Resource security integration platform

Abstract

A resource security integration platform can be configured to establish API integration between software applications and various APIs. The security platform can be configured to register with multiple APIs for authorization in order to communicate with those APIs, so that the source application itself does not need to authenticate the API or communicate with the API. A source request is received from a source system, including an indication of a resource and the address of an application programming interface of a destination system. A definition of the application programming interface is determined based on the address. The definition is used to obtain authorization for accessing the destination system. Then, an interface request message is generated and sent to the destination system using the authorization. An interface response message is received from the destination system, and response data based on the interface response message is sent to the source system.

Description

Technical Field

[0001] The present invention relates to data requests from a source system to a destination system, and more particularly to the integration of application programming interface (API) requests in a secure platform. Background Art

[0002] In many cases, software applications interact with each other to perform efficient data processing without duplicating code and work. There are several integration technologies that can be used to establish communication between separate applications. For example, developers of software applications can use application programming interfaces (APIs) to utilize the capabilities of other applications using request and response messaging. Accessing an API requires software developers to determine the input parameters of the API, such as a uniform resource locator (URL), an authentication mechanism, the hypertext transfer protocol (HTTP) method used, content type, request body requirements, and other parameters. Each different API provided by different destination systems or service providers may require input parameter information. In addition, each service provider may use different authorization mechanisms and needs to register with an authorization server. Therefore, designing software applications that access various APIs can be difficult and time-consuming.

[0003] As described further below, the present disclosure addresses these and other problems. Summary of the invention

[0004] One embodiment provides a computer security system, which includes one or more processors and one or more machine-readable media. The one or more machine-readable media are coupled to the one or more processors and store computer program codes, which include instruction sets that can be executed by the one or more processors. The instructions are executable to receive a source request from a source system, the source request including an indication of a resource and an address of an application programming interface of a destination system. The instructions are also executable to obtain a definition of the application programming interface based on the address. The instructions are also executable to obtain authorization for accessing the destination system using the definition of the application programming interface. The instructions are also executable to generate an interface request message based on the indication of the resource, the address of the application programming interface, and the definition. The instructions are also executable to send the interface request message to the destination system using the authorization. The instructions are also executable to receive an interface response message from the destination system. The instructions are also executable to send response data based on the interface response message to the source system.

[0005] Another embodiment provides one or more non-transitory computer-readable media storing computer program codes including sets of instructions. The computer program codes include instructions for receiving a source request from a source system, the source request including an indication of a resource and an address of an application programming interface of a destination system. The computer program code also includes instructions for obtaining a definition of the application programming interface based on the address. The computer program code also includes instructions for obtaining authorization for accessing the destination system using the definition of the application programming interface. The computer program code also includes instructions for generating an interface request message based on the indication of the resource, the address of the application programming interface, and the definition. The computer program code also includes instructions for sending the interface request message to the destination system using the authorization. The computer program code also includes instructions for receiving an interface response message from the destination system. The computer program code also includes instructions for sending response data based on the interface response message to the source system.

[0006] Another embodiment provides a computer-implemented method. The method includes receiving a source request including an indication of a resource and an address of an application programming interface of a destination system from a source system. The method also includes obtaining a definition of the application programming interface based on the address. The method also includes obtaining authorization for accessing the destination system using the definition of the application programming interface. The method also includes generating an interface request message based on the indication of the resource, the address and definition of the application programming interface. The method also includes sending the interface request message to the destination system using the authorization. The method also includes receiving an interface response message from the destination system. The method also includes sending response data based on the interface response message to the source system.

[0007] The following detailed description and accompanying drawings provide a better understanding of the nature and advantages of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 A diagram of a security platform in communication with a source system and a destination system is shown according to an embodiment.

[0009] Figure 2 A flow chart of a computer security method according to an embodiment is shown.

[0010] Figure 3 A diagram of a resource security process according to an embodiment is shown.

[0011] Figure 4 A diagram showing components of a resource security integration platform according to an embodiment is shown.

