Designing a composable API platform powered by open standards and open-source tools
summary
Claims that 71% of web traffic and ~1.5 billion API calls motivate a composable API platform built with OpenAPI, OPA, OAuth2/OIDC and OpenTelemetry. The demo assembles an OpenAPI spec into Tyk via a CRD on Minikube with Argo CD, uses Keycloak for JWT/OAuth2, enforces policies with OPA, and ships metrics/logs/traces to Prometheus Loki Tempo and Grafana. End-to-end requests authenticate, authorization varies by JWT scope, and distributed traces and dashboards are visible, so the build actually works.
AI-written summary · about
chapters (16)
- 0:00Welcome to API platforms
- 2:56Why API platforms matter
- 5:47From simple APIs to complexity
- 7:52Composability and open standards
- 9:37Designing composable API platform
- 12:45Key capabilities for success
- 15:17Measuring API platform success
- 16:21Demo overview
- 19:31Creating OpenAPI spec
- 23:06Security with OPA and Keycloak
- 26:37Keycloak realms for identity
- 29:50Testing JWT authentication
- 31:55Granular authorization policies
- 34:48Observability with OpenTelemetry
- 36:14Distributed tracing in Grafana
- 37:21Summary
related talks
30mDesigning a Composable API Platform Powered by Open Standards
52mOpen-Source to the Rescue of My APIs: Securing Them with Gravitee.io and Keycloak
17mAPI Security Simplified: Practical Tips & Tools
14mArchitecting Secure and Scalable Integration Platforms for FinTech
24mMastering API Security and Compliance
51mApproaching OAuth2
38mEvolving your APIs, a Pragmatic Approach
45mOpenAPI for Web Developers