Integrationadvanced
SAP API Management & API-Led Integration
Governing, securing, and monetizing SAP and custom APIs using SAP API Management as part of a broader API strategy.
API Management sits in front of an API and applies policies to it, without the backend changing.
API Management is like a building's professional reception desk and security checkpoint in front of many internal departments (backend APIs) - visitors register, get an ID badge (API credentials) with defined access limits (rate limiting/quota), and get directed to the right department, while the departments themselves keep doing their actual work (CPI/backend logic) without needing to individually vet every visitor at their own door.
Key Concepts
1
The backend does one thing: serve the data. Everything about who may call it, how often, and in what shape
is configured in the proxy.
2
The policies that matter.
rate limit cap calls per consumer per minute
quota longer-term caps, often tied to a paid tier
spike arrest smooth sudden bursts rather than passing them on
OAuth2 / API key enforce authentication at the edge
transformation reshape a response, or mask a field before it leaves3
Why this belongs in front rather than inside. Ten consumers of one OData service each need a rate
limit, and putting that logic in the backend means writing and maintaining it there, per consumer, forever.
4
without a gateway every backend implements auth, limits, logging
with a gateway backends serve data; the proxy enforces the rest5
A limit configured in a proxy applies immediately and can differ per consumer, which is not something a
backend service was built to express.
6
The API Portal is the half that changes how teams work. A catalog where developers find available APIs,
read documentation generated from the OpenAPI specification, and register an application to get
credentials — by themselves.
7
Without it, every new consumer is a ticket, a conversation, and a credential someone issues by hand and
nobody tracks. With dozens of consumers that stops working, which is the point at which organisations adopt
this rather than the point at which they build their first integration.
8
The distinction from CPI. They do different jobs and are used together:
9
CPI builds and runs the flow: transform, route, orchestrate
API Management fronts the resulting endpoint: secure, limit, publish10
CPI produces an endpoint. API Management is what makes that endpoint safe to give to people outside your
team.
11
"API-led" is the strategy word, and it means something specific. APIs are treated as products with a
lifecycle — designed, published, versioned, deprecated, retired — rather than as one-off integrations built
for a single consumer and forgotten.
12
The practical consequence is versioning and deprecation. A point integration can be changed by agreement
with its one consumer. A published API with forty consumers needs a new version alongside the old one and a
deprecation period. Answering that you would "just update it" is what the question is listening for.
13
What the interviewer is probing.1. "What does API Management add over exposing a service directly?" Probing: the value.
Stalls: "Security." Moves up: a policy layer — authentication, rate limiting, quotas, caching,
mediation and analytics — without changing the backend.
14
2. "What is the difference between a proxy and a product?" Probing: the vocabulary. Stalls:
"Nothing." Moves up: the proxy is the exposed endpoint with its policies; a product bundles
proxies for consumption and subscription by applications.
15
3. "Why rate-limit an internal API?" Probing: the reasoning. Stalls: "No need." Moves up:
to protect the backend from a misbehaving consumer — one looping client can take down an ERP system
that has finite work processes.
16
4. "Where do policies run relative to the backend?" Probing: the mechanism. Stalls: "In the
backend." Moves up: at the gateway, on request and response flows, so the backend is never reached
by a rejected call.