[0012] Figure 5A diagram showing hardware of a special purpose computing machine for implementing the systems and methods described herein is shown. DETAILED DESCRIPTION

[0013] In the following description, for the purpose of explanation, many examples and specific details are set forth in order to provide a thorough understanding of the present disclosure. Such examples and details should not be interpreted as overly limiting the elements of the claims or the subject matter claimed as a whole. It is clear that, based on the language of different claims, the subject matter claimed may include some or all of the features in these examples, alone or in combination, and may also include modifications and equivalents of the features and techniques described herein.

[0014] As described above, developers of software applications can use application programming interfaces to leverage the capabilities of other applications using request and response messaging. Accessing an API requires the software developer to determine the input parameters of the API, such as a uniform resource locator (URL), authentication mechanism, hypertext transfer protocol (HTTP) method, content type, request body requirements, etc. Such information may be required for each different API provided by various destination systems or service providers. In addition, each service provider may use a different authorization mechanism and need to register with an authorization server. Therefore, designing software applications that access various APIs can be difficult and time-consuming.

[0015] The present disclosure provides a resource security integration platform (referred to as a "security platform") to solve the above and other problems. The security platform can be configured to establish API integration between software applications and various APIs. The security platform can be configured to register with multiple APIs for authorization in order to communicate with those APIs, so that the source application itself does not need to authenticate the API or communicate with the API. The features and advantages of the security platform include enabling the source application to authenticate with a single security platform, rather than authenticating with multiple API platforms separately. In addition, the security platform reduces the complexity of API integration by being configured to receive simplified metadata information from the source application and using the metadata information to generate complex (complex) API requests to the destination system based on API definition information. The features and advantages of the security platform also include enabling software developers to design simple metadata requests for use with the security platform, rather than generating complete API request messages. The security platform also provides scanning and monitoring of API requests to prevent the disclosure of sensitive data, business / personal contact details and other private information. Further details of the security platform are described below.

[0016] Figure 1Diagram 100 shows a security platform 130 in communication with a source system 120 and a destination system 170 according to an embodiment. The security platform 130 may also communicate with an authorization system 180. The security platform 130 may communicate with the source system 120, the destination system 170, and the authorization system 180 through one or more communication networks (e.g., the Internet).

[0017] The source system 120 includes a source application 111, which is designed to consume resources obtained from a destination application 171 of the destination system 170. The source application refers to an application that uses the security platform 130 to access the target API of the destination system 170. The source system 120 can be a computer device or a system of one or more computer devices. For example, the source system can be a desktop computer, a laptop computer, a smart phone, a tablet computer, a wearable device, or other computing devices.

[0018] The security platform 130 may be configured to handle authorization for accessing the destination system 170 and the generation of API requests made to the destination system 170. Thus, the source system 120 may not need to be configured to perform API requests and authorizations for itself. In addition, the source system 120 may not need to generate a complete API request including all information required as input parameters for the API. Instead, the source system 120 may generate simplified metadata 112 for the API request. The metadata 112 may include the name or indication of the requested resource, the URL of the destination application 171, the authorization type of the API (e.g., none, access token, SAML, or JWT), any additional headers for the API request, methods (e.g., GET, POST, PUT, DELETE, or PATCH), and any data or hooks used. The source system 120 may be a computer device or a system of one or more computer devices. For example, the source system may include one or more server computers.

[0019] The security platform 130 includes a controller 121 configured to read a metadata file 112 provided by the source system 120. The controller 121 can be configured to start an authentication manager 122 to establish a connection with a target API at a destination system 170 (e.g., an API of a destination application 171). The controller 121 can be configured to trigger a request builder 123 to build a request header / payload. The controller 121 can send the request to the destination system 170 (e.g., a target API of a destination application 171). As further described below, the request can pass through a secure tunnel provided by the security platform 130.

[0020] The destination system 170 may be configured to provide access to its destination application 171 based on an API. The destination system 170 may also provide definitions of APIs that may be accessed by the security platform 130 and other computing devices. The destination system 170 may be a computer device or a system of one or more computer devices. For example, the source system may include one or more server computers.

