> ## Documentation Index
> Fetch the complete documentation index at: https://grandcentral.backbase.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API management (APIM)

> Comprehensive API lifecycle management with security, monitoring, and governance capabilities

The API Management layer provides full control over the API lifecycle, from design and development to publishing, monitoring, and retirement.

## APIM value proposition

<CardGroup cols={2}>
  <Card title="Full API lifecycle management" icon="recycle">
    Complete API management from creation to retirement, including versioning and deprecation
  </Card>

  <Card title="Backend system abstraction" icon="layer-group">
    Route APIs to different backend systems with easy configuration and management
  </Card>

  <Card title="API analytics and insights" icon="chart-line">
    Comprehensive usage metrics, performance data, and error monitoring
  </Card>

  <Card title="Security and authentication" icon="shield-halved">
    Enterprise-grade security with comprehensive authentication and authorization
  </Card>
</CardGroup>

## APIM architecture components

The API management platform consists of three core components that work together to manage the API lifecycle.

### Control plane

The control plane provides centralized management for API publishers:

* **Centralized management portal** - provides API publishers with tools to define APIs, policies, and subscriptions through a unified interface.
* **API definition** - enables creating and managing API specifications, endpoints, and documentation. Publishers can design APIs using OpenAPI specifications and manage multiple versions simultaneously.
* **Policy management** - configures security controls, rate limiting rules, transformation logic, and routing policies. Policies are reusable and can be applied at different scopes (global, product, API, or operation level).
* **Subscription control** - manages API subscriptions, user access, and entitlements across different API products. Access keys and tokens are provisioned automatically with configurable expiration and rotation policies.
* **Analytics dashboard** - monitors API usage, performance metrics, and system health. Real-time dashboards provide insights into API consumption patterns, error rates, and performance bottlenecks.

### Developer portal

The developer portal gives API consumers self-service discovery and testing:

* **Self-Service Portal** - allows API consumers to discover APIs, subscribe to services, and access development resources without requiring manual approval processes.
* **API discovery** - enables browsing and searching available APIs with detailed documentation. Developers can filter APIs by category, version, or functionality to find relevant services quickly.
* **Subscription management** - provides self-service API subscriptions and access key management. Developers can manage their own subscriptions, regenerate keys, and monitor their usage quotas.
* **Documentation and samples** - includes interactive documentation with code samples and tutorials. Documentation is auto-generated from API specifications and kept synchronized with API changes.
* **Test consoles** - offer interactive API testing and validation tools. Developers can test API calls directly from the portal without writing code, inspecting requests and responses in real-time.

### API gateway

The API gateway runs as the runtime proxy between clients and backends:

* **Runtime proxy and policy engine** - acts as a proxy between client applications and backend services, applying policies and routing calls. The gateway handles all incoming API requests and enforces configured policies before forwarding to backends.
* **Request routing** - provides intelligent routing to appropriate backend services based on API specifications, load balancing rules, and health checks.
* **Policy enforcement** - applies authentication verification, rate limiting controls, transformation logic, and routing rules at runtime. Policies execute in a defined sequence with short-circuit capability for failed checks.
* **Load balancing** - distributes requests across multiple backend instances to ensure high availability and optimal resource utilization.
* **Request monitoring** - captures real-time monitoring and logging of all API requests, including request/response payloads, headers, performance metrics, and error details.

## API lifecycle management

The APIM platform provides comprehensive lifecycle control across four key phases:

<AccordionGroup>
  <Accordion title="Design and develop" icon="drafting-compass">
    The design and develop phase includes the following:

    **Policy library** - 50+ built-in policies including the categories below.

    **Traffic management** - available capabilities include:

    * Rate limiting and throttling
    * Quota management
    * Load balancing strategies

    **Caching and performance** - options include:

    * Response caching policies
    * Request/response compression
    * Performance optimization

    **Transformation** - supported transformations include:

    * Request/response transformation
    * Protocol conversion (REST ↔ SOAP)
    * Data format conversion (JSON ↔ XML)

    **Validation** - validation capabilities include:

    * Schema validation
    * Parameter validation
    * Content type verification
  </Accordion>

  <Accordion title="Secure" icon="lock">
    The secure phase covers the following:

    **Authentication methods** - supported methods include:

    * API Keys and tokens
    * OAuth 2.0 / OpenID Connect
    * JWT (JSON Web Tokens)
    * mTLS (Mutual TLS)

    **Authorization** - controls include:

    * Role-based access control (RBAC)
    * Scope-based permissions
    * Custom authorization policies

