Live data from Hacker News

Why isn't your API specification public?

apiful.io

21–30 of 30 posts

Re: Why isn't your API specification public?

#21
post #6

Not a single mention of the human element, which I will theorize is the main reason. Psychologically, looking at a formal specification is pretty intimidating. How many people do you know who enjoy sitting down with a cup of coffee/tea and their favorite time-worn leather-bound copy of RFC7231? Most developers I know love getting something to work. They love the feeling of having mastered something to the point that…

I agree with the argument: developers like reading web pages that describe how to use API, covering rationale of API design, gotchas, code samples. However, what if the specs were able to capture what is in such human-readable pages (for example https://docs.cloudant.com/ )? What if API spec could be automatically derived out of HTML pages? Embed some metadata in HTML page and then we have both cake (human-readable)…

GraphQL accomplishes this pretty well. Graphiql is a brilliant example of human and machine readable API documentation.

Re: Why isn't your API specification public?

#22

I think API owner need to see some value in publishing spec. And SDK generation, not a strong argument for publishing since it can be done on API owner side with more control and better quality. IMHO key component here is automatic integration, you simply publish a link to your spec and you magically have integration with a number of 3rd-party tools/services. I currently work on catalog which does exactly this, and y…

IvanGoncharov, you've done much work in this space in trying to innovate around Web APIs (thanks for that!).

I think realityking nailed it in terms of the API community needing to define compelling use cases. The catch 22 here is that it is hard for people to innovate around API specifications when they are so hard to get! Per the SDKs ... what if there was a NPM.org or rubygems equivalent of high quality SDKs that get automatically generated whenever I push a new API specification? That seems like it could be cool.

And your example of automated composition is fantastic! Curious if you are able to share how much work it is for you to get access to the specifications in order to make this possible? If we invented a common practice to publish something like api.company.com/spec.yaml could you have spent a lot more time on making cool integrations vs mining specs?

Re: Why isn't your API specification public?

#23

One of the things that striked me when I worked on my first API was that all of service registration, search, payments and certification incur a lot of overhead. Most of these problems are addressed by using third party platforms and middleware (for example Mashape + Kong). But this seems to restrict findability to this one platform and also introduces nontrivial dependencies and fees even for small projects. Therefo…

You blew my mind a little bit there ... so you're introducing the notion of a super light-weight subscription / payment system to sidecar the API specification itself? This something that would make sense with state-less services vs those requiring some investment by the service provider (i.e. some account with more backend overhead)?

Having the API specification cover more of the business/service aspects is very interesting (could you possibly define cost per call per endpoint or per payload size for instance).

Re: Why isn't your API specification public?

#24

One of the things that striked me when I worked on my first API was that all of service registration, search, payments and certification incur a lot of overhead. Most of these problems are addressed by using third party platforms and middleware (for example Mashape + Kong). But this seems to restrict findability to this one platform and also introduces nontrivial dependencies and fees even for small projects. Therefo…

You blew my mind a little bit there ... so you're introducing the notion of a super light-weight subscription / payment system to sidecar the API specification itself? This something that would make sense with state-less services vs those requiring some investment by the service provider (i.e. some account with more backend overhead)? Having the API specification cover more of the business/service aspects is very int…

Yes.

The only costs that would occur would be transaction fees for changing state in the Ethereum network (which is only required once for registering the service and at the order of half a cent at the current scalability level) and a similar amount for opening and closing the payment channels. I'm currently implementing a prototype extending http://hug.rest. If executed correctly, the following three lines of Python:

@hug.get("/pay_world", requires=pay("$0.001")) def pay_world(): return "You paid for this"

would result in the framework generating the OpenAPI spec amended with the payment metadata in the background and making it available under the service root. A middleware layer would check every ingoing request for payment signatures, closing the payment channel if necessary. Interesting things would become possible, although it is not clear if it all will succeed. Many different kinds of payment mechanisms would be conceivable, from pay-per-call to subscription based. Hypothetically, you could even pay APIs with gold backed cryptocurrency or tokens you issued yourself.

See here for a similar project and reasoning: https://github.com/etherapis/etherapis

Re: Why isn't your API specification public?

#25
post #12
post #6

Earlier quoted context omitted.

I agree with the argument: developers like reading web pages that describe how to use API, covering rationale of API design, gotchas, code samples. However, what if the specs were able to capture what is in such human-readable pages (for example https://docs.cloudant.com/ )? What if API spec could be automatically derived out of HTML pages? Embed some metadata in HTML page and then we have both cake (human-readable)…

That sounds very much like [API Blueprints]( https://apiblueprint.org/ ), which [Apiary]( https://apiary.io/ ) back. I tried to get the organisation I work for to standardise on them (being able to run tests from a versioned API specification seemed like a fantastic way to hit two birds with one stone), but sadly, couldn't convince enough people.

It also sounds like Swagger + OpenAPIs: https://openapis.org

Re: Why isn't your API specification public?

#26

I think API owner need to see some value in publishing spec. And SDK generation, not a strong argument for publishing since it can be done on API owner side with more control and better quality. IMHO key component here is automatic integration, you simply publish a link to your spec and you magically have integration with a number of 3rd-party tools/services. I currently work on catalog which does exactly this, and y…

IvanGoncharov, you've done much work in this space in trying to innovate around Web APIs (thanks for that!). I think realityking nailed it in terms of the API community needing to define compelling use cases. The catch 22 here is that it is hard for people to innovate around API specifications when they are so hard to get! Per the SDKs ... what if there was a NPM.org or rubygems equivalent of high quality SDKs that g…

Per the SDKs ...

