API World + CloudX + Dev Innovation Summit 2024

Live virtual demo and Q&A with Chris Petterson, VP of Solutions.

Budhaditya Bhattacharya, Tyk, Developer Advocate
Supreet Nagi, Northwestern Mutual, Assistant Director Systems Software Engineering

NorthWestern Mutual is one of the largest financial services providers in the United States with 5 million+ customers and 6700+ financial advisors. APIs are a core part of our business and are supported by a highly mature API platform engineering team.
In this case study, we learn how we combined seamless API creation and centralized governance using an automated workflow-based model to drive an exceptional DevX.
We will examine a combination of tools, such as K8S, KEDA, Jaeger, and OTel, that enabled the creation of our API platform, along with changes to people and processes.
What we will cover:
1. Key challenges when balancing API creation & governance at scale
2. Implementing an automated workflow-based governance model
3. Metrics of success & outcomes achieved
4. How to execute a similar API platform strategy using the platform engineering maturity model
Ultimately, this session provides real-world examples and insights into best practices for implementing this model within your company.

Tim Erlin, Wallarm, VP of Product

Securing modern applications requires new thinking. As the prevalence of application programming interfaces (APIs) increases, and the exponential increase in API calls grows, attackers are taking notice. Attackers have shifted their primary focus from web applications to APIs and most security teams haven’t adapted. Since APIs are inherently more exposed than traditional web apps, security teams must rebalance their efforts to ensure defenses are strongest where attacks are actually occurring. The session will cover:

Introduction to API Security Requirements
Cross-referenced API Security Best Practices
A Security Maturity Model for API Security
3 Ways to Close Remaining Security Gaps
Q&A

Gagan Kapahi, Optum, Sr. Principal Engineer and Director of Engineering

With proliferation of multi cloud, hybrid cloud, digital architectures and micro services, security and reliability of APIs has become very critical and important.

Majority of the organizations today spend a lot of time and resources on chasing the problem and the root cause.

With the right blend of synthetics and enhanced observability strategy, organizations can save huge amount of time chasing the problem and instead spend more time rolling out new features and problem solving.

Let's hear more from us on how this overall synthetics and observability strategy leads to improved user experience (UX) and digital outcomes.

Sterling Chin, Postman, Senior Developer Advocate

Sterling presents a comprehensive playbook for navigating the AI API landscape, which has been rapidly evolving since the AI revolution began in late 2022. We'll explore how APIs have become the cornerstone of AI accessibility and implementation across industries.

Attendees will gain actionable insights on how to implement and maximize the potential of AI APIs in their organizations. This playbook approach will equip participants with the knowledge to make informed decisions, overcome common challenges, and stay ahead in the rapidly advancing field of AI.

Whether you're new to AI implementation or looking to optimize your current strategies, this talk will provide valuable, real-world guidance for harnessing the power of AI through APIs.

You'll Learn:
1. How to evaluate AI APIs
2. Open Source or Close Source?
3. How to create a playbook on implementing AI APIs in your products

In this demo, we’ll showcase how to secure APIs using Auth0 Fine-Grained Authorization (FGA). As modern applications require more sophisticated access control, traditional methods like role-based access control (RBAC) can fall short. Auth0 FGA provides a more flexible and scalable solution by enabling developers to define and enforce granular permissions and policies.

We’ll walk through the process of setting up Auth0 FGA to protect your APIs, demonstrate key concepts, and show how to implement dynamic, relationship-based access controls. By the end of this demo, you’ll have a clear understanding of how to secure your APIs using Auth0 FGA while delivering a seamless user experience

Booth #606

Improve API quality and remediate errors with a GenAI API Assistant
Hunter Kouchi

Vishal Motwani, Numbers Station AI, Founding Product Manager

Unlock the power of AI in data analytics with Numbers Station's bespoke platform. Join Vishal Motwani, Founding Product Manager of Numbers Station, and uncover how Large Language Models (LLMs) are revolutionizing production-level data workflows. 

Via a multi-agent architecture and embeddable API, Numbers Station is built to seamlessly integrate with your existing knowledge sources—dashboards, databases, APIs, dbt, query logs and more. Numbers Station’s AI agents actively search, query, analyze, and take it two steps further—suggesting the next best action and automating downstream tasks in real-time.