[0021] The authorization system 180 can provide access to the destination system 170 based on registration and authentication with the authorization system 180. In some embodiments, the destination system 170 can handle authorization instead. The security platform 130 can register with the authorization system 180 and perform authentication with the authorization system 180 on behalf of the source system. The authorization system 180 can be a computer device or a system of one or more computer devices. For example, the source system can include one or more server computers.

[0022] Features and advantages of the security platform are further described below.

[0023] Figure 2 A flowchart 200 of a computer security method according to an embodiment is shown. The computer security method may be performed by the resource security integration platform described herein. Unless otherwise specified, the steps of the computer security method may be performed in an order different from the order described.

[0024] At 201, the computer security method may receive a source request from a source system, the source request including an indication of a resource and an address of an application programming interface of a destination system. The destination system may provide the resource using an application programming interface. The address may be a URL of the destination system. The indication of the resource may be a name or identifier of a specific API resource. For example, the source request may be formatted using JavaScript Object Notation (JSON).

[0025] At 202, the computer security method can obtain a definition of an application programming interface based on the address. The definition information can be formatted as a swagger file. The definition of the API can indicate, for example, API methods, content types, formats, payload templates, and header information.

[0026] At 203, the computer security method can use the definition of the application programming interface to obtain authorization for accessing the destination system. For example, the authorization can be an access token.

[0027] At 204, the computer security method can generate an interface request message based on the indication of the resource, the address, and the definition of the application programming interface. The request message can be a complete API request message that satisfies the requirements of the API of the destination system.

[0028] At 205, the computer security method can send the interface request message to the destination system using authorization. For example, the authorization can be based on "oAuth" or "base64" authentication.

[0029] The computer security method can receive an interface response message from the destination system at 206. The response message can include information generated or obtained by the destination system in response to the request message.

[0030] The computer security method may send response data based on the interface response message to the source system at 207. Thus, the source system may access an API provided by the destination system without directly communicating with the destination system.

[0031] In some embodiments, the computer security method may send a second interface request message based on the first interface response message, thereby linking the interface requests together. In such embodiments, the indication of the resource may be a first indication of the first resource, and the address of the application programming interface of the destination system may be a first address of the first application programming interface of the first destination system.

[0032] In such an embodiment, the source request also includes a second indication of the second resource and a second address of the second application programming interface. And, the interface response message from the destination system can be a first interface response message. The computer security method can also generate a second interface request message based on the first interface response message, the second indication of the second resource, and the second address. The computer security method can also obtain a second interface response message based on the second interface request message. The response data sent to the source system can also be based on the second interface response message. Therefore, the interface responses have been linked together.

[0033] In some embodiments, a computer security method may scan interface request messages based on one or more security policies.

[0034] In some embodiments, the computer security method can use the stored authorization information to send an access request to an authorization server. In such embodiments, obtaining authorization for accessing the destination system is based on the access request.

[0035] In some embodiments, the computer security method can authenticate the source system based on authentication information included in the source request. In such embodiments, the source request can include the authentication information.

[0036] In some embodiments, the computer security method may register with an authorization system prior to receiving a source request, and authorization for accessing the destination system may be obtained from the authorization system.

[0037] In some embodiments, the source request includes a definition of an application programming interface.

[0038] Figure 3 A diagram 300 of a resource security process according to an embodiment is shown. The process includes a source system 320, a resource security integration platform ("security platform") 330, a destination system 370, and an authorization system 380. Figure 3 The security platform 330 may be configured similarly to the above Figure 1 security platform 130. Figure 3 The source system 320 may be configured similarly to the one discussed above. Figure 1 The source system 120. Figure 3 The destination system 370 may be configured similarly to the Figure 1 Destination system 170. Figure 3 The authorization system 380 may be configured similarly to the one discussed above. Figure 1 Authorization system 180.

[0039] At 301, source system 320 generates API metadata and sends it to security platform 330. The format and structure of API metadata is further described below.