If you've a Swagger/OpenAPI spec, you can use Swagger Codegen (https://github.com/swagger-api/swagger-codegen), a free and open-source project, to generate API clients (SDKs) in C#, Ruby, PHP, Java, ObjC, etc.

Here is an example: https://github.com/wing328/petstore-php

You can also use Swagger Codegen to generate server stub in SpringMVC, PHP Slim and more.

Disclosure: I'm a top contributor to Swagger Codegen.

(To convert RAML, API blueprint, WSDL, etc to Swagger/OpenAPI spec 2.0, please try https://github.com/lucybot/api-spec-converter - an open-source converter written in NodeJS)

Re: Why isn't your API specification public?

#27
post #7

I'm wondering if there's actually a widespread demand/need for public API specs. Contentful's API specification (in the blue print format) has been open for a while as a side effect of opening up our documentation. I'm not aware of any user ever using for anything but the generated documentation (and there have been bugs in the past that would have made things like generated test servers break quite nicely). What (po…

What do you think about automatic generation of client-code in various languages? With regards to the bugs, were they a result of the implementation and the specification getting out of sync? Would automatic means for creating / maintaining specs be able to help here?

Re: What do you think about automatic generation of client-code in various languages?

Swagger-Codegen (https://github.com/swagger-api/swagger-codegen) is a pretty mature, free and open-source project for generating API clients (e.g. ObjC, Java, C#, Ruby, Python, etc) and server stubs (e.g. PHP Slim, Java Spring, etc). Please give it a try and let us know your feedback by opening a ticket via https://github.com/swagger-api/swagger-codegen/issues

Disclosure: I'm a top contributor to the project.

Re: Why isn't your API specification public?

#28

Not a single mention of the human element, which I will theorize is the main reason. Psychologically, looking at a formal specification is pretty intimidating. How many people do you know who enjoy sitting down with a cup of coffee/tea and their favorite time-worn leather-bound copy of RFC7231? Most developers I know love getting something to work. They love the feeling of having mastered something to the point that…

The IETF's RFCs are hardly ever "formal". At best they have a formal grammar, but never a formal semantics.

And I disagree that formal specifications are intimidating. A formal specification is just code, so if you have trouble understanding something, you can enlist the computer's help. On the other hand, if an informal specification isn't clear to you, you are more or less screwed.

Re: Why isn't your API specification public?

#29
post #12

Earlier quoted context omitted.

That sounds very much like [API Blueprints]( https://apiblueprint.org/ ), which [Apiary]( https://apiary.io/ ) back. I tried to get the organisation I work for to standardise on them (being able to run tests from a versioned API specification seemed like a fantastic way to hit two birds with one stone), but sadly, couldn't convince enough people.

What were the reasons people brought up against doing this?

Mostly inertia. We're a large-ish company; I work in a remote office away from the majority of dev, and technical direction needs marketing.

We ended up using Swagger, which doesn't solve as many of our problems (having documentation generated from code isn't as robust from a testing POV, particularly when your RESTful API is versioned), but my "perfect" is the enemy of the company's "good" :).

Re: Why isn't your API specification public?

#30

I think API owner need to see some value in publishing spec. And SDK generation, not a strong argument for publishing since it can be done on API owner side with more control and better quality. IMHO key component here is automatic integration, you simply publish a link to your spec and you magically have integration with a number of 3rd-party tools/services. I currently work on catalog which does exactly this, and y…

IvanGoncharov, you've done much work in this space in trying to innovate around Web APIs (thanks for that!). I think realityking nailed it in terms of the API community needing to define compelling use cases. The catch 22 here is that it is hard for people to innovate around API specifications when they are so hard to get! Per the SDKs ... what if there was a NPM.org or rubygems equivalent of high quality SDKs that g…

> The catch 22 here is that it is hard for people to innovate around API specifications when they are so hard to get!

Yes, this is exactly the problem which I try to solve with my collection.

> Per the SDKs ... what if there was a NPM.org or rubygems equivalent of high quality SDKs that get automatically generated whenever I push a new API specification?

You can run the same tool on API owner side you don't need to publish your spec for that. I did a couple of interviews with API owner and they fear to loose control over SDKs, Docs, etc.

> Curious if you are able to share how much work it is for you to get access to the specifications in order to make this possible?

No, it's public info since my entire work is open-sourced under MIT license. I try to make process automatic as much as possible, so it starts from scraping. For example, I scrape Github for Swagger specs: https://morph.io/IvanGoncharov/API_specifications When I need to filter test, example, etc. APIs and find specs for real-life APIs. But get spec source is just first step, I need to fix errors in it(~80% have them), get additional info(logo, link to API key registration, etc.). But most time consuming is update them every day. My update/convert/validation scripts not ideal so I need to manually inspect all changes.

> ould you have spent a lot more time on making cool integrations vs mining specs?

Actually not I learn a lot from it, for example, you can fix all mistakes in API owner specs. Instead, you should give them a tool which will automatically inspect API spec and output errors/warnings/recommendations/hints. Together with my friend we working on OpenAPI/Swagger linter.

If you want to discuss more here is my Skype(ivangon4arov) and Hangouts(ivan.goncharov.ua@gmail.com) or APIs.guru public chat https://gitter.im/APIs-guru/api-models

Post reply on HN