API Management platforms should help developers build, provide and consume APIs using both industry standard and custom security models. Developers should be able to delegate some, or all of the responsibilities to handle security on behalf of the API Provider or API Consumer applications to the platform. These API Security Management capabilities tremendously reduce time and efforts on developing, testing and operating APIs in secure environments. In addition, API Security should be independently controlled by API Management Gateways at both the Inbound and the Outbound message flows, therefore creating the opportunity to pass through security and/or mediate (translate) security between API Consumers and backend APIs. Inbound or outbound message flows can implement and enforce many different security authentication models with different user credentials and security token types. These can be industry standard authentication schemes and security tokens, as well as custom security models. Well-written API platforms enforce and implement both authentication and authorization to ensure complete end-to-end security. This session will also touch upon the importance of Authorization and why it should be easy for anyone to define complex Access Rules that will be enforced at run-time. Authorization logic is extremely important for the security and integrity of data, even more so with the data privacy regulations being introduced globally.

3. APIAPI Consumer

4. On-premises
Cloud
Hybrid +
APIAPI Consumer

5. • Username/Password (ex: Basic Authentication)
• X.509 certificates (single-sided or mutual)
• Kerberos / NTLM
• OAuth

6. • Username/Password (ex: Basic Authentication)
• X.509 certificates (single-sided or mutual)
• Kerberos / NTLM
• OAuth
• Custom (ex: API Keys)

7. API Consumer APIAPI Gateway

8. API Gateway
Inbound Outbound
API Consumer API

9. APIAPI Gateway
Username/ Password
X.509
Kerberous
NTLM
JWT
API Keys
Custom
Username/ Password
X.509
Kerberous
NTLM
JWT
API Keys
Custom
API Consumer

10. Authentication
Authorization=
APIAPI Consumer

11. API Consumer APIAPI Gateway
Auth + Az

12. API Gateway
API Consumer API

13. API Gateway
APIAPI Consumer

14. API Gateway
API
API Consumer
API Consumer
API