[0040] At 302, the security platform 330 uses the authentication information included with the API metadata to authenticate the source system. For example, an x509 certificate or another type of digital certificate can be used to perform authentication. An X509 certificate is a standard digital certificate that helps identify users, applications, services, etc. The certificate can contain a serial number, version, algorithm (the cryptographic algorithm used to sign the certificate), certificate authority (CA) name, and validity. Using certificates for authentication helps protect data from man-in-the-middle (MitM) attacks. The author of the application can contact his / her organization's CA to issue a digital certificate or issue a digital certificate through other mechanisms by using a programming language library to generate a public key, a private key, and sign a digital certificate.

[0041] At 303, the security platform 330 requests API definition information from the destination system 370. The definition information can be formatted as a swagger file. Typically, today's API definitions use swagger files to expose API methods, content types, formats, payload templates, header information, etc. The definition information can be maintained in the repository of each application. The security platform 330 can access the file and extract the API definition. For older APIs, the security platform 330 can provide a window for the source system 320 to manually add the API definition file.

[0042] At 304 , the destination system 370 provides the API definition information to the security platform 330 .

[0043] At 305, the security platform 330 registers with the authorization system 380. However, in most cases, this step may not be performed because the security platform 330 has previously registered with the authorization system 380 and may not need to re-register. At 306, the authorization system 380 registers the security platform.

[0044] At 307, the security platform 330 requests an access token from the authorization system 380. At 308, the authorization system 380 authorizes the security platform and generates a token. The security platform 330 then obtains the access token from the authorization system 380. As described further below, the authorization process may be performed by an authorization manager.

[0045] At 309, the security platform 330 generates an API request. As described further below, the API request is generated by a request builder.

[0046] At 310, security measures are applied by security platform 330. As described further below, security measures may be applied using a secure tunnel.

[0047] At 311, the security platform 330 sends the API request to the destination system 370. At 312, the destination system 370 provides an API response, and the security platform 330 obtains the API response.

[0048] At 313, the security platform 330 provides response data to the source system 320 based on the API response. At 313, the source system 320 obtains the API response. This process is advantageous for the source system 320 because it does not need to register or authenticate with the authorization system 380, and it only needs to provide metadata to the security system instead of generating a complete API request.

[0049] Reference below Figure 4 Further describe the functionality of the security platform.

[0050] Figure 4 Diagram 400 shows components of a resource security integration platform 430 according to an embodiment. Source system 420 and security platform 430 may be configured as described above. API 1 471, API 2 472, and API 3 473 may be configured similarly to the destination system described above. Figure 4 The security platform 430 may be configured similarly to the above Figure 1 Security platform 130 and Figure 3 Security platform 330. Figure 4 The source system 420 may be configured similarly to the above Figure 3 The source system 320 and Figure 1 The source system 120. Figure 4 The authorization server 480 may be configured similarly to the above Figure 3 Authorization system 380 and Figure 1 The authorization system 180. API (1-n) 471, 472, 473, 479 can be used by Figure 3 Destination system 370 or Figure 1 The destination system 170 is implemented by the destination system.

[0051] The security platform 430 can be configured to use an application-specific authentication module (e.g., oAuth, base64 authentication, etc.) to ensure trust with the source system 420. The API metadata file 421 of the source system 420 can be a standard JSON file that contains information about the target API, headers, requested resources, etc. As described above, the source system 420 can provide the metadata file 421 to the security platform 430.

[0052] An exemplary template for a metadata file is provided below.

[0053]

[0054]

[0055] In some embodiments, the RestAPI proxy 422 of the source system 420 may be used to establish communication between the source application 420 and the security platform 430 (eg, the proxy 422 may access the restful service endpoint of the security platform using a metadata file).

[0056] The resource security information platform 430 includes a request / response dispatcher 431 (Req / Res dispatcher). The request / response dispatcher 431 can be configured to process a processing request from a source application and pass the details to the controller. In addition, the request / response dispatcher 431 can be configured to return a response to the source application of the source system 420.

[0057] The resource security information platform 430 includes a controller 433. The controller 433 can read the metadata file 421, execute the authentication mechanism to establish a connection with the target API (e.g., API ln 471-479), trigger the request builder 440 to build the request header / payload, and send the request to the target API through the secure tunnel 450. Once the controller 433 receives a response from the target API, it can send the response back to the source application of the source system 420 through the dispatcher 431.

