# How to expand business reach with event driven APIs
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2021-07-30
Category: TECHNOLOGY
Category URL: https://financedigest.com/category/technology
Meta Title: Delivering Real-Time Information: Challenges and Solutions
Meta Description: Discover how async APIs can provide real-time updates without the need for constant polling. Learn about the benefits and challenges in delivering critical
URL: https://financedigest.com/how-to-expand-business-reach-with-event-driven-apishtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/graphicstock-man-using-digital-device-make-payments-online-shopping-and-icon-customer-sbi-301984721-1736838098808-compressed.jpg)

_By **Menaka Jayawardena**, Associate Technical Lead at WSO2_

Today, customers increasingly demand access to real-time information like stock prices, train times, etc. and they expect to be automatically informed when something has changed without having to hit the refresh button. Delivering this critical information, as it occurs, is a [challenging task for every business](https://www.financedigest.com/the-maserati-100-one-hundred-business-disruptors-challenging-the-establishment.html " ‘The Maserati 100’ One Hundred Business Disruptors Challenging The Establishment"). Traditionally, applications required backend servers to fetch the latest information; however, this proved to be inefficient, as it consumes a significant number of resources.

Many APIs that make up the web today are synchronous APIs. The nature of this type of API is a function of the [time frame from the request to the return](https://www.financedigest.com/ogrady-to-return-to-bank-of-ireland-as-ceo-irish-times.html "O’Grady to return to Bank of Ireland as CEO – Irish Times") of data and it provides a way to make scheduled requests for resources, data or services when available. Polling is a common approach, but the [process of periodical requests to the backends and waiting for responses becomes inefficient over time](https://www.financedigest.com/tightening-up-time-consuming-processes-in-the-financial-industry.html "Tightening up time consuming processes in the financial industry").

APIs should be designed to allow users to receive a [stream of events from the service](https://www.financedigest.com/how-can-stream-processing-act-as-a-catalyst-for-innovation-in-financial-services.html "How Can Stream Processing Act As A Catalyst For Innovation In Financial Services?"), instead of polling it periodically. Event-driven APIs or asynchronous (async) APIs can be used to [meet this requirement — with mission-critical information pushed](https://www.financedigest.com/queen-elizabeth-meets-sturgeon-after-new-push-for-independence-vote.html "Queen Elizabeth meets Sturgeon after new push for independence vote") to client applications at the time of the event. This provides a much better experience for users.

**Async APIs vs. REST APIs**

REST APIs for core management capabilities and end-user interactions are becoming essential for [building both on-premises and cloud-based solutions](https://www.financedigest.com/meet-tilak-joshi-the-fintech-ceo-building-modern-solutions-for-the-gig-economy.html "Meet Tilak Joshi: the fintech CEO building modern solutions for the gig economy"). RESTful APIs are more flexible, faster, popular, and scalable. They are now favoured over SOAP APIs, which are becoming outdated.

Unlike conventional request/response APIs (e.g., REST and SOAP), asynchronous APIs can send multiple responses to a single request. This can also be in the form of unidirectional or bi-directional communication. Several protocols can be used for async APIs, such as WebSocket, Webhooks, MQTT, and Server-Sent Events (SSE). Most of these protocols [support HTTP at the connection creation stage and use a specific channel to transfer the subsequent messages between the client](https://www.financedigest.com/bny-mellon-strengthens-support-for-treasury-services-clients-in-germany-with-appointment-of-gungor-taner.html "BNY MELLON STRENGTHENS SUPPORT FOR TREASURY SERVICES CLIENTS IN GERMANY WITH APPOINTMENT OF GÜNGÖR TANER") and the server. Also, conventional HTTP verbs (i.e., GET, POST, PUT, etc.) are not valid for these channels.

Another prominent difference between a REST API and an async API is the usage of an [event backbone technology](https://www.financedigest.com/quesnays-female-founders-in-tech-competition-to-expand-program-with-focus-on-insurance-technology-and-event-at-insuretech-connect-2018.html "Quesnay’s Female Founders in Tech Competition to Expand Program with Focus on Insurance Technology and Event at InsureTech Connect 2018") (a message broker such as Kafka or RabbitMQ) and topics. The backend services are registered as event publishers and they publish events on specific topics. [Client applications are registered as event](https://www.financedigest.com/impact-com-continues-momentum-in-the-first-quarter-fueled-by-client-growth-new-products-and-partnership-events.html "impact.com Continues Momentum in the First Quarter, Fueled by Client Growth, New Products and Partnership Events") subscribers to respective topics, to receive those events published by the publisher services. Upon receiving the events, the client performs the required processing and displays it to the user.

