2018-08-10 Meeting Notes

Apigee has agreed to meet with us to review our implementation. Jordan engaged an architectural resource.
they will meet with us this Friday from 10-10:45.
Here is the meeting info:
meet.google.com/eom-jrqm-dcg

Questions

• We have a chatbot to help perform common tasks. Whats the correct way to setup an account to do that?
• One common task the chatbot does is search for Apps that have API Products in a particular status (Pening, Revoked, etc). To search for that information, the bot needs to (1) search for all developer email addresses, then (2) search for all the application associated with each address, and finally (3) search for api products associated with each application. The creates a large number of requests, which sometimes hits a quota limitation (too many requests per second). Is there a better way to search? Is there a way to simply search for all Applications that use an API Product? Or all API Products by status?
• Are we using Teams properly?
• Best way to get to Drupal 8?
• Does Apigee offer services where they might handle the conversion from Drupal 7 to Drupal 8?
• Are handling security well - gateway and portal?
• Reporting

Demo - Steven

K = Kevin Park, S = Steven Maglio, D = Diana Antova, J = Wyatt Jordan

K - how are we structured? Do we have couple of admins or everyone can manage everything? 

K - Logging policies - do we have them? 

S - We do not, we will need to figure out how to add them. Steven has an idea!

K - it is a brand new feature that should help with monitoring. Post - client flow, K will send us a document on how to use it. It is hidden feature. 

S - dining cam API - image tag that contains the API key. how do we handle security with the api key in the header?

K - keep the initial API key for the initial auth to retrieve the html, and then request a one-time token that is exposed to the end user. JWT and OAuth, json tokens. We have Apigee's oauth implemented, we need to use it for the on-time token. 

S - for now we continue this way until we implement campus oauth. We still use a separate application for this case. the dining cam api should not be auto-approved so we can control the separate application key for 

S - options response is before the API key, is it a bad way to so it?

K - it is fine to do it this way

S - employee API proxy, key-value map operation,

K -  KVM is the basic way to do encryption, change - the scope, from API proxy to environment, so we have different credentials for each environment. The scope of the KVM should be environment scope.

K - Recommended to have a catch-all proxy. to display an error message if the other proxies are called incorrectly. 

• Steven Maglio to implement catch-all proxy (APIGEE-129)

K - not recommended to have a min-max parameters, best to use query parameters. url is for resources and sub-resources - student/id/classes. for limiting data or choosing which min or max parameter it is best to use query parameters.

Ian - API versioning - what is best practice?

K - lots of philosophies, URL is what he recommends, makes things a lot easier to use. Having it explicitly in teh URL makes it easy to know what people are using.

S - multiple versions withing the same proxy

K - seen a lot more success when people split the versions into separate proxies, analytics gives you quick insight into what is used. Deprecation is much easier. customer permissions thru api products.

S - Version numbers - every unit can handle their version numbers, major versions inside the URI, if you don't put a number, you go to latest major version. If they want to get the minor version, they have to pass a header. 

K - that is fine, how often will the API methods change? 

S - we have done it twice already.

K - if we are not making braking changes, we could use a minor version bump, but it is a lot of initial overhead and not provide value. recommends not using minor versions if no braking change. Even if the back end logic changes. 

Decision - we can drop minor versions. 

D- Security

S - API key and user name and password now. With oauth we want to just get one key that has all. we are hoping JWT token will help with this, 

K - can share some slides that show why oauth is important. API key and secret is only for the application to authenticate into Apigee, from security standpoint is very secure. 

S - company ad-on. non-mint drupal plugin. without the enterprise version we cannot manage the teams from the gateway. we are thinking to use the bot to manage. 

K - company feature he does not have experience with. non-mint companies leverage the rback functionality. For each developer they force them to select a role. Permissions are applied to a particular role that they can access thru the portal. dev portal team is working on a team feature now. 

One role is defined in apigee edge, dev portal is another role. He will send us information about how it works. 

S - MFA for the chat ops account. Created a separate account for chat-ops without MFA. What is the right way to setup an account to do that? 

K - cannot use MFA, and we will use the license. 

• Kevin Wu pointed out that you can use MFA with a bot account.
  
  • Steven Maglio and Kevin Wu to update bot implementations. (APIGEE-130)

Avg active users is a term they use, so some might not count as such. Jordan will send us the description. 

D - reporting

J - will ask Kevin and get back to us. 

• Steven Maglio Create @apibot report commnds requirements. Add a use case where users can get usage; and usage by version number; and usage by version with appication breakdown; and high level report where someone can access it (push onto developer.ucsb.edu?)
  • Research - Are there any companies that Apigee logs are already being pushed to, which have better reporting already written. Do those companies allow for dashboards to be displayed in external apps (developer.ucsb.edu)?
• Diana Antova - API Proposal - An api that could return who has left UCSB (UC Path/PPS) in the past X days (maybe Adam can do this)
  • who has changed departments
• Diana Antova and Steven Maglio will start this process with Registrar's Office to use the Publish an API Workflow for the APIs that are already in place.

• Diana Antova - Develop Access Request Workflow Requirements
• Diana Antova - Document User Access Request Workflow for End Users (APIGEE-120)
  • Vince added text to the Using Your First API Pages.
  • He will create a full page for the whole process and link to the Access Request Form Document and how to use it.
• Ian Lessing (Unlicensed) - Create Access Request Workflow for End Users (APIGEE-87)
  • Should we create a requirements page for this?

• 28 Aug 2018 1 - 5 pm - Pantheon Overview, Terminus Overview and Demo, Performance & Going Live
• 29 Aug 2018 1 - 5 pm - Custom Upstream Development
• What did people learn?