[0058] The resource security information platform 430 includes an API definition manager 434, a metadata reader 435, and an API definition reader 436. The API definition manager 434 manages API definitions. Today's API definitions use swagger files to expose API methods, content types, formats, payload templates, header information, etc., so these files are maintained in the repository of the corresponding application. The API definition manager will access the file and extract the API definition. For older APIs, the security platform can provide a window to manually add API definition files, and this is a prerequisite. The metadata reader 435 can be configured to read and interpret the API metadata 421 received from the source system 420. The API definition reader 436 can be configured to retrieve API definition data 490. For example, the API definition data 490 can be a swagger file.

[0059] The resource security information platform 430 includes an authentication manager 439. The authentication manager 439 can handle the generation of the API request header tat required to verify the user's access role. Different types (e.g., basic, oAuth, bearer, etc.) can be used to implement authentication based on application design and API security models.

[0060] The authentication manager 439 can be configured to construct an access token or authorization token by sending the necessary auth calls to the application server, and it can be configured to temporarily store the token. The data can be cleaned up after the request header is successfully constructed.

[0061] The resource security information platform 430 includes a request builder 440. The request builder 440 may be configured to read data from the controller 433. The request builder 440 may construct a payload in a supported format of a target API, and it may process a data hierarchy.

[0062] The resource security information platform 430 includes a hook 443. The hook 433 includes a cache 444, a hook controller 445, and a prompt 44. As further described below, the hook 443 can be configured to create a virtual chain between APIs. Using a hook, the output result of one API can be used as the input of another API. For example, a user may want to use the modelDefinitionAPI to obtain a model definition. The input parameter of the modelDefinition API may be a "model id." In order to obtain the "model id," another API request may need to be triggered. In this example: 1. Send the request "modellds" API to the application server. 2. Extract the "model id" and construct a payload. 3. Send the request "model definition" to the application server

[0063] Here, there are two APIs involved in getting the model definition as output.

[0064] By utilizing the secure platform 430, responses from two APIs can be linked in a way that the results of the first API will be used to construct the second API request. An example hook request is provided below.

[0065]

[0066]

[0067] When an application is accessing a third-party API (open source or paid application developed outside the organization), security measures may need to be enforced without compromise. Therefore, all API requests to the target API can be passed through the secure tunnel 450. The secure tunnel includes an output API monitor 451, a security scanner 452, and a report processor 453. Each message can be monitored and scanned to provide centralized data security.

[0068] In this way, the resource security integration platform is advantageous because it can handle complex API request communications of one or more source applications using simplified metadata files, thereby making programming and configuration of the source applications easier. In addition, the security platform is advantageous because it enables source applications to authenticate with a single security platform rather than authenticating with multiple API platforms separately. Features and advantages of the security platform also include enabling software developers to design simple metadata requests for use with the security platform rather than generating complete API request messages. Another advantage is that the security platform provides scanning and monitoring of API requests to prevent the leakage of sensitive data, business / personal contact details and other private information, so that the monitoring and scanning may not need to be performed by the source application.

[0069] Figure 5 A diagram 500 of hardware of a special purpose computing machine for implementing the systems and methods described herein is shown. The following hardware description is merely an example. It will be appreciated that various computer topologies may be used to implement the above techniques. Figure 5 The hardware shown in is specifically configured to implement the resource security integration platform described in this article.

[0070] Figure 5501 for executing the above-mentioned techniques (such as, for example, information and instructions for executing some of the above-mentioned techniques). The memory can also be used to store programs executed by the processor 501. Possible implementations of the memory can be, but are not limited to, random access memory (RAM), read-only memory (ROM), or both. A storage device 503 for storing information and instructions is also provided. Common forms of storage devices include, for example, hard drives, magnetic disks, optical disks, CD-ROMs, DVDs, flash memory or other non-volatile memory, USB memory cards, or any other medium that can be read by a computer. The storage device 503 may include a memory device for executing the above-mentioned techniques (such as, for example, the above-mentioned information about the memory device). Figure 2 The storage device and memory are both examples of non-transitory computer-readable storage media.

