An API credential management method and API platform

Abstract

The application discloses an API credential management method and an API platform, and belongs to the technical field of cloud computing and computer program data interaction. The method comprises the following steps: publishing an API to an API platform in response to a publishing operation of an API publisher; creating a target application and generating a target API credential in the API platform in response to an application creation operation of an API subscriber; associating and binding the target API with the target API credential and creating a target triple in response to a binding operation of the API subscriber; and judging the validity of a target API calling request of the API subscriber, and rejecting or forwarding the target API calling request according to the judgment result. In the application, the application and the API credential have a one-to-one correspondence, a single credential can be associated with multiple APIs, the total quantity of credentials can be effectively reduced, operation and maintenance management can be simplified, and security risks can be reduced.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing and computer program data interaction technology, specifically relating to an API credential management method and API platform. Background Technology

[0002] API (Application Programming Interface) platforms serve as the core hub for inter-system communication. Through centralized management of API interfaces, they enable efficient connections and secure data exchange between different applications, services, or software systems, effectively breaking down information silos, improving development efficiency, and driving business integration and innovation. API platforms implement unified governance of API interfaces, providing centralized registration, publishing, monitoring, and maintenance functions to ensure the availability and reliability of API calls. They also provide access control and authentication functions to comprehensively protect data security. Software developers can directly call mature business APIs (such as payment and mapping APIs) within the API platform, significantly shortening development cycles and accelerating application development. Furthermore, API platforms connect internal enterprise systems (such as ERP, CRM, and OA systems) with external ecosystems, breaking down information barriers and achieving system integration and data sharing. For traditional enterprises, API platforms can help seamlessly integrate legacy systems with cloud services, achieving gradual modernization upgrades and driving digital transformation.

[0003] API credentials are a crucial security mechanism for API platforms to implement access control and authentication. Their core function is to verify the identity of the caller and authorize access to specific resources, ensuring that only legitimate users or applications can perform the corresponding operations. Credential management is one of the most vulnerable aspects of API platforms; poor management can lead to credential leaks, resulting in serious security incidents such as data breaches and asset losses. Currently, the subscription model of traditional API platforms has significant flaws: when an API platform provides an API subscription service, the API subscriber selects the APIs they need to subscribe to. The API platform assigns a unique API credential to each API selected by the subscriber, and there is a one-to-one correspondence between API credentials and APIs. Assume there are K subscribers, each subscribing to M1, M2, ..., M... K For each API, an API platform needs to generate it. API credentials. As business expands, the number of API credentials grows rapidly, causing problems such as scattered credential distribution and management difficulties. It also easily leads to zombie credentials and redundant credentials, which consume system resources and increase security risks such as data leakage.

[0004] In practical API integration scenarios, API integration is typically implemented at the application level. A single application will flexibly call multiple required API interfaces according to its specific business needs. For example, a file processing system may integrate multiple mature APIs provided by third parties to implement functions such as text and image recognition, file format conversion, and file encryption and decryption. If the traditional model is used, the application administrator needs to manage multiple independent credentials for each API integration, resulting in a large workload for configuration, storage, and maintenance. Summary of the Invention

[0005] To address the problems of large number, complex management, and high security risks associated with existing API credentials, this invention provides an API credential management method and API platform. By managing API credentials in a unified manner at the application level, the total number of API credentials is reduced and the management process is simplified.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides an API credential management method, comprising:

[0008] In response to the API publisher's publishing action, publish the API to the API platform;

[0009] In response to the API subscriber's application creation operation, the target application is created in the API platform, and the target API credentials are generated as the unique authentication key of the target application in the API platform.

[0010] In response to the binding operation of the API subscriber, the target API is associated with the target API credential, and a target triple is created; the target API is determined by the API subscriber in the API platform according to the actual business needs of the target application; the target triple is used to record the association and binding relationship between the target API and the target API credential, as well as the validity period of the association and binding relationship;

[0011] In response to the validity period setting operation of the API subscriber, determine the validity period of the association binding relationship in the target triple;

[0012] In response to a target API call request from the API subscriber, the validity of the target API call request is determined, and the target API call request is rejected or forwarded to the publisher of the target API based on the determination result; the target API call request contains the target API credentials.

[0013] Furthermore, the number of target APIs may be one or more; when the number of target APIs is multiple, the target API credentials shall establish an association and binding relationship with each target API and set the validity period of each association and binding relationship respectively.

