WSO2 API Manager

Open your backlog and pick the API you need online by Friday. In WSO2 API Manager, start by importing an OpenAPI or GraphQL definition—or sketch the endpoints in the design view. Spin up a mock to validate contracts with consumers, then wire real backends (REST, SOAP, gRPC, or microservices) through the gateway. Add docs, examples, and a try-it console so consumers can self-serve in the developer portal. Publish the API as a visible asset, gate subscriptions with approval if needed, and generate keys or OAuth clients automatically. If you prefer code-first, commit your API artifacts to Git and let a pipeline package and promote them through dev, test, and prod.

Harden the runtime before traffic hits. Apply burst control and quotas per app, tenant, or plan; protect against spikes with dynamic throttling. Enable OAuth2/JWT, mTLS, and IP filtering; add payload checks, schema validation, and message size limits to cut common exploits. Use transformation policies for headers, mediation, and CORS. Lock down who sees what with roles, teams, and fine-grained scopes. Version deliberately: run v1 and v2 side by side, mark one as deprecated, and set a retirement date. Ship safely with GitOps: export/import API bundles, run contract and smoke tests, and roll forward or roll back with a click.

Grow adoption and revenue once it’s live. Create free, metered, and premium plans with per-minute or per-month caps and hook billing to your provider of choice. In the portal, developers discover APIs, sign up, create apps, request access, and view their own usage, latency, and error trends. Product owners watch dashboards for top consumers, slow endpoints, and drop-offs. Connect external observability stacks (ELK, Prometheus, Grafana) or use built-in insights to spot anomalies, trigger alerts on 5xx spikes, and trace calls across services. Iterate safely: test new throttling or caching rules in a sandbox, promote when stable, and audit every change.

Pick a deployment that fits your footprint. Run fully on your servers, go cloud-first, or split control plane and data plane for hybrid teams. Use a centralized gateway for shared governance, or place micro-gateways next to each service or Kubernetes namespace for low latency and autonomy. Do blue/green or canary upgrades of gateways and policies, keep state in a shared store, and scale horizontally as calls grow. Wrap legacy SOAP or monoliths behind a single entry point while new microservices emerge; migrate customers in waves using routing rules and header-based traffic splitting. When it’s time to retire an API, notify subscribers, enforce sunsetting, and keep a clean lineage of artifacts and versions for traceability.