[0071] Computer system 510 may be coupled to display 512 via bus 505 for displaying information to a computer user. Input devices 511 such as a keyboard, touch screen, and / or mouse are coupled to bus 505 for communicating information and command selections from the user to processor 501. The combination of these components allows the user to communicate with the system. In some systems, bus 505 represents, for example, multiple dedicated buses.

[0072] The computer system also includes a network interface 504 coupled to the bus 505. The network interface 504 can provide two-way data communication between the computer system 610 and the network 520. For example, the network interface 504 can be a wireless or wired connection. The computer system 510 can send and receive information through the network interface 504, for example, across a local area network, an intranet, a cellular network, or the Internet. In the Internet example, a browser can, for example, access data and features on a backend system, which can reside on multiple different hardware servers 531-534 across the network. For example, the servers 531-534 can be part of a cloud computing environment.

[0073] The above description illustrates various embodiments of the present disclosure along with examples of how various aspects of specific embodiments may be implemented. The above examples should not be considered to be the only embodiments, and are presented to illustrate the flexibility and advantages of specific embodiments defined by the appended claims. Based on the above disclosure and the appended claims, other arrangements, embodiments, implementations, and equivalents may be employed without departing from the scope of the present disclosure defined by the claims.

[0074] As used herein, the terms "first", "second", "third", "fourth", "fifth", "sixth", "seventh", "eighth", "ninth", "tenth", etc. do not necessarily indicate an order or sequence unless otherwise specified. As used herein, these terms may simply be used to distinguish between different objects or elements.

[0075] The above description illustrates various embodiments of the present disclosure along with examples of how various aspects of specific embodiments may be implemented. The above examples should not be considered to be the only embodiments, and are presented to illustrate the flexibility and advantages of specific embodiments defined by the appended claims. Based on the above disclosure and the appended claims, other arrangements, embodiments, implementations, and equivalents may be employed without departing from the scope of the present disclosure defined by the claims.

Claims

1. A computer security system comprising: one or more processors; as well as One or more machine-readable media, coupled to the one or more processors and storing computer program code, the computer program code comprising a set of instructions executable by the one or more processors to: receiving a source request from a source system, the source request including an indication of a resource and an address of an application programming interface of a destination system; obtaining a definition of an application programming interface based on the address; Using the definition of the application programming interface to obtain authorization for accessing the destination system; generating an interface request message based on the indication of the resource, the address, and the definition of the application programming interface; Using the authorization, sending an interface request message to a destination system, wherein the interface request message is a complete API request message that satisfies the requirements of an application interface request message of the destination system; receiving an interface response message from a destination system; as well as Sending response data based on the interface response message to the source system, wherein the indication of the resource is a first indication of a first resource, wherein the address of the application programming interface of the destination system is a first address of a first application programming interface of the first destination system, wherein the source request further comprises a second indication of a second resource and a second address of the second application programming interface, wherein the interface response message from the destination system is a first interface response message, wherein the computer program code further comprises a set of instructions executable by the one or more processors to perform the following operations: generating a second interface request message based on the first interface response message, the second indication of the second resource, and the second address such that a result of the first application programming interface is used as an input to the second application programming interface; and A second interface response message is obtained based on the second interface request message, wherein the response data sent to the source system is also based on the second interface response message.

2. The computer security system according to claim 1, wherein: The computer program code also includes a set of instructions executable by the one or more processors to: The interface request message is scanned based on one or more security policies.

3. The computer security system according to claim 1, wherein: The computer program code also includes a set of instructions executable by the one or more processors to: An access request is sent to an authorization server using the stored authorization information, wherein obtaining authorization to access the destination system is based on the access request.

4. The computer security system according to claim 1, wherein: The origin request includes authentication information, The computer program code further includes an instruction set executable by the one or more processors to perform the following operations: The origin system is authenticated based on the authentication information included in the origin request.

5. The computer security system according to claim 1, wherein: The computer program code also includes a set of instructions executable by the one or more processors to: Prior to receiving the source request, the source system is registered with the authorization system, and authorization for accessing the destination system is obtained from the authorization system.