[0014] Furthermore, the target triple is used for:

[0015] When using the target API as the search condition, query and count the number of all API credentials that are associated with the target API in order to determine the total number of applications that call the target API;

[0016] When using the target API credential as a search criterion, the total number of APIs associated with the target API credential is queried and counted to determine the total number of APIs called by the target application.

[0017] Furthermore, in response to a target API call request from the API subscriber, the validity of the target API call request is determined, and based on the determination result, the target API call request is rejected or forwarded to the publisher of the target API, including:

[0018] The target API credential is searched in the API platform. If the target API credential is not found, it is considered invalid, the target API call request is deemed invalid, and the target API call request is rejected.

[0019] If the target API credentials are found in the API platform, the target API call request is authenticated based on the AK / SK mechanism. If the authentication fails, the target API call request is deemed invalid and rejected.

[0020] If the identity authentication is successful, the target triplet corresponding to the target API credential is retrieved in the API platform. If the target triplet is not found, it means that the target API credential is not associated with the target API, the target API call request is deemed invalid, and the target API call request is rejected.

[0021] If the target triple is found in the API platform, the validity period of the target triple is checked. If the validity period has expired, the target API call request is determined to be invalid and the target API call request is rejected.

[0022] If the set validity period has not expired, the target API call request is deemed valid, and the target API call request is forwarded to the publisher of the target API.

[0023] Furthermore, the method also includes: updating the expiration date in the target triplet in response to the expiration date extension operation of the API subscriber.

[0024] Furthermore, the method also includes: in response to the API subscriber's unsubscribe operation of the target API, removing the association between the target API and the target API credential, and deleting the target triplet.

[0025] Furthermore, the method also includes: in response to the target application deletion operation of the API subscriber, deleting the target API credential and all target triples associated with the target API credential.

[0026] Furthermore, the method also includes: in response to the API publisher's API delisting request, querying whether there exists a valid triplet corresponding to the API, using the API to be delisted as an index; if it exists, then rejecting the API delisting request.

[0027] Secondly, this invention provides an API platform, comprising:

[0028] The API publishing module is used to respond to the publishing operation of the API publisher and publish the API to the API platform;

[0029] The API subscription module is used to respond to the application creation operation of the API subscriber, create the target application in the API platform, and generate the target API credentials as the unique authentication key of the target application in the API platform.

[0030] The API management module includes a sub-module for association and binding, a sub-module for validity period setting, and a sub-module for API call request determination.

[0031] The association binding submodule is used to respond to the binding operation of the API subscriber, associate the target API with the target API credential, and create a target triple; the target API is determined by the API subscriber in the API platform according to the actual business needs of the target application; the target triple is used to record the association binding relationship between the target API and the target API credential, as well as the validity period of the association binding relationship;

[0032] The validity period setting submodule is used to determine the validity period of the association binding relationship in the target triple in response to the validity period setting operation of the API subscriber;

[0033] The API call request determination submodule is used to respond to the target API call request from the API subscriber, determine the validity of the target API call request, and reject the target API call request or forward the target API call request to the publisher of the target API based on the determination result; the target API call request contains the target API credentials.

[0034] Furthermore, the API management module also includes a validity period update submodule, an API unsubscription submodule, an application deletion submodule, and an API delisting submodule;

[0035] The validity period update submodule is used to update the validity period in the target triple in response to the validity period extension operation of the API subscriber;

[0036] The API unsubscribe submodule is used to respond to the API subscriber's target API unsubscribe operation by removing the association between the target API and the target API credential, and deleting the target triplet.

[0037] The application deletion submodule is used to delete the target API credential and all target triples associated with the target API credential in response to the target application deletion operation of the API subscriber.

[0038] The API delisting submodule is used to respond to the API delisting request from the API publisher by querying whether there is a valid triplet corresponding to the API, using the API to be delisted as an index; if it exists, the API delisting request is rejected.

[0039] The beneficial effects of this invention are as follows:

[0040] 1. This invention reconstructs the subscription model of API subscribers and innovatively introduces the concept of application, allowing an API subscriber to subscribe to multiple APIs with an application as the basic subscription unit. Each application has a unique API credential, which avoids the rapid increase in the number of credentials as the business expands under the traditional model, greatly reducing the total number of API credentials. This reduces the management difficulty of API credentials and facilitates the auditing and tracing of API calls.