Whether you're looking to embed Generative AI into legacy systems or elevate your organization's data capabilities, this session offers a glimpse into the future of AI-powered analytics that won't disrupt your current infrastructure. Don't miss this opportunity to supercharge your data strategy!

Gaganjot Kaur Kang, Sony Interactive Entertainment, Software Engineer

This session is geared towards equipping software engineers, technical managers, and business owners with an in-depth guide to optimizing API performance. Attendees can expect the following key takeaways:

- Explore fundamental principles and top practices to grasp the importance of API performance optimization.
- Acquire knowledge of API architecture patterns through real-world examples, aiding in the development of data-intensive applications.
- Discover strategies for bolstering the speed, scalability, and reliability of APIs.

Ken Huang, DistributedApps, CEO and Chief AI Officer

This presentation introduces a comprehensive framework for testing and validating the security of generative AI applications, particularly those built on large language models (LLMs). Developed by Ken Huang (the Speaker) and World Digital Technology Academy's AI Safety, Trust, and Responsibility (STR) working group, the framework addresses the new attack surfaces and risks introduced by generative AI.

The standard covers the entire AI application stack, including base model selection, embedding and vector databases, prompt execution/inference, agentic behaviors, fine-tuning, response handling, and runtime security. For each layer, it outlines specific testing methods and expected outcomes to ensure AI applications behave securely and as designed throughout their lifecycle.

Key areas of focus include model compliance, data usage checks, API security, prompt injection testing, output validation, and privacy protection. The framework also addresses emerging challenges like agentic behaviors, where AI agents autonomously perform tasks based on predefined objectives.

Aman Sardana, Discover Financial Services, Senior Principal Application Architect

Have you ever wondered what it takes to create resilient and highly available platform services that support mission-critical software systems? Please join me to find out how you can set the right strategy and foundational architecture for building platform services that businesses can trust for their most critical workloads.

Payment systems that support real-time transaction processing are expected to be highly available and highly responsive 24/7/365. These systems must be fault-tolerant and resilient to any failures that might happen during payment transaction processing.
Mission-critical payment systems with distributed architecture often depend on platform services like distributed caching, messaging, event streaming, databases, etc. that should be independently designed for high availability and fault tolerance.
In this talk, I’ll share the approach we took for architecting and designing platform services within the payments domain that can be applied to any domain that supports business-critical processes. This methodological approach starts with establishing a capability view for platform services and then defining the implementation and physical views. You’ll also gain an understanding of other aspects of platform services like provisioning, security, observability, testing, and automation that are important for creating a well-rounded platform strategy supporting business-critical systems.

Harsh Sharma, Shell, Associate Software Engineer

How to build API/Interfaces using Azure Integration Services like logic App, APIM, Service Bus, Function App.
 

Management capabilities to Traefik OSS in seconds.

No rip and replace. No learning curve. All awesome.

Speaker: Shaun Empie, Principal Solutions Architect

Sumeet Kumar Agrawal,  Informatica, Vice President Product Management

As GenAI adoption accelerates, enterprises are increasingly turning to low-code and no-code API development to democratize access and spur innovation. However, deploying GenAI applications within large organizations poses unique challenges, including a shortage of skilled resources, navigating complex enterprise data landscapes, staying relevant with rapidly evolving GenAI models and frameworks, and the difficulty of scaling AI projects beyond proof of concept.
Join us for an insightful session where we explore overcoming these challenges with a GenAI-powered integration API solution. We will discuss strategies to democratize GenAI across various user personas, contextualize its use for future-proofing, create LLM agnostic GenAI orchestrations, and achieve enterprise-grade scalability. Learn how to leverage the right data management tools to build successful GenAI apps that are easy to use, grounded with high-quality and trusted enterprise data, and protected from bias and privacy breaches.

Brett Bush, LogicGate, Staff Software Engineer: Platform

Within API-First development, a dichotomy has formed: Code-First or Design-First. Are these approaches destined to be adopted in polarized isolation, or rather, are they equally valid phases of a healthy API development cycle? This presentation will reveal a new way to visualize the cyclical nature of Code-First and Design-First API development, discuss parallels to Test-Driven development, and explore the benefits unlocked from leveraging both methodologies in tandem. 

Michael Kwan, Broadcom, Architect

Quantum computing seems like a distant-future technology, but if you consider the pace of enterprise modernization, the quantum threat may be just around the corner - and APIs are a primary target. When is Q-day exactly? Nobody knows yet, but equally unknown is the scale of the corrective measures that will be required of your API infrastructure.