    **Identity providers** - integration options include:

    * 1st party identity providers
    * 3rd party IDP integration
    * SAML and OIDC support

    **Network security** - capabilities include:

    * IP-based access control
    * Geo-blocking capabilities
    * VPN and private connectivity
  </Accordion>

  <Accordion title="Publish" icon="bullhorn">
    The publish phase includes the following:

    **Version management** - capabilities include:

    * API versioning strategies
    * Backward compatibility
    * Deprecation management
    * Revision control

    **Product management** - options include:

    * API Product creation
    * Bundle management
    * Pricing and monetization

    **Access control** - controls include:

    * User groups and roles
    * Subscription tiers
    * Access approval workflows

    **Documentation** - documentation features include:

    * Auto-generated documentation
    * Interactive API explorers
    * Code samples and SDKs
  </Accordion>

  <Accordion title="Monitor" icon="chart-line">
    The monitor phase provides the following:

    **Observability** - capabilities include:

    * Comprehensive logging
    * Real-time metrics collection
    * Distributed tracing
    * Performance monitoring

    **Analytics** - analytics features include:

    * Usage analytics and reporting
    * Performance dashboards
    * Business intelligence integration
    * Custom metric creation

    **Alerting** - alerting options include:

    * Real-time alert configuration
    * SLA monitoring and enforcement
    * Automated incident response
    * integration with monitoring tools

    **Debugging** - debugging capabilities include:

    * End-to-end request tracing
    * Error analysis and reporting
    * Performance bottleneck identification
  </Accordion>
</AccordionGroup>

## Industrialized APIM capabilities

Grand Central provides enterprise-ready APIM capabilities out-of-the-box:

<CardGroup cols={2}>
  <Card title="Self-service onboarding" icon="user-plus">
    Automated developer registration, API subscription workflows, access key provisioning, and documentation access
  </Card>

  <Card title="Security controls" icon="shield-check">
    Multi-factor authentication, certificate management, threat protection, and compliance monitoring
  </Card>

  <Card title="APIM Helm charts" icon="dharmachakra">
    Kubernetes-native deployment, configuration management, scaling and updates, and environment consistency
  </Card>

  <Card title="GitOps CI/CD" icon="code-branch">
    Infrastructure as Code, automated deployments, version control integration, and rollback capabilities
  </Card>
</CardGroup>

## Integration with observability

APIM integrates with observability tools for logging, metrics, and alerting:

* **Structured logging** - captures comprehensive request/response data in a structured format for easy analysis. All API interactions are logged with correlation IDs, timestamps, user context, and detailed request/response payloads.
* **Log aggregation** - provides centralized log collection and management with powerful search and filtering capabilities. Logs from all APIM components are aggregated into a unified logging platform for cross-component analysis.
* **Performance metrics** - track response times, throughput, error rates, and availability measurements. Real-time dashboards display latency percentiles, request volumes, and error rate trends.
* **Business metrics** - capture API usage patterns, developer adoption rates, and business KPIs. Track API consumption by product, customer, or endpoint to understand business value and usage trends.
* **Distributed tracing** - enables end-to-end request tracking across microservices and system boundaries. Each request receives a unique trace ID that follows the request through all components, making it easy to identify where latency or errors occur.
* **Performance analysis** - identifies bottlenecks and optimizes request processing paths. Trace data reveals which components contribute most to overall latency, enabling targeted optimization efforts.
* **Real-time alerts** - provide immediate notification of API issues, SLA breaches, and security threats. Alert rules are configurable based on thresholds for error rates, latency, or custom metrics.
* **Alert management** - handles alert routing, escalation, and integration with incident management systems. Alerts can trigger automated remediation workflows or notify on-call engineers through multiple channels.

## Benefits summary

<CardGroup cols={3}>
  <Card title="Developer productivity" icon="rocket">
    * Self-service API discovery
    * Interactive documentation
    * Automated testing tools
    * Faster time to integration
  </Card>

  <Card title="Operational excellence" icon="gear">
    * Centralized API governance
    * Automated policy enforcement
    * Real-time monitoring
    * Simplified troubleshooting
  </Card>

  <Card title="Business value" icon="chart-line">
    * API monetization capabilities
    * Partner ecosystem enablement
    * Reduced development costs
    * Faster innovation cycles
  </Card>
</CardGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Integration platform" icon="code" href="/platform/integration-platform">
    Explore the low-code/pro-code integration development capabilities
  </Card>

  <Card title="Connectivity architecture" icon="network-wired" href="/platform/architecture#connectivity-architecture">
    Learn about secure connectivity patterns and implementation
  </Card>
</CardGroup>