[0041] 2. This invention allows applications to subscribe to multiple APIs using an application as the basic subscription unit. Only one API credential needs to be configured within a single application to subscribe to multiple APIs, avoiding the occurrence of zombie or redundant credentials, facilitating credential cleanup, reducing the configuration complexity and security risks of a single application, and improving the operational efficiency of the application.

[0042] 3. This invention supports an API subscriber in creating multiple independent applications, managing subscribed APIs from the application level. Each application can independently select the APIs to subscribe to and set the subscription validity period. Credentials between applications are isolated from each other, and changes to the subscription of a single application will not affect other applications, providing API subscribers with convenience and flexibility in management.

[0043] 4. This invention achieves loose coupling between API credentials and APIs from the perspective of API subscribers. API subscribers can create applications and API credentials in advance based on business plans, and then associate and bind APIs as needed, avoiding mutual dependence between API credentials and APIs.

[0044] 5. This invention has a clear mapping relationship between API, subscriber, and application. It associates and binds API credentials with APIs through triples. Since the API credentials belong to the application created by the API subscriber, it also reflects the subscription relationship between the subscriber, business application, and API. The API platform can intuitively show API subscribers which applications have subscribed to which APIs and can statistically analyze API calls on an application-by-application basis to form a clear resource usage graph.

[0045] 6. This invention provides a mechanism for reusing API credentials. When a credential expires, only the validity period of the existing API credential needs to be updated. There is no need to regenerate the credential or resubscribe to the API. The API subscriber's application does not need to modify the credential configuration, which reduces the subscription's configuration workload and the number of credentials generated. Attached Figure Description

[0046] Figure 1 This is a flowchart of the API credential management method of the present invention.

[0047] Figure 2 This is a schematic diagram illustrating the API publishing, application creation, and API binding processes implemented through the API platform in this invention.

[0048] Figure 3 This is a schematic diagram of the API call process according to an embodiment of the present invention.

[0049] Figure 4 This is a schematic diagram of the API platform according to an embodiment of the present invention. Detailed Implementation

[0050] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0051] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0052] The terms “first”, “second”, etc., are used to distinguish similar objects, not to describe or indicate a specific order or sequence.

[0053] The term "comprising" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent in such process, method, article, or apparatus / device.

[0054] Furthermore, to better illustrate the present invention, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that the present invention can be practiced without certain specific details. In some instances, methods, means, elements, and circuits well known to those skilled in the art have not been described in detail in order to highlight the spirit of the invention.

[0055] Figure 1 The flowchart of the API credential management method of the present invention is as follows: Figure 1 As shown, the method includes:

[0056] S1. In response to the API publisher's publishing operation, publish the API to the API platform.

[0057] API publishers uniformly publish their APIs to the API platform, and API subscribers must subscribe to and call APIs through the API platform.

[0058] This invention's API platform provides a one-stop API sharing and management service. By integrating API management, security control, and audit monitoring functions, it offers an efficient, centralized, secure, and automated management platform for API publishers and subscribers. As a bridge between API publishers and subscribers, the API platform aggregates API resources published by multiple parties and provides them for display and testing, allowing subscribers to choose which to subscribe to. In terms of security control, the platform is responsible for authenticating and authorizing API call requests initiated by subscribers, and provides protection measures such as circuit breaking and rate limiting to ensure the security and stability of API calls. Regarding audit monitoring, the platform provides multi-dimensional statistics and billing functions, enabling both API publishers and subscribers to obtain a comprehensive view of their resource calls or those being called through the platform. By publishing APIs on a unified API platform and subscribers selecting APIs from the platform for subscription, API publishers can achieve efficient reuse of technical capabilities, secure control, and maximized commercial value through standardization, centralization, and an ecosystem-based approach.

[0059] S2. In response to the API subscriber's application creation operation, create the target application in the API platform and generate the target API credentials as the unique authentication key of the target application in the API platform.

[0060] After logging into the API platform, API subscribers create a target application within the platform based on their business scenario. Once the target application is created, a unique target API credential is generated for it within the API platform. This credential is only valid for the API subscriber within the target application and is used for authentication and authorization when the subscriber calls APIs on the API platform from within the target application.

[0061] S3. In response to the binding operation of the API subscriber, associate the target API with the target API credential and create a target triple; the target API is determined by the API subscriber in the API platform according to the actual business needs of the target application; the target triple is used to record the association binding relationship between the target API and the target API credential and the validity period of the association binding relationship.