In this presentation you will learn:
- How quantum computing introduces a new security risk
- What is the API-specific exposure associated with this threat
- How and when do you need to start preparing your APIs
- What will be the costs in terms of computing resources and API retrofit projects
- What we are learning from post-quantum API security research and initial tests so far

Parth Shah, Cruise, Staff Software Engineer
Bianca Tamayo, Cruise, Staff Software Engineer

In today's micro services world, it is far too common for an API service to explode at an unbounded rate. The journey starts off as a shiny new micro service, which was designed to contain APIs for 1 business entity, becoming so heavily utilized that over time, it evolves and turns into a massive monolith, which contains hundreds of APIs for dozens of business entities. In the early days, new features could be introduced and rolled out within a few hours. Now, a small database schema change takes a few days or weeks to roll out. In this madness, how do you effectively and efficiently decompose and modernize your monolith? This session goes over a real world case study of how a group of 5 engineers decomposed a 160+ API monolith into smaller and focused micro services with 0 outages, 0 downtime, increase in overall service availability from 99.9% to 99.999%, decrease in latencies from 15% to 95% and ability to handle 90x more traffic with a reduced resource footprint (68% reduction in compute and 55% reduction in memory).
 

Cameron Delano, F5, Sr Strategic Architect 
Corey Ball, Moss Adams, Senior Manager - Penetration Testing

F5 secures and optimizes traffic for some of the largest AI projects in the world, and organizations are planning to spend an average of 18% of 2025 IT budgets on AI implementation.
What many are missing is that outside of a few edge cases, nearly all training, usage, attacks, and data loss against AI models come through APIs, and APIs themselves expose critical information about models such as data labels and confidence scores, facilitating model theft, transfer attacks, and other issues unique to securing LLMs.
In this session, we’ll talk about the ties between AI security, APIs, and how to structure a Defense in Depth architecture to secure your AI factory and models from the beginning, rather than after the fact.

Shashank Ashtikar, M9, Co-Founder & CTO

With the viral adoption of AI driven by commercially available LLMs newer venues of business have opened up. These new business models are driven by the likes of Co-pilots and virtual agents that bring in tremendous productivity gains across business workflows. Concepts like Generative AI and Conversational AI have already gained mainstream popularity. A new branch of AI that is gaining momentum is that of Agentic AI. This talk is geared towards identifying mechanisms that make inter-agentic communication possible and the ontology of such interactions solving for needed concepts of roles, tasks, memory, tools, context and prompts for a scalable and reliable inter-agentic business workflow.
 

Todd Little, Oracle, Chief Architect Oracle Transaction Processing Products

Microservices are currently the architecture du jour for building cloud native applications. This session will describe how microservices, each with their own database, can work together to ensure the data they maintain is consistent with the databases of other microservices.
Deciding on a pattern to guarantee data consistency is dependent upon many factors. This session will describe some of those factors and provide practical solutions to ensuring data consistency across a broad range of microservices.
At the completion of this session, attendees should understand that it's more important to determine the context and requirements for their application than just going with the current mantra. Hopefully this will lead them to consider simpler design patterns that have been discarded for no other reason than someone decided they're an anti-pattern.

Ed Olson-Morgan, Marsh McLennan, Core API & Innovation Lead

Driving value from generative AI isn't just about large language models. Integrating them with the right data, services and supporting capabilities through APIs is just as important.

Learn how Marsh McLennan's Generative AI Services project built an API-based environment to nourish AI experimentation and underpin AI impact through production applications serving their 90,000 employees as well as a world-wide client base.

Akash Bhaskar, Cisco, Software Architect

This technical session will demonstrate software and configuration compliance use cases through CI/CD pipelines on network devices. A fully functional Jenkins pipelines will be discussed including tools and concepts like code management, artifact management, orchestration, testing.

Based on the concepts and tools mentioned in this session, network engineers can quickly build their own pipelines and take advantage of well tested approach in their network operations. The session will be tool independent where a certain concept will be introduced along with potential tool.

Brenton House, IBM, Principal Cybersecurity and AI Advisor

Generative AI has revolutionized the tech world in the past months. With its insatiable thirst for data, all eyes have turned to APIs and the security (or lack of) protecting them. Large data breaches have become so common that security researchers are overwhelmed with the terabytes of leaked data finding its way to the Dark Web. Learn both the ugly secrets behind cyber threats and the successful strategies used to stop them.
 