6. The computer security system of claim 1, wherein: The source request includes a definition of an application programming interface.

7. One or more non-transitory computer readable media storing computer program code, wherein: The computer program code includes a set of instructions for performing the following operations: receiving a source request from a source system, the source request including an indication of a resource and an address of an application programming interface of a destination system; obtaining a definition of an application programming interface based on the address; Using the definition of the application programming interface to obtain authorization for accessing the destination system; generating an interface request message based on the indication of the resource, the address and the definition of the application programming interface, the interface request message being a complete API request message that satisfies the requirements of the application interface request message of the destination system; sending an interface request message to a destination system using the authorization; receiving an interface response message from a destination system; as well as Sending response data based on the interface response message to the source system, wherein the indication of the resource is a first indication of a first resource, wherein the address of the application programming interface of the destination system is a first address of a first application programming interface of the first destination system, wherein the source request further comprises a second indication of a second resource and a second address of the second application programming interface, wherein the interface response message from the destination system is a first interface response message, wherein the computer program code further comprises a set of instructions executable by the one or more processors to perform the following operations: generating a second interface request message based on the first interface response message, the second indication of the second resource, and the second address such that a result of the first application programming interface is used as an input to the second application programming interface; and A second interface response message is obtained based on the second interface request message, wherein the response data sent to the source system is also based on the second interface response message.

8. The non-transitory computer readable medium of claim 7, wherein: The computer program code also includes a set of instructions executable by the one or more processors to: The interface request message is scanned based on one or more security policies.

9. The non-transitory computer readable medium of claim 7, wherein: The computer program code also includes a set of instructions executable by the one or more processors to: An access request is sent to an authorization server using the stored authorization information, wherein obtaining authorization to access the destination system is based on the access request.

10. The non-transitory computer readable medium of claim 7, wherein: The source request includes authentication information, wherein the computer program code further includes a set of instructions executable by the one or more processors to: The origin system is authenticated based on authentication information included in the origin request.

11. The non-transitory computer readable medium of claim 7, wherein: The computer program code also includes a set of instructions executable by the one or more processors to: Prior to receiving the source request, the source system is registered with the authorization system, and authorization for accessing the destination system is obtained from the authorization system.

12. The non-transitory computer readable medium of claim 7, wherein: The source request includes a definition of an application programming interface.

13. A computer-implemented method comprising: receiving a source request from a source system, the source request including an indication of a resource and an address of an application programming interface of a destination system; obtaining a definition of an application programming interface based on the address; Using the definition of the application programming interface to obtain authorization for accessing the destination system; generating an interface request message based on the indication of the resource, the address and the definition of the application programming interface, the interface request message being a complete API request message that satisfies the requirements of the application interface request message of the destination system; sending an interface request message to a destination system using the authorization; receiving an interface response message from a destination system; as well as Sending response data based on the interface response message to the source system, wherein the indication of the resource is a first indication of a first resource, wherein the address of the application programming interface of the destination system is a first address of a first application programming interface of the first destination system, wherein the source request further comprises a second indication of a second resource and a second address of the second application programming interface, wherein the interface response message from the destination system is a first interface response message, wherein the method further comprises: generating a second interface request message based on the first interface response message, the second indication of the second resource, and the second address such that a result of the first application programming interface is used as an input to the second application programming interface; and A second interface response message is obtained based on the second interface request message, wherein the response data sent to the source system is also based on the second interface response message.

14. The computer-implemented method of claim 13, further comprising: The interface request message is scanned based on one or more security policies.

15. The computer-implemented method of claim 13, further comprising: An access request is sent to an authorization server using the stored authorization information, wherein obtaining authorization to access the destination system is based on the access request.

16. The computer-implemented method of claim 13, further comprising: The origin system is authenticated based on authentication information included in the origin request.

17. The computer-implemented method of claim 13, further comprising: Prior to receiving the source request, the source system is registered with the authorization system, and authorization for accessing the destination system is obtained from the authorization system.

Images