[0062] The API subscriber browses API resources in the API platform, determines the target API based on the actual business needs of the target application, and associates the target API with the target API credential. At this point, a target triple is created in the API platform, with the form <target API, target API credential, NULL>, where NULL indicates that the association does not have a valid validity period.

[0063] S4. In response to the validity period setting operation of the API subscriber, determine the validity period of the association binding relationship in the target triple.

[0064] The API subscriber sets an expiration date for the association between the target API and the target API credential. The target triple is updated to <target API, target API credential, expiration date>, forming a valid association mapping of "API-API credential-expiration date". This expiration date is the valid period during which the target API credential can call the target API within the API platform.

[0065] In one embodiment, when a file processing system needs to integrate a text image recognition API, it first creates an application named "File Processing System" on the API platform as an API subscriber, and then generates a unique API credential for "File Processing System," denoted as credential a. At this point, credential a is not associated with any API and is only used for subsequent API subscription operations. Then, the API platform creates a triple <Text Image Recognition API, credential a, NULL> to associate the text image recognition API with credential a. This association is set to have a one-year validity period, so the API platform updates the original triple to <Text Image Recognition API, credential a, start time + 1 year>, where the start time is the initial time when the text image recognition API and credential a establish their association.

[0066] In this invention, an API subscriber can create multiple applications, each with its own unique API credential. An API credential can be associated with multiple APIs, and each association can have its own independently set expiration date. That is, an API subscriber can determine one or more target APIs for a target application. When there are multiple target APIs, the target API credential establishes an association with each target API, and the expiration date of each association can be set separately.

[0067] The target API and target API credential in the target triple <target API, target API credential, validity period> can be set as query indexes. When using the target API as the search condition, the number of all API credentials associated with the target API can be queried and counted through the target triple to determine the total number of applications calling the target API (i.e., how many applications called the target API). When using the target API credential as the search condition, the number of all APIs associated with the target API credential can be queried and counted through the target triple to determine the total number of APIs called by the target application (i.e., how many APIs the target application called). This flexible and scalable search mechanism provides ample room for future expansion into high-value-added services such as API billing and security protection.

[0068] Figure 2 This is a schematic diagram illustrating API publishing, application creation, and API binding via an API platform, as described in the present invention. Figure 2 As shown, API publishers publish their APIs to a unified API platform. API subscribers first create applications on the API platform. The API platform generates a unique API credential for each application. Then, the API subscriber determines the corresponding API for each application from the API platform and binds the API corresponding to each application with the API credential (i.e., subscribing to the corresponding API for each application). Compared to the one-to-one correspondence between API credentials and APIs in the traditional subscription model, in this invention, there is a one-to-one correspondence between API credentials and applications.

[0069] In one embodiment, a file processing system needs to integrate three corresponding APIs provided by a third party to implement three core functions: text and image recognition, file format conversion, and file encryption and decryption. If the traditional API access model is used, the file processing system needs to apply for an API credential for each API, i.e., it needs to apply for three API credentials and complete the subscription process for each of the three different APIs one by one. However, in the solution of this embodiment, the file processing system only needs to configure one API credential and associate and bind that API credential with each of the three APIs, thus covering all of the file processing system's own API subscription needs.

[0070] S5. In response to the target API call request from the API subscriber, determine the validity of the target API call request, and reject the target API call request or forward the target API call request to the publisher of the target API based on the determination result; the target API call request contains the target API credentials.

[0071] The API subscriber initiates an API call request to the API platform by application unit using the corresponding API credential. The API platform performs identity authentication and authorization using the API credential in the API call request, and determines whether the API call request is valid according to the triplet <API, API credential, validity period>.

[0072] Step S5 specifically includes:

[0073] S5-1. Retrieve the target API credential in the API platform. If the target API credential is not retrieved, the target API credential is regarded as an invalid credential, the target API call request is determined to be invalid, and the target API call request is rejected.

[0074] S5-2. If the target API credential is retrieved in the API platform, identity authentication is performed on the target API call request based on the AK / SK mechanism. If the identity authentication fails, the target API call request is determined to be invalid, and the target API call request is rejected.

[0075] One of the core functions of the API platform of the present invention is to complete identity authentication and authorization for API call requests based on API credentials. This embodiment adopts the AK (Access Key) / SK (Secret Key) mechanism for identity authentication. The AK is used for identity identification, which specifically refers to the target application entity created by the API subscriber in this embodiment. In step S5-1, the API platform judges the validity of the target API credential by retrieving the AK; the SK functions as a key for encryption and information verification. In this embodiment, the API subscriber uses the SK to generate a signature for the target API call request. In step S5-2, the API platform recalculates the signature by invoking the same SK and completes two-way comparison, so as to determine whether the identity authentication is passed.

