API World + CloudX + Dev Innovation Summit 2024

Richard Clark, JFrog, Senior Solutions Architect

As supply chain attacks continue to evolve and proliferate, there is a critical need for organizations to fortify their defenses. Especially with the ever growing usage of open source technology in today’s software landscape, open source vulnerabilities have become a prime target for attackers seeking widespread impact. In this session, Richard Clark, Senior Solutions Architect at JFrog will emphasize the importance of proactive measures, including educating developers to use reputable tools, and adopting software composition analysis to safeguard against the growing menace of supply chain vulnerabilities.

In this session, Richard will also discuss:
How software bills of materials or SBOM standards, such as CycloneDX and SPDX, enhance visibility into software dependencies;
The rapid adoption of faster release cycles in business operations and how it heightens vulnerabilities in supply chain management;
The importance of collaboration between security teams and developers.

Roundtables give attendees the opportunity to meet in small groups with API World, CloudX + Dev Innovation Summit speakers and industry leaders to discuss real-world topics relevant to you. These open roundtables are working sessions for in-depth industry conversations.

Topic: AI, Low-code and No-Code and their impact on the industry 

Dakota Garcia, MuleSoft from Salesforce, Senior Product Manager
Simone Geib, MuleSoft from Salesforce, Director of Product Management

How can you adopt AI with trust & speed? Will AI lead to more API sprawl? Create a connected, scalable foundation to deliver AI-powered experiences and improve visibility, security and governance for APIs using MuleSoft Anypoint Platform.

Alisha Mohanty. OpenText, Manager, Product Marketing

A quick guide to API strategy for businesses to thrive in an era of Artificial Intelligence
Here I elaborate on points to take away for current trends in API strategy and future predictions keeping them relevant the age of AI.

Roundtables give attendees the opportunity to meet in small groups with API World, CloudX + Dev Innovation Summit speakers and industry leaders to discuss real-world topics relevant to you. These open roundtables are working sessions for in-depth industry conversations.

Asanka Abeysinghe, WSO2, CTO

In the evolving landscape of enterprise technology, the traditional approach of building separate API platforms is no longer sustainable. Instead, integrating API management and capabilities into a comprehensive Internal Developer Platform (IDP) ensures greater agility, efficiency, and coherence in software development. This session explores the pitfalls of isolated API platforms and presents a compelling case for their integration into IDPs. By emphasizing modularity, discovery, and composability, this unified approach can streamline workflows and enhance developer productivity. Drawing from the principles of the Platformless Manifesto, practical strategies, architectural considerations, and real-world examples will illustrate the benefits of this integrated methodology. 

Ram Gopinathan, Red Hat, Principal Specialist Solutions Architect, Edge Computing

This session will first cover what design first API development means and compare and contrast with code first approach. We will then go over how backstage can help API developers practice design first API development using software templates and github actions workflow.
API designers after designing openapi spec in swagger editor can use the software template to provide information about the API along with the spec. Once the information is submitted, using backstage scaffolding capabilities required catalog entity files are created and added to git repo and a pull request is created. PR url will be displayed as output. Open pull request action will also trigger a github actions workflow to update the targets in the location file and since our backstage instance is configured to automatically ingest entities from this location as soon as the pull request is merged within a few minutes this new API will become available in the backstage software catalog. At this point development team can use a software template to implement this newly created API.

Anushrut Gupta, Hasura, Senior Product Manager, Generative AI

“Over the last 3 months, summarize the top billing issues faced by my enterprise customers within the first 30 days of their onboarding.”

On the surface, building an internal AI customer intelligence application that can answer questions like this is a perfect use-case for Gen AI.
However, building a production ready app that retrieves the data (RAG) before hauling it off to your favorite LLM for summarization soon becomes a terrible engineering experience.

The data is spread across 3 places: a tickets database (eg: elastic), a CRM (eg: salesforce) and your user-accounts transactional database (eg: postgres).
In production, your app can’t access the data from these databases directly. Given security & privacy concerns, your app won’t have direct access to these databases.
Making independent retrieval requests to each of these sources and then joining them in memory might be prohibitively expensive and needs a level of query planning to do efficiently.
Moving all data into one location is expensive to build, maintain and govern
Predictable quality is further made hard because underlying data formats and storage interfaces are continuously changing.
Different types of user queries might require additional filtering and joining of data, which becomes hard to generalize.

APIs solve almost all of these very well known challenges. APIs offer standardization and security. APIs can provide a stable contract to interact with underlying data.

And in all likelihood, you already have APIs on these internal and external data sources.

Ironically, while APIs have become a necessity for other parts of the stack, they are clearly not the first thing that AI engineers building RAG reach for.

