API Masking/ API Routing Via SAP API Management: A Step by Step Guide

[HammadSharif1]

Introduction:
SAP API Management is one of the core capabilities of the Integration Suite, it is used for API Provisioning, API Security, Traffic Management, API Analytics and API Life cycle management. Its benefits include enhanced communication, increased agility, improved security and scalability. It provides a self-service portal to discover, test, and subscribe to APIs.

 

In this blog, we will discuss  API masking using SAP API Management by routing the API through an API management URL. This way, the consumer won't see the actual endpoint, and API Management will handle the communication with the backend service. In this way, we can ensure the direct access of the API is not exposed to the outside world, protection layer is in between which can be further protected with the endless possibilities through the API management policies although we have covered a basic understanding of this concept.

 
Pre-Requisites:

Below are the required prerequisites for this process,

1. Get access to SAP Integration Suite.

Reference Link: Integration Suite Capabilities 

2. Activate API Management capability of Integration Suite.

Reference Link: Activating and Managing Capabilities 

In this Blog, we will discuss how the API Masking is done using the SAP API Management,

We will use the API Proxy in order to implement the concept of API Masking via API Management. An API Proxy can be created through the below, we will create it via API Provider
1. Via API Provider
2. Via URL
3. Via API Proxy Itself

Procedure for API Masking:

Step 1:

Open SAP Integration Suite, go to Configure, and create an API Proxy.

Step 2:

Create an API Proxy as shown in the below screenshot,

Step 3:

Save and Deploy

Step 4:

Applying API Masking Policies:

Once Deployed, click on the policies, apply the APIKey Policy and use the below Code in order to validate the APIKey in the header request

Policy Code:

<VerifyAPIKey async='true' continueOnError='false' enabled='true' xmlns='http://www.sap.com/apimgmt'>
	<APIKey ref='request.header.APIKey'/>
</VerifyAPIKey>

Step 5:

Create a Product by giving a meaningful name as per your scenario,

Step 6:

Add the API to the Product:
Adding APIs to products helps in grouping them into logical bundles so it becomes easier to manage Bulk APIs. Along with this, policies, access controls and settings can be applied at product levels rather than managing them individually.

Step 7:

Save and Publish it, once the product is published, you can see it in the API Hub.

Step 8:

Assign the Product to the Application and get the APIKey for secured communication

Step 9:

Testing the API via Postman:

Once the API has been masked, you can invoke various resources within the same API by appending the appropriate endpoints to the base URL in accordance with your specific requirements. This allows you to retrieve a targeted dataset.

In the similar fashion, you can access specific entities like 'Products' or 'Employees' by appending their respective endpoints.

Conclusion

Implementing API masking via an API proxy in SAP API Management is a robust way to protect sensitive data in your APIs and hide the actual endpoint from consumers. By following the steps outlined in this guide, you can create a secure API proxy that masks sensitive information, ensuring compliance with data protection regulations and safeguarding user trust.

With SAP API Management, you can easily manage and secure your APIs, providing a scalable and flexible solution for API governance and security.

Additional Resources

For more information on SAP API Management and API masking, check out the following resources:

• SAP API Management Documentation
• SAP Community Blogs on API Management
• SAP API Management Tutorials

By leveraging these resources and following the steps in this guide, you'll be well on your way to mastering API masking in SAP API Management.