learn/api-gateway/

Pattern: API Gateway / Backends for Frontends
Context
Let’s imagine you are building an online store that uses the Microservice architecture pattern and that you are implementing the product details page. You need to develop multiple versions of the product details user interface:
HTML5/JavaScript-based UI for desktop and mobile browsers - HTML is generated by a server-side web application
Native Android and iPhone clients - these clients interact with the server via REST APIs
In addition, the online store must expose product details via a REST API for use by 3rd party applications.
A product details UI can display a lot of information about a product. For example, the Amazon.com details page for POJOs in Action displays:
Basic information about the book such as title, author, price, etc.
Your purchase history for the book
Availability
Buying options
Other items that are frequently bought with this book
Other items bought by customers who bought this book
Customer reviews
Sellers ranking
…
Since the online store uses the Microservice architecture pattern the product details data is spread over multiple services. For example,
Product Info Service - basic information about the product such as title, author
Pricing Service - product price
Order service - purchase history for product
Inventory service - product availability
Review service - customer reviews …
Consequently, the code that displays the product details needs to fetch information from all of these services.
Problem
How do the clients of a Microservices-based application access the individual services?
Forces
The granularity of APIs provided by microservices is often different than what a client needs. Microservices typically provide fine-grained APIs, which means that clients need to interact with multiple services. For example, as described above, a client needing the details for a product needs to fetch data from numerous services.
Different clients need different data. For example, the desktop browser version of a product details page desktop is typically more elaborate then the mobile version.
Network performance is different for different types of clients. For example, a mobile network is typically much slower and has much higher latency than a non-mobile network. And, of course, any WAN is much slower than a LAN. This means that a native mobile client uses a network that has very difference performance characteristics than a LAN used by a server-side web application. The server-side web application can make multiple requests to backend services without impacting the user experience where as a mobile client can only make a few.
The number of service instances and their locations (host+port) changes dynamically
Partitioning into services can change over time and should be hidden from clients
Services might use a diverse set of protocols, some of which might not be web friendly
Solution
Implement an API gateway that is the single entry point for all clients. The API gateway handles requests in one of two ways. Some requests are simply proxied/routed to the appropriate service. It handles other requests by fanning out to multiple services.

Rather than provide a one-size-fits-all style API, the API gateway can expose a different API for each client. For example, the Netflix API gateway runs client-specific adapter code that provides each client with an API that’s best suited to its requirements.
The API gateway might also implement security, e.g. verify that the client is authorized to perform the request
Variation: Backends for frontends
A variation of this pattern is the Backends for frontends pattern. It defines a separate API gateway for each kind of client.

In this example, there are three kinds of clients: web application, mobile application, and external 3rd party application. There are three different API gateways. Each one is provides an API for its client.
Examples
Netflix API gateway
A simple Java/Spring API gateway from the Money Transfer example application.
Resulting context
Using an API gateway has the following benefits:
Insulates the clients from how the application is partitioned into microservices
Insulates the clients from the problem of determining the locations of service instances
Provides the optimal API for each client
Reduces the number of requests/roundtrips. For example, the API gateway enables clients to retrieve data from multiple services with a single round-trip. Fewer requests also means less overhead and improves the user experience. An API gateway is essential for mobile applications.
Simplifies the client by moving logic for calling multiple services from the client to API gateway
Translates from a “standard” public web-friendly API protocol to whatever protocols are used internally
The API gateway pattern has some drawbacks:
Increased complexity - the API gateway is yet another moving part that must be developed, deployed and managed
Increased response time due to the additional network hop through the API gateway - however, for most applications the cost of an extra roundtrip is insignificant.
Issues:
How implement the API gateway? An event-driven/reactive approach is best if it must scale to scale to handle high loads. On the JVM, NIO-based libraries such as Netty, Spring Reactor, etc. make sense. NodeJS is another option.
Related patterns
The Microservice architecture pattern creates the need for this pattern.
The API gateway must use either the Client-side Discovery pattern or Server-side Discovery pattern to route requests to available service instances.
The API Gateway may authenticate the user and pass an Access Token containing information about the user to the services
An API Gateway will use a Circuit Breaker to invoke services
An API gateway often implements the API Composition pattern

https://eng.uber.com/architecture-api-gateway/

Unstarred

Dunk (exclude from study)

API Gateways

Review Questions

Todos

Sensemaker