In this talk, we’ll discuss:
Why API based retrieval doesn’t work well for RAG
What we need from our existing internal and external APIs to make them RAG ready
How we can get existing APIs to become RAG ready without needing to rebuild the APIs

This talk will be technical, with code demos (possibly with some live coding!) and end with key resources (reference architectures, API best practices, tools/technologies) that attendees can take back to their work.

Venkatesh Kunchenapalli, Senior Devops and Infrastructure Engineer

In the rapidly evolving landscape of software development, the pressure on development teams to deliver high-quality applications swiftly is ever-increasing. This scenario often burdens developers with undifferentiated tasks, hindering their productivity and focus on core application development. Platform engineering, facilitated by Internal Developer Portals (IDP), presents a strategic approach to alleviating these challenges by automating infrastructure management and providing pre-configured tools and environments.
Venkatesh Kunchenapalli's experience at Wipro, USA, has demonstrated significant enhancements in developer efficiency through the adoption of IDPs. This paper discusses the implementation of a self-service platform that automatically provisions GitHub repositories, CI/CD pipelines, and cloud infrastructure using templates tailored for various project types such as Java, Node.js, and Python. The automated setup includes comprehensive workflows for Terraform, Docker, and Kubernetes, ensuring environments are ready for immediate use.
Key findings from our internal evaluations reveal a substantial improvement in productivity, with a 40-50% reduction in manual hours required for project setups, directly translating to an increase in the speed of application delivery. For instance, web application development saw man-hours reduced from 200 to 120, achieving a 40% productivity gain. Similarly, API service projects noted a 50% reduction, from 160 to 80 man-hours.
Further, the introduction of IDPs has led to a notable increase in developer satisfaction, with survey results showing an improvement from 60 to 85 out of 100, marking a 42% increase in developer contentment post-implementation. These enhancements are supported by a robust support system that addresses issues through data-driven insights and proactive template updates, ensuring the IDP remains effective and relevant.
This paper underscores the critical role of platform engineering in modern software development by demonstrating how it can significantly enhance developer experience and operational efficiency, thereby fostering faster and more effective application development cycles.

We will do a demo and offer a raffle at the end for a giveaway!
 
Chris Petterson, head of solutions on our team, will be giving a quick live demo of Blackbird, our new API development platform, with a raffle and prize giveaway at the end. Prize TBD.

Booth #507

Cortez Frazier Jr., FOSSA, Principal Product Manager

If you work in vulnerability management or DevSecOps programs, you’re probably familiar with the painful condition known as CVE overload. Each year, tens of thousands of new vulnerabilities are reported, which causes stress and late nights for the teams tasked with remediating them.

And that’s not to mention the herculean tax of distinguishing between potential vulnerabilities and confirmed vulnerabilities. The reality that most vulnerabilities are only potentially exploitable (as determined by the deployed context of each package) also means remediation often results in a lot of wasted time and effort.

A proposed solution is VEX (Vulnerability Exploitability eXchange): a set of formats that communicates vulnerability impact status, whether a vulnerability is exploitable in its deployed context, and mitigation steps. In theory, VEX (when used alongside other prioritization inputs) makes it possible to remediate more efficiently. But as with most security frameworks, efficacy depends on proper implementation.

This talk will cover five steps to leveraging VEX throughout the vulnerability remediation lifecycle, from the time a vulnerability is disclosed to the time you publish and distribute a VEX statement. We’ll cover the tools and workflows teams need to know to effectively use VEX in their organizations.

Raileen Del Rosario, Docusign, Programmer Writer

Ensuring frictionless integration for developers is key to ensuring that your APIs are used to their fullest potential. By offering reference implementations and a Quickstart wizard in eight programming languages, we highlight the main use cases for our APIs, enabling developers to use our tools efficiently. This talk will discuss how providing ready-made code enables developers to start using your APIs as quickly as possible. 

Anthony Molzahn, Devii, CEO

10:30am PST

10:30am PST

11:00am PST

11:00am PST

11:00am PST

11:00am PST

11:00am PST

11:15am PST

11:30am PST

11:30am PST

11:30am PST

11:30am PST

12:15pm PST

1:00pm PST

1:00pm PST

1:00pm PST

1:00pm PST

1:00pm PST

1:30pm PST

1:30pm PST

1:30pm PST

1:30pm PST

1:30pm PST

1:45pm PST

2:00pm PST

2:00pm PST

2:00pm PST

2:00pm PST

2:00pm PST

2:00pm PST

2:15pm PST

2:30pm PST

2:30pm PST

2:30pm PST

2:30pm PST

2:30pm PST

3:00pm PST

3:00pm PST

3:00pm PST

3:30pm PST