Skip to content

Latest commit

 

History

History
215 lines (172 loc) · 11 KB

create-manage-secure-apis.md

File metadata and controls

215 lines (172 loc) · 11 KB
copyright lastupdated
years
2017, 2018
2017-11-30

{:java: #java .ph data-hd-programlang='java'} {:swift: #swift .ph data-hd-programlang='swift'} {:ios: #ios data-hd-operatingsystem="ios"} {:android: #android data-hd-operatingsystem="android"} {:shortdesc: .shortdesc} {:new_window: target="_blank"} {:codeblock: .codeblock} {:screen: .screen} {:tip: .tip} {:pre: .pre}

Create, secure and manage REST APIs

This tutorial demonstrates how to create a new REST API using the LoopBack Node.js API framework and then add management, visibility, security and rate limiting to your API using the API Connect service on IBM Cloud. {:shortdesc}

Objectives

  • Create a REST API in Node.js
  • Deploy Node.js application
  • Import API Specification to API Connect
  • Secure and Manage API

Products

This tutorial uses the following products:

Before you begin

Download and install Node.js

Create a REST API in Node.js

{: #create_api} In this section, you will create an API in Node.js using the LoopBack framework. LoopBack is a highly-extensible, open-source Node.js framework that enables you to create dynamic end-to-end REST APIs with little or no coding.

Create application

  1. Install IBM API Connect command line tool.
npm install -g apiconnect
  1. Enter the following command to create the application.
apic loopback
  1. At the prompt, enter entries-api as the project name and press Enter.
? What's the name of your application? entries-api
  1. Press Enter to use a directory with the same name as the project.
  2. Choose the current version of LoopBack.
  3. Select empty-server for the kind of application.
  ? What kind of application do you have in mind? (Use arrow keys)
  ? empty-server (An empty LoopBack API, without any configured models or datasources) 
    hello-world (A project containing a basic working example, including a memory database) 
    notes (A project containing a basic working example, including a memory database)

apic_loopback

Add a data source

Adding a data source allows you to configure where the data should be persisted. Various types of databases are supported, but for the sake of simplicity, we will use an in-memory data store.

  1. Change directory to the new project and launch the API Designer.
cd entries-api
apic edit

  1. Click on Data Sources > Add, A New LoopBack Data Source window opens.

  2. Enter entriesDS in the Name text field and click New.

  3. Use in-memory db for the Connector setting.

  4. Click All Data Sources on the top left. The data source will appear in the list of data sources.

    The editor automatically updates the server/datasources.json file with settings for the new data source. {:tip}

apic_loopback

Add a model

Models allow you to define and control the structure of data and schema of your API.

  1. Click Models > Add and enter entry in the Name text field and click New .
  2. In the Data Source field, select entriesDS.
  3. In the Properties, click the Add property icon .
  4. In the Property Name text field, enter name and select Type of string.
  5. Repeat with Property Name text field email and Type of string.
  6. Repeat with Property Name text field comment and Type of string.
  7. Click the Save icon to save your changes.
  8. Click All Models to finish editing the model.

apic_loopback

Test your LoopBack application

In this section, you will start a local instance of your Loopback application and test the API by inserting and querying data using the API Designer.

  1. Start the local server by clicking Start icon at the bottom of the screen and wait for the Running message: .
  2. Click the Explore icon to see the API Designer Explore tool. The sidebar shows all of the REST operations for the LoopBack models in the API.
  3. Click the operation entry.create in the left pane to display the endpoint. The center pane displays summary information about the endpoint, including its parameters, security, model instance data, and response codes. The right pane provides template code to call the endpoint using the cURL command, and languages such as Ruby, Python, Java, and Node.
  4. On the right pane click Try it. Scroll down to Parameters and enter the following in data
{
  "name": "Jane Doe",
  "email": "[email protected]",
  "comment": "Jane likes Blue"
}
  1. Click Call operation. apic_loopback
  2. Confirm successful POST by checking for Response Code: 200 OK.

