The range of policies that enable the APIs to loosely couple it with security, rate limit, retry, etc. are good. We can easily tie authentication mechanisms to external and other internal services without having to modify the backend.
WebSphere DataPower Gateway is really beneficial if you are trying to integrate two or more systems. It provides you with comfort and peace of mind by creating a DMZ zone for the services which are going out of the intranet to hit external clients APIs. It is greatly recommended if you have a very high volume service or API which is being used by a majority of clients because it has a dedicated physical box present which takes care of memory, CPU and all such stuff. So, all your transactions happen at wire-speed.
The foremost thing that we use DataPower is for implementing top-notch level security in different projects. We use it as a security gateway when some internal client or external client wants to make a call to any of our APIs. The basic security implementation which we do for the projects is SSL which can get more and more advanced based on the requirements of the project. Some clients want to implement OAuth, some want to implement SAML, and some are happy with a 2-way SSL handshake.
Another big advantage of DataPower is that it supports all the major industry message formats. It especially has an inbuilt component called the Multi-Protocol Gateway which comes installed in the box itself. It's the best thing if you want to convert an XML to JSON or vice-versa. It does all those conversions at wire-speed doesn't matter the volume of those transactions. We also use it with MQ while interacting with Mainframes and legacy systems. It supports all MQ properties and gives us the flexibility to change the message as well if required.
We have used DataPower in integration with ServiceNow as well to raise incidents and trigger emails to respective clients by writing custom scripts which continuously runs on the DataPower logs. As soon as they see any particular error for the services which are being monitored, they send an SNMP trap to ServiceNow with the error message and an incident is raised.
Cost - the upfront cost is a bit restrictive. I've been told it is because there are a few underlying VMs that are running this service. So if you're just starting out with API management, it can be an expensive proposition. Value increases as you add additional APIs. If you're using Azure B2C for the developer portal, you'll require Standard or Premium since they support AAD integration.
Security granularity - at time of writing, APIM doesn't support breaking out operations to products. For example, if you have an API that has a GET and a POST operation, and you want the POST operation to require a different subscription. There is a work around, but it makes management a bit messy.
Developer and Publisher portal - it's a little weird. Microsoft hasn't migrated all the publisher portal functionality into the "native" Azure portal. So some of it feels a little weird - especially when working with the content management side of things for the developer portal.
Scaling - while it's easy to scale up, the cost of APIM ramps up very quickly. Standard -> Premium is a 4x jump.
The old interface is being really missed by our team as the new WebUI interface is not that intuitive or easy to work with. It takes a lot of time to load. There should be an inbuilt wizard for creating a Rest service as well like there is for an XML based service.
IBM support is very knowledgeable but it's not that easy to reach them. They don't release the fix patches very soon which also becomes a big issue in certain situations where critical projects are involved.
Lastly, DataPower has its steep learning curve and it requires time and effort on your end to gain full control and make the most of the advanced features which it offers. Finding the right resource in the market is not that easy.
It’s really pay as you go, so it's not that costly to get in and try it out. There’s no expensive client to buy and manage, but you do need to stay on top of the rapidly changing Azure environment to be sure you upgrade or adjust when needed.
It’s not great having more than one API tool, but it’s ok to spread out your work, as you always want the right tool for the right job. For example, if you are a Salesforce-heavy organization, I’d go with Mule over Azure.
It was easy getting an external consultant access to the tool to build their own API for a project they were working on for us.
It has really taken our business to the next level. We have expanded and integrated with so many new vendors and for all those integrations DataPower is serving as our security gateway.
We don't have to depend on any other tool for doing the load balancing of the incoming requests as that is also taken care inside the WebSphere DataPower Gateway box itself, thereby distributing the load equally.
It has made our platform much more secure, uniform and robust to deal with any kind of incoming message format or threat as well due to its latest security mechanisms and huge processing power.
