Postman API Lifecycle

About

This is the API Lifecycle as provided by Postman ¹.

8 stages of the API Lifecycle

Although every API is unique, they follow similar stages. The following is highly iterative, and teams constantly return to the earliest stages as they address consumer feedback and develop new features.

Stage 1: Define

Product managers, and other stakeholders define the operational, business, and security requirements for a single API or group of APIs. The agree on the API’s intended use-case, and identify the team members who will move it through each subsequent stage of the lifecycle. They also create and configure a dedicated workspace where team members can collaborate, as well as a repository that is connected to a Continuous Integration (CI) pipeline. This helps stabilise the rest of the API lifecycle and establish locations and tooling for stage-specific work.

Stage 2: Design

Involves making intentional decisions about how an API will expose data to consumers. The API definition is the created capturing the decisions. This definition is a human and machine-readable presentation of an API’s intended functionality. The API definitions adhere to API specifications, such as OpenAPI and AsyncAPI, which provide a standardised format and vocabulary for API definitions and lay the foundation for API contracts, documentation, mocks and tests. The design stage can be standardised by defining organisational patterns and practices for shaping the surface area and behaviour of APIs. For example, teams may follow the OpenAPI specification, and they may also define style rules for capitalisation, naming, and punctuation that can be enforced through automated checks.

Stage 3: Develop

Code that implements the intended functionality of the API design is written, and a version control system such as Git, which enables developers to safely manage changes and revert to previous iterations if necessary, is used. The source code is stored in a version control platform such as GitHub and GitLab. These platforms also enable developers to keep track of code-related issues, and conduct code reviews. Teams standardise the development workflow, as these vary widely by team.

Stage 4: Test

Testing, which occurs during the “develop”, “secure”, and “deploy” stages of the API lifecycle, enables developers and QA teams to confirm that an API is working as expected. API tests can either be executed manually or automatically run from multiple geographic reguions or within (CI/CD) pipelines. Testing early and often helps teams surface and remediate issues before they become ingrained or reach production. There are many different types of tests, and each one serves a unique purpose. For example, contract tests are used to ensure that any changes do not cause the API to deviate from what was promised during the design stage. Performace tests, contrast, can help confirm that an API is able to deliver responses in an appropriate amount of time.

Stage 5: Secure

This stage involves checking an API for commong security vulnerabilities that can compromise an application’s overall security posture. For example, it’s important to confirm that an API’s authentication logic only allows legitimate users to interact with the API and access its data. These API security checks can be run manually or automatically within CI/ CD pipelines, and they help ensure that every API within an organisation follows the same security standards.

Stage 6: Deploy

The deploy stage refers to the process of publishing APIs to development, staging, and production environments. Many teams leverage CI/ CD pipelines and API gateways to standardise the deployment process and emnsure that every batch of changes is properly tested and secured before it reaches consumers. Consistent processes make deployments more predictable, which is particularly important for agile teams that ship new code several times a week.

Stage 7: Observe

This stage of the API lifecycle involves collecting, visualising and alerting on API telemetry data in production. During this stage, site reliability engineers (SREs) and DevOps engineers will configure monitors to automatically notify them of API performance and security issues and leverage APM tools that place API performance data in context. API observability plays a crucial role in surfacing errors, latency, and security vulnerabilities before thye negatively impact dependent services, partners and customers.

Stage 8: Distribute

The API’s discoverability is improved during this stage through API catalogs. Producers use public API catalogs to reach and support third-party consumers, and private catalogs for internal teams to collaborate and consume one another’s APIs. Detailed descriptions and relevant tags should be included with each API as this helps in discovering it using the catalog’s search engine.

Anki

Links

• Postman
• API Lifecycle
• API Platform

References