Note: If you see an error message due to an untrusted certificate for localhost, click the link provided in the error message in API Designer Explore tool to accept the certificate, then proceed to visit the URL in your web browser. The exact procedure depends on the web browser you are using. If you load the REST endpoints directly in your browser, you will see the message: {"name":"PreFlowError","message":"unable to process the request"}. Then, attempt the Call operation again.

  1. Add another entry using a curl command. Confirm the port matches your Application port
curl --request POST \
--url https://localhost:4002/api/entries \
--header 'accept: application/json' \
--header 'content-type: application/json' \
--header 'x-ibm-client-id: default' \
--header 'x-ibm-client-secret: SECRET' \
--data '{"name":"John Doe","email":"[email protected]","comment":"John likes Orange"}' \
--insecure
  1. Click entry.find >Try It(on the right pane) > Call operation to display all entries. You should see JSON for Jane Doe and John Doe. entry_find

You can also start the application manually by issuing the npm start command. Your REST API will be available at http://localhost:3000/api/entires {:tip}

Create API Connect service

To prepare for the next steps, you need to create an API Connect service on IBM Cloud which will act as the gateway for your API. This service on IBM Cloud will be used to manage,secure and rate limit your API.

  1. Launch IBM Cloud Dashboard
  2. Navigate to Catalog > APIs > API Connect and click Create entry_find

Publish API to IBM Cloud

{: #publish}

You will use the API Designer to deploy your application to IBM Cloud as a Cloud Foundry application and also publish your API definition to API Connect. The API Designer is your local toolkit. If you closed it, you can relaunch with apic edit command from the project directory.

You can also deploy the application manually using the bx cf push command. However, it will not be secured. To import the API into API Connect, use the OpenAPI definition file is available in the definitions folder. Deploying using the API Designer secures the application and imports the definition automatically. {:tip}

  1. Back in the API Designer, click Publish > Add and Manage Targets > Add IBM Bluemix target.
  2. Select the Region and Organization that you want to publish to.
  3. Select the Sandbox Catalog and click Next.
  4. Enter entries-api-application under Type a new application name and click +
  5. Click entries-api-application in the list and click Save.
  6. Click on the Menu icon on the left top most corner > Projects > entries-api in the list.
  7. In the API Designer UI, click APIs > entries-api > Assemble
  8. In the Assembly editor, click the Filter policies icon.
  9. Select DataPower Gateway policies and click Save.
  10. Click Publish on the top bar and select your target. Select Publish application and Stage or Publish Products > Select Specific products > entries-api.
  11. Click Publish and wait 5 minutes for the application to finish publishing. publish

You can republish or stage your application anytime by clicking on publish anytime. {:tip}

The API application is now published to IBM Cloud as a Cloud Foundry application. You can see it by looking at Cloud Foundry applications under IBM Cloud Dashboard. However, direct access using the URL is not possible as the application is protected.

API Gateway

Until now, you have been designing and testing your API locally. Next, you will use the API Connect service to test your deployed API on IBM Cloud.

  1. Launch IBM Cloud Dashboard
  2. Find and select your API Connect service under Cloud Foundry Services
  3. Click on Explore and select Sandbox
  4. Click on entry.create
  5. On the right pane, click Try it. Scroll down to Parameters and enter the following in data
{
  "name": "Cloud User",
  "email": "[email protected]",
  "comment": "Entry on the cloud!"
}

A 200 response should displayed.

gateway

Your managed and secure API URL is displayed next to each operation and it should look like

https://us.apiconnect.ibmcloud.com/orgs/ORG-SPACE/catalogs/sb/api/entries

Rate Limiting

Setting rate limits enables you to manage the network traffic for your APIs and for specific operations within your APIs. A rate limit is the maximum number of calls you want to allow in a particular time interval.

  1. Back in the API Designer, click Products > entries-api.
  2. Select Default Plan on the left
  3. Expand Default Plan and scroll down to Rate limits field
  4. Set fields to 10 calls / 1 Minute
  5. Select Enforce hard limit and click Save icon. rate_limit
  6. Follow steps under Publish API to IBM Cloud section to re-publish your API

Your API is now rate limited to 10 requests per minute. See more info about Setting up rate limits or explore the API Designer to see all the management features available.

Related information