Dominik Rampelt, APICHAP, CEO & Co-Founder

Artificial Intelligence is rapidly transforming every facet of our lives, including the way we approach API development. In this talk, we will explore the profound impact AI will have on developers and the necessary steps to harness its full potential. The future of API development will focus heavily on an API-Contract First approach, where developers become architects defining APIs and data flows. The implementation will then be assisted by various AI tools.

Join us to discover how tools like APICHAP enable developers to implement APIs for your services and integrate with any datasource in just a few seconds. Learn how to leverage the power of AI in your daily development work. In the future, the best API developers won't just write code—they'll design the blueprint for AI to follow.  

Amol Gote, Innova Solutions, Solutions Architect

In the evolving landscape of financial services, implementing a cash flow underwriting system aims to expand credit access and enhance risk assessment. This session will cover an approach that leverages open banking, machine learning, and dynamic underwriting rules to provide creditworthiness evaluation beyond traditional credit scoring methods. It will cover the case study of iCreditWorks - a Fintech organization where this pattern was implemented.

The system consists of four critical components:

(1) A financial data aggregator to securely link customers' bank accounts, utilizing open banking APIs and traditional integration techniques.

(2) Collaboration with a specialized partner that employs machine learning models to analyze transaction data, generating a comprehensive cash flow score and identifying verifiable income.

(3) Developing and implementing underwriting rules that integrate the cash flow score and income data to make informed lending decisions.

(4) The seamless integration of these components into a mobile application and backend infrastructure, ensuring a user-friendly experience and efficient loan application processing.

This session discusses the cash flow underwriting system's design, implementation, and strategic significance. It highlights its potential to extend credit access by surpassing traditional credit scores and opening new avenues for financial inclusion and risk assessment. It also introduces a technical implementation approach for cash flow underwriting by integrating multiple services and using open banking for bank account linking for transaction data.

Amit Chauhan, Yugabyte, Principal Engineer

The infrastructure of major cloud providers and private data centers spans countries and continents. This makes it possible to build multi-region microservices that serve user requests with low latency from nearly anywhere, tolerate all sorts of possible outages, and comply with data regulatory requirements.

This hands-on session introduces you to design patterns for building scalable and fault-tolerant microservices that span distant locations. You'll learn the patterns by building a sample microservices. We'll start with a traditional single-region configuration and then switch to a multi-region setting. In the end, we'll have a working prototype of an microservices that handles user traffic with low latency in North America, Europe, and Australia.

We will make a fully functional, production-ready API for a SQL database in less than 15 minutes.

It comes with a policy based access control for queries and mutations!

Bring your own SQL database or use our demo database to follow along.

Vamsi Ravula, Red Hat, Developer Advocate
Hugo Guerrero, Red Hat, Sr Principal Developer Advocate

Locationless API management is a paradigm shift in API governance and security. This innovative approach allows organizations to efficiently manage their APIs distributed across multiple clouds and clusters without exposing them publicly over the internet. Instead, it leverages a sophisticated layer seven service network, offering a secure and seamless solution for API management. By operating locationless, businesses can maintain a high degree of control and privacy over their APIs, mitigating the risks associated with public exposure while facilitating efficient communication between services across diverse deployment environments.

A Layer 7 service network provides the necessary infrastructure to establish secure connections between services, regardless of location. Through this network, APIs can be efficiently managed and accessed within a controlled environment, ensuring that sensitive data and functionalities remain protected. This locationless API management approach not only enhances security but also streamlines operations, as it minimizes the complexities of public-facing API management. As organizations continue to prioritize data privacy and security, locationless API management, powered by technologies like a Layer 7 service network, emerges as a game-changing solution that empowers businesses to securely manage and utilize their APIs without the need for public internet exposure.

Derric Gilling, Moesif, CEO

A discussion on what are healthy metrics foryour developer program and ways to improve like Time to First Hello World (TTFHW) and integration rate. What does it mean to build a good Developer Experience and some tips on where you can improve. 

Pamela Deason, Marketing Manager for Broadcom with draw a name to receive a Soarington Drone!

