Mashery brews service for managing APIs

With APIs increasingly serving as a mechanism to enhance Web applications, Mashery has developed an on-demand service that provides management infrastructure and community building tools for API developers.

Mashery's beta service, launching this week, includes API access control, rate limiting, usage tracking and metrics, interactive documentation, developer key assurance and community development tools, such as blogs, documentation, forums, wikis and about pages.

According to Oren Michels, CEO of Mashery, most developers publishing APIs are not focused on creating infrastructure around their exposed Web services. Mashery isn't going to replace what the Web giants, such as Yahoo, EBay, Google and Amazon, have in place, but there are thousands of developers with APIs who don't want to build the infrastructure and tools required to deliver services and build developer communities.

"Developers have single sign-on and a consistent user experience, and Mashery can be skinned to look like whatever site, within some constraints," Michels said. FreeMash provides the basic community and documentation platform to approved developers, who can submit anything from complex APIs to data feeds, for free. Fee-based ProMash charges vendors for managing access, controlling APIs and receiving advanced usage stats. "The idea is that running a full-on developer program with access and control to APIs will be in the neighborhood of quarter of an full-time employee, $10,000 to $15,000 per year," Michels said. 

 
Mashery provide API reports with API and developer usage statistics

Mashery support two forms of rate limiting for each API it manages, Michels said. "First, the API vendor specifies how many calls per second they are willing to accept from a particular developer key to avoid a particular developer overloading the API from a burst of activity. If they exceed that rate, they will receive an HTTP/1.1 403 error ('Forbidden - Over rate limit') until the next second begins," Michels explained. "Secondly, the API vendor specifies how many calls each developer key can make over a predetermined period of time--generally a day or a month, but it is configurable. If they exceed that, it is up to the vendor to determine how we handle it. We can allow the traffic but notify the API provider and the developer, we can return a 403 error or we can create a notification, but allow the overage up to a certain higher level. In a future release, we will include the option to accept traffic up to a certain level for free, but to charge for access that exceeds the 'free' limit."

The Document dashboard page shows the comprehensive management of documents, wiki, blog, forum, static ("custom") pages and comments across all of those areas through a consistent user interface.

A startup with six full-time employees, a few contractors and some early stage funding, Mashery is running its service on Amazon's EC2 and S3 on demand platform. "The worst case scenario using a CPU instance full-time is $100 per month, which is cheaper than a dedicated server. Also, bandwidth between EC2 and S3 is free," Michels said. Mashery plans to raise money to build out more of an enterprise-class product, with additional security and reports, Michels said.