Improving User Experience With Tools and Technology
This Fortune 500 company offers a broad range of financial products and services to consumers, small businesses, and commercial clients. The bank wanted to create better end customer experiences with a suite of tools and technology to simplify their daily lives with services to help them manage money, credit, and identity, amongst other essential things.
Akana Helps With…
External Developer Engagement
Consumable and Easier to Use APIs
Creating an API Ecosystem
The bank built an API Platform with a Developer Portal to expose these tools and technologies to developers who can easily use them in their products. The API Platform and Developer Portal publish a set of externally-facing APIs that provide valuable capabilities App developers can embed into applications to help streamline their users’ lives. These include:
- Secure authentication and identity services – two factor authentication providing strong security for access to confidential information
- Loyalty point balance and redemption – easily view and consume loyalty points accrued consuming the bank’s services
- Credit promotions – get a personalized list of current promotions and offers
The bank will continue to extend the range of APIs to meet the fast growing needs of its developer community.
The APIs the bank is publishing through the Gateway and Portal must be secure, reliable, and easy to find and consume, and must also be able to sustain the level of traffic generated by popular Apps used by millions of customers.
There are two integrated components in the bank’s API management platform:
- API Gateways – A network of API Gateways the bank’s developers can use to securely and reliably expose capabilities as services and APIs both internally and externally.
- Developer Portal – A portal that external developers can use to easily find and consume the bank’s APIs.
Most of the APIs the bank publishes need to be delivered securely, both in terms of the infrastructure hosting the API, and the API interface itself. The API Management solutions protects the bank’s applications from external threats while providing state of the art API security. The Gateway offers comprehensive protection against OWASP top ten threats including Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Injection, Session Management, and more. It also provides antivirus scanning and strong cryptographic protection.
A couple of examples of the security features the bank implements are:
- OAuth – a high-performance, scalable OAuth server that the bank uses to authenticate users and authorize access to all APIs.
- Throttling – every App has its own contract with the Gateway ensuring that each App can only consume an agreed up amount of traffic from each API.
The bank needs to ensure that its APIs perform extremely well to keep customers happy, scale to support the needs of a rapidly growing user base, and are distributed globally to provide local access to minimize network latency for global users. To this end the API management solution provides:
- Caching & Paging – optimize the performance of APIs, especially for mobile Apps with a highperformance caching and paging system combined with a global content distribution network.
- Distribution/Routing – publish API endpoints around the globe while managing the API as a single entity with a single set of central analytics and usage data.
A critical part of any API platform is the ability to provide developers with a self-service platform they can use to find and easily consume APIs. The bank’s API Management platform provides:
- Documentation – dynamically generated Swagger documentation for all the APIs with additional downloadable documents providing helpful implementation guides.
- App provisioning – developers can create their own App definitions and request access to APIs with specific quotas and service-levels.
- Testing – developers can send test requests from a custom test client, or using the testing features builtin to the API docs.
- RESTful API design
- Security policy enforcement
- SLA and throughput management
- Developer engagement
This particular customer chose a perpetual license model, deploying the products into its own Amazon VPC instances, using Akana’s Docker image with Amazon EC2 Container Server. This closely models the deployment Akana uses in its own SaaS platform. By following this deployment pattern the bank ensures seamless scaling as needed, and maintains compliance with its own internal security policies.
The bank selected the Akana platform over other vendors for several reasons. It offered the best performance, scale, and richness of features and functionality. The Akana platform also successfully combined with the bank’s required deployment automation capabilities.
The bank’s platform is in production handling live traffic. The bank continues to roll out more APIs and has planned a rich roadmap of new services.