Since async APIs and REST APIs are conceptually different, several unique challenges arise when using a conventional system for asynchronous APIs. These include incompatibilities with existing security mechanisms and throttling policies, and problems around capturing [analytics data](https://www.financedigest.com/doing-more-with-trade-data-the-value-of-deeper-analytical-insights.html "Doing More with Trade Data: The Value of Deeper Analytical Insights"). Handling these challenges [via a proper API management solution](https://www.financedigest.com/peppermint-technology-revamps-communications-with-via-voice-solution.html "PEPPERMINT TECHNOLOGY REVAMPS COMMUNICATIONS WITH VIA VOICE SOLUTION") that fully supports event-driven APIs is a must.

**Are your Event-Driven APIs secure?**

API [security can be categorised into authentication](https://www.financedigest.com/ksmartech-expands-trustonic-partnership-to-secure-authentication-for-ios-and-android-apps.html "Ksmartech expands Trustonic partnership to secure authentication for iOS and Android apps ") and authorisation. Authentication describes who can access which resource, while authorisation describes whether the authenticated user can perform the specific task. In conventional REST APIs, users can be authenticated using user credentials, [access tokens](https://www.financedigest.com/cardstack-launches-application-to-simplify-access-to-token-generation-events.html "Cardstack Launches Application to Simplify Access to Token Generation Events"), certificate-based authentication, etc. Also, each resource can be protected with scopes and each API invocation can be protected too. However, in asynchronous APIs there are only topics to which the [clients and services](https://www.financedigest.com/dimension-data-introduces-next-generation-managed-services-offering-accelerate-client-innovation.html "Dimension Data introduces next-generation managed services offering to accelerate client innovation") are subscribed, and the communication occurs through a dedicated messaging backbone; it is a challenging task to secure APIs.

One possible approach to this challenge is by authenticating during the initial HTTP communication. For example, we can secure the initial WebSocket handshake (via HTTP) before creating the connection. It is also possible to enforce authorisation by defining whether the client can publish any events or not.

There are some open endpoints that do not require authentication and authorisation based on particular use cases.

**Rate Limiting, Throttling and Monetisation**

Security, rate limiting, throttling, monetisation and analytics are some of the [important factors that an organisation should focus on when exposing its core business](https://www.financedigest.com/the-importance-of-property-care-looking-after-your-business.html "The Importance of Property Care: Looking After Your Business") functions as APIs. To address these, an [enterprise must select the right API management](https://www.financedigest.com/managing-mobility-in-the-enterprise-must-have-consideration.html "Managing mobility in the enterprise must have consideration") solution.

Much of the time, the end [goal of any business](https://www.financedigest.com/how-to-create-financial-goals-for-your-business-in-2021.html "How To Create Financial Goals For Your Business In 2021") that exposes APIs for external parties is to generate revenue. For this, the main [requirement is the ability to limit](https://www.financedigest.com/lack-of-collaboration-and-skills-shortage-is-limiting-organisations-ability-to-meet-ifrs-9-requirements.html "Lack of collaboration and skills shortage is limiting organisations’ ability to meet IFRS 9 requirements") the usage of the API (block the access, reduce bandwidth, etc). API [management systems support](https://www.financedigest.com/synapse-appoints-new-finance-and-operations-manager-to-support-the-rapid-growth-of-the-business.html "Synapse appoints new Finance and Operations Manager to support the rapid growth of the business") rate limiting and monetisation for REST/SOAP APIs, using policies based on the request count (requests per second/minute, bandwidth, etc). When the client exceeds the number of requests allowed, the client is blocked for some time.