Ayesha M. Ali, Metavisionaries, Co-Founder / Creative Director

This session will explore the transformative potential of APIs in the realm of Fusion Tech Art and interdisciplinary content creation. Emphasizing the integration of frontier technologies such as Artificial Intelligence (AI) and Machine Learning (ML), we will discuss how APIs serve as the vital connectors enabling seamless communication and collaboration across diverse creative fields. Participants will gain insights into how APIs facilitate innovative approaches that merge art, technology, fashion, and more.
Objectives:
• Introduce the Concept of Fusion Tech Art: Explain the importance and impact of Fusion Tech Art in the modern digital and creative industries.
• Highlight the Role of APIs: Discuss how APIs act as the backbone of integrating AI, ML, and various creative disciplines.
• Demonstrate Practical API Integration Techniques: Showcase new interdisciplinary approaches enabled by APIs and practical techniques that can be adopted by entrepreneurs and creatives.
• Case Study: Present a detailed case study of my project sent to space in collaboration with NASA and SpaceX, illustrating the power of API-driven integration.
• Ethical and Sustainable Practices: Address the ethical considerations and sustainability issues related to API-driven AI and tech projects, both on Earth and in space.
Session Outline:
1. Introduction to Fusion Tech Art:
• Definition and significance of Fusion Tech Art in contemporary creative practices.
• Overview of how APIs enable the integration of AI, ML, and other technologies into creative projects.
2. Current Landscape of Frontier Technologies:
• In-depth look at the latest developments in AI, ML, and their applications through APIs.
• Examples of cutting-edge tools and platforms that utilize APIs for interdisciplinary integration.
3. Seamless Interdisciplinary Techniques through APIs:
• Step-by-step guide on adopting an interdisciplinary approach using APIs.
• Demonstration of API functionalities that enable the merging of art, technology, fashion, and other fields.
4. Case Study: Art Project to Space via APIs:
• Detailed narrative of my project sent to the International Space Station (ISS) with NASA and SpaceX, focusing on the API integrations that made it possible.
• Insights into the creative process, collaboration, and execution of the project.
• Lessons learned and tips for aspiring creatives and entrepreneurs on leveraging APIs.
5. Ethics and Sustainability in API-Driven Fusion Tech Art:
• Discussion on the ethical implications of using APIs in AI and content creation.
• Sustainability discourse and its importance in tech-driven projects.
• How to ensure responsible and sustainable practices when utilizing APIs in creative projects.
Target Audience:
• API developers and technologists interested in the creative applications of their work.
• Artists and designers looking to integrate technology into their projects using APIs.
• Entrepreneurs and creatives seeking innovative interdisciplinary approaches.
• Educators and students in the fields of art, technology, and design.
Expected Outcomes:
• Increased awareness and understanding of Fusion Tech Art and the role of APIs in enabling it.
• Practical knowledge of API-driven tools and techniques for merging diverse creative disciplines.
• Inspiration from real-world examples and successful case studies.
• A framework for ethically and sustainably implementing API-driven AI and tech in creative projects.

Jeremy Snyder, FireTail.io, CEO and Founder

To start off, Jeremy will summarize key points and findings from extensive research into the API security landscape in 2024 with a look at our growing reliance on APIs and how APIs are increasingly being used as an attack surface.

Then, he’ll go over statistics on API proliferation and recap key developments from 2023, including the OWASP Top 10 Update 2023 and the impact AI is having on API security. He will pay particular attention to the massive expansion of API calling capabilities that came via recent OpenAI Updates and the overall impact of AI on API security.

Jeremy will then look at increasing regulatory oversight, the current shift toward personal accountability for CISOs and what this means for cyber security against a backdrop of increasingly sophisticated API attacks.

Jeremy will present real-world examples and show what we can learn from them, while drawing on data from a decade of data breaches, including notable cases like Points.com, moveIT, Money Lover and bugs in West Bengal and Rajasthan government websites, as well as others.

Jeremy will analyze API breaches by primary and secondary attack vectors and compare these findings to what we witnessed in 2023.

Finally, this talk will provide the actionable insights and practical advice needed to help you implement effective API security strategies across your organization. Jeremy will cover the 6 pillars of API security needed for companies to secure their APIs, as well as guidance on implementing authentication, authorization, input validation, encryption, and regular security assessments.

Overall, this talk will emphasize the importance of API security, summarize findings from the last 12 months, explore the trends we’re seeing in cyber security and make predictions for the rest of 2024, as well as providing recommendations and tips for improving cybersecurity postures.