[0076] S5-3. If the identity authentication is passed, retrieve the target triplet corresponding to the target API credential in the API platform. If the target triplet is not retrieved, it indicates that the target API credential is not associated and bound with the target API, the target API call request is determined to be invalid, and the target API call request is rejected.

[0077] S5-4. If the target triplet is retrieved in the API platform, the validity period in the target triplet is checked. If the set validity period has expired, the target API call request is determined to be invalid, and the target API call request is rejected.

[0078] S5-5. If the set validity period has not expired, the target API call request is determined to be valid, and the target API call request is forwarded to the publisher of the target API.

[0079] Figure 3 is a schematic diagram of an API calling process according to an embodiment of the present invention, as shown in Figure 3 As shown, after receiving a target API invocation request sent by an API subscriber, the API platform starts API authentication. The API platform first retrieves and queries the target API credential in the target API invocation request. If the retrieval fails, it indicates that the target API credential is an invalid credential, and the API platform rejects this API invocation request; if the retrieval succeeds, the API platform performs identity authentication and authorization on the target API credential. If the identity authentication fails, the API platform rejects this API invocation request; if the identity authentication succeeds, the API platform verifies the association and binding relationship between the target API credential and the target API. If the target API credential is not associated and bound to the target API, it indicates that the target application corresponding to the target API credential has not subscribed to the target API, the verification of the association and binding relationship fails, and the API platform rejects this API invocation request; if the verification of the association and binding relationship succeeds, the API platform checks the validity period of the target API credential. If the target API credential has exceeded the set validity period, the validity period check fails, and the API platform rejects this API invocation request; if the validity period check succeeds, the API platform accepts the target API invocation request and forwards the target API invocation request to the publisher of the target API (i.e., the API provider).

[0080] In a possible implementation, the API credential management method of the present invention further comprises: updating the validity period in the target triple in response to a validity period extension operation of an API subscriber, where the validity period extension operation is used to extend the validity period of the association and binding relationship between the target API and the target API credential.

[0081] The API subscriber may apply for extending the validity period before the validity period expires, or apply for extending the validity period after the validity period expires. After the validity period extension application is approved, the API platform updates the target triple to <target API, target API credential, new validity period>.

[0082] In the triple <API, API credential, validity period>, the validity period is an invocation constraint set for the API credential, and the validity period is defined by conditions such as a cutoff time and the number of invocations. When the validity period expires, the API platform will reject API invocation requests using this API credential. If the application corresponding to the API credential needs to renew the API, the API subscriber may apply on the API platform to extend the validity period of the API credential. After the application is approved, the API platform updates the validity period configuration in the triple, and subsequent API invocation requests will be verified according to the new validity period.

[0083] In one possible implementation, the API credential management method of the present invention further includes: in response to the target API unsubscription operation of the API subscriber, removing the association binding relationship between the target API and the target API credential, and deleting the target triple; the target API unsubscription operation is used to unsubscribe from the target API subscribed by the target application.

[0084] API subscribers can unbind the target API from the target API credential before the expiration date of the target triple <target API, target API credential, expiration date>. The unbinding method is as follows: API subscribers select the target application they created on the API platform, submit an unsubscribe request for a target API subscribed to by the target application, and after the request is successful, the API platform will remove the association between the target API credential and the target API and delete the corresponding target triple. Subsequent calls from the target application to this API will be rejected.

[0085] In one possible implementation, the API credential management method of the present invention further includes: in response to a target application deletion operation by an API subscriber, deleting the target API credential and all target triples associated with the target API credential.

[0086] When an API subscriber deletes an application it created from the API platform, the API platform simultaneously deletes the API credentials corresponding to that application, as well as all triples associated with that API credentials (i.e., all triples containing that API credentials). Specifically:

[0087] (1) After receiving the API subscriber’s request to delete the target application, the API platform will search using the target API credential as the index. If it finds that there is an association between the target API and the target API credential that is still valid (i.e., a valid target API subscription is found), it will prompt the API subscriber that the target application still has a valid API subscription and suggest that the API subscriber unsubscribe from the valid API subscription of the target application before deleting the target application. Alternatively, the API subscriber may be asked to determine whether to forcibly delete the target application.