[Protecting backend services](https://www.financedigest.com/protecting-the-uk-financial-services-sector-from-cyberattacks-now-and-in-2023.html "Protecting the UK financial services sector from cyberattacks now and in 2023") from spikes of requests are also handled via these policies, by introducing a request rate limit. But when it comes to async APIs, servers publish the events and applications are the event subscribers. Therefore, conventional throttling policies cannot be applied because server-client events [need to be considered](https://www.financedigest.com/institutions-need-to-consider-spreadsheet-management-to-meet-the-pras-latest-stress-testingexpectations.html "Institutions Need to Consider Spreadsheet Management to Meet the PRA’s Latest Stress Testing Expectations").

The definition of throttling policies should also be changed. Consider the following:

Time-based throttling: A client can only be subscribed to the topic for a specific time. After that, the client is disconnected from the server.

Event count-based throttling: A client can only receive x number of total events. This also can be combined with time-based throttling and create policies (e.g., a count of 10000 events per day).

Backpressure-based throttling: When the client cannot handle the rate of events it receives, it imposes stress on the gateway to delivering the messages to the client — since it is required to queue the messages and send when the client can accept them. In these situations, the client can be removed from the gateway, to ensure that the gateway is not affected.

**Why** [analytics plays a vital role in API management.](https://www.financedigest.com/enhancing-credit-exposure-management-through-graph-analytics.html "Enhancing Credit Exposure Management Through Graph Analytics")

Analytics plays a [vital role in any API-driven business](https://www.financedigest.com/acca-sets-out-magnificent-seven-attributes-vital-to-success-in-modern-business.html "ACCA Sets Out ‘Magnificent Seven’ Attributes Vital to Success in Modern Business") and helps to make informed decisions, by providing details such as the number of API consumers, most-accessed API resources, latencies, and identifying trends, etc. It should be a mandatory capability supported by an API [management product](https://www.financedigest.com/remove-the-digital-divide-for-employee-productivity-management.html "Remove The Digital Divide For Employee Productivity Management").

In traditional REST/SOAP APIs, an API gateway can capture information such as invoking API resources, backend latencies, geo-locations, etc. These are fetched from the request/response headers.

When it comes to async APIs, capturing this information becomes much more complex, since there are no HTTP requests or responses. What we do have is a set of topics and subscribers. All the messages are sent through a separate channel (server -> client or client -> server) and the gateway should be able to capture the required information. For each subscriber of the API, the gateway should capture:

- The number of messages being pushed.
- The TPS variation over time
- The number of publishing errors
- Health details about the backend (endpoint)

**Expanding [business reach](https://www.financedigest.com/aon-assists-freddie-mac-to-reach-5bn-risk-transfer-milestone-for-u-s-mortgage-credit-business.html "AON ASSISTS FREDDIE MAC TO REACH BN RISK TRANSFER MILESTONE FOR U.S. MORTGAGE CREDIT BUSINESS") and adoption**

Using event-driven APIs has become key to meeting [customer demand and providing](https://www.financedigest.com/banks-can-provide-a-protective-shield-to-defend-customers-from-cyber-attack.html "Banks can provide a protective shield to defend customers from cyber attack") a better user experience. Since there are several fundamental differences between REST and async APIs, using a standard API [management solution](https://www.financedigest.com/exact-launches-practice-management-solution-to-help-transform-accountants-into-trusted-business-advisors.html "Exact launches Practice Management solution to help transform accountants into trusted business advisors") may be challenging. The right API management solution should combine traditional API management [capabilities](https://www.financedigest.com/mercury-fx-boosts-financial-crime-management-capabilities-with-trunarrative-platform-investment.html "Mercury FX boosts financial crime management capabilities with TruNarrative platform investment") with an event-driven architecture. Moreover, vendors now provide integration [software with plug-and-pay and configuration-driven approaches](https://www.financedigest.com/why-a-modern-organisation-needs-an-agile-approach-to-software-asset-management.html "Why a modern organisation needs an agile approach to software asset management") to implement asynchronous messaging patterns. This will provide tremendous value, [enabling an organisation to expand](https://www.financedigest.com/forescout-and-fireeye-expand-partnership-enabling-faster-response-to-cybersecurity-threats.html "FORESCOUT AND FIREEYE EXPAND PARTNERSHIP, ENABLING FASTER RESPONSE TO CYBERSECURITY THREATS") business reach and adoption.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---