As most software developers no doubt know, there are two primary models for API design: RPC and REST. Regardless of model, most modern APIs are implemented by mapping them in one way or another to the same HTTP protocol. It has also become common for RPC API designs to adopt one or two ideas from HTTP while staying within the RPC model, which has increased the range of choices that an API designer faces. This post tries to explain the choices, and give guidance on how to choose between them.

We are pleased to announce the next release of our flagship enterprise offering, Kong Enterprise 1.5! This follow-up release adds additional stability and features on top of our last major release, Kong Enterprise 1.3, which we announced at Kong Summit 2019. Kong Enterprise 1.5 key features include Kong Immunity Consumer Alerts, OIDC improvements, and Kong Developer Portal Application Registration. There are also several smaller features and stability improvements packaged here.

The principles behind performance testing API’s does not differ from the principles behind the performance testing of any application. Many API’s however are Asynchronous and a valid response from the API does not necessarily mean the transaction is complete which can cause a problem when measuring the performance of API’s. There are however ways around this and we will explore these in this post.

Kong for Kubernetes is a Kubernetes Ingress Controller based on the Kong Gateway open source project. Kong for K8s is fully Kubernetes-native and provides enhanced API management capabilities. From an architectural perspective, Kong for K8s consists of two parts: A Kubernetes controller, which manages the state of Kong for K8S ingress configuration, and the Kong Gateway, which processes and manages incoming API requests.

When protecting your online services, the weakest link is represented by the endpoints – that is, by the end-user devices running web or mobile applications or by external systems leveraging open APIs. As a matter of fact, there is a growing number of targeted attacks leveraging sophisticated techniques such as malicious web injections, mobile overlay and API abuse attacks to perform identity hijacking, account takeover, transaction tampering and payment frauds.