[0088] (2) If the API subscriber chooses to force delete the target application, the API platform will simultaneously delete the target API credential corresponding to the target application and all triples associated with the target API credential.

[0089] In one possible implementation, the API credential management method of the present invention further includes: responding to an API delisting request from an API publisher, querying whether a valid triplet exists corresponding to the API, using the API to be delisted as an index; if it exists, then rejecting the API delisting request.

[0090] When an API publisher applies to delist an already published API, the API platform must ensure that the API has not been subscribed to by any API subscribers. The API platform uses the API to be delisted as an index to check if a valid triple containing the API exists and is still valid. If a valid triple exists, it indicates that there is an association between the API credential and the API, and that the API credential is still valid. In this case, the API platform rejects the API publisher's delisting application to avoid affecting the normal operation of API subscribers' applications. Therefore, API publishing must undergo strict review, and APIs should not be arbitrarily delisted except under special circumstances to protect the legitimate rights and interests of API subscribers.

[0091] The API credential management method of this invention uses applications as the basic subscription unit, configuring a unique API credential for each application. One API credential can be associated with and bound to multiple APIs, thereby effectively reducing the total number of credentials, simplifying operation and maintenance management, and reducing security risks. It relies on triples to achieve full-link relationship traceability and access control, possessing the characteristics of high flexibility, traceability, and high security. Assume there are K subscribers, each subscriber creating N1, N2, ..., N... K If an application subscribes to one or more APIs, then an API platform is needed to generate one. This invention significantly reduces the total number of API credentials required compared to traditional API subscription models where a credential is generated for each API subscription, thereby lowering the overall maintenance complexity. Furthermore, managing API credentials from a business application perspective, including cleaning and tracking them, significantly improves application security, flexibility, and convenience, preventing the creation of zombie or redundant credentials and reducing security risks.

[0092] This invention also proposes an API platform for implementing the API credential management method of this invention.

[0093] Figure 4 This is a schematic diagram of the API platform of the present invention, as shown below. Figure 4 As shown, the API platform includes:

[0094] The API publishing module is used to respond to the publishing operation of the API publisher and publish the API to the API platform;

[0095] The API subscription module is used to respond to the application creation operation of the API subscriber, create the target application in the API platform, and generate the target API credentials as the unique authentication key of the target application in the API platform.

[0096] The API management module includes:

[0097] The association binding submodule is used to respond to the binding operation of the API subscriber, associate and bind the target API with the target API credential, and create a target triple; the target API is determined by the API subscriber in the API platform according to the actual business needs of the target application; the target triple is used to record the association binding relationship between the target API and the target API credential, as well as the validity period of the association binding relationship;

[0098] It is associated with and bound to submodules, and is also used to maintain the created triples;

[0099] The validity period setting submodule is used to determine the validity period of the association binding relationship in the target triple in response to the validity period setting operation of the API subscriber;

[0100] The API call request determination submodule is used to respond to the target API call request from the API subscriber, determine the validity of the target API call request, and reject the target API call request or forward the target API call request to the publisher of the target API based on the determination result; the target API call request contains the target API credentials.

[0101] Furthermore, the API management module also includes:

[0102] The validity period update submodule is used to update the validity period in the target triple in response to the validity period extension operation of the API subscriber;

[0103] The API unsubscribe submodule is used to respond to the target API unsubscribe operation of the API subscriber, remove the association binding relationship between the target API and the target API credential, and delete the target triple;

[0104] The application deletion submodule is used to delete the target API credential and all target triples associated with the target API credential in response to the target application deletion operation of the API subscriber.

[0105] The API delisting submodule is used to respond to the API delisting request from the API publisher by querying whether there is a valid triplet corresponding to the API, using the API to be delisted as an index; if it exists, the API delisting request is rejected.

[0106] Furthermore, the API management module also includes:

[0107] The API registration and discovery submodule is used to implement registration when publishing APIs and discovery when calling APIs.

[0108] The Web Services submodule is used to provide Web services, enabling API subscribers to view API documentation and conduct online API testing, and assisting API subscribers in making API subscription decisions.

[0109] The API monitoring and auditing submodule is used to implement audit monitoring of API calls.

[0110] Furthermore, the API platform also includes:

[0111] An API gateway is used to implement routing functions. After an API call request passes the validity check, it forwards the API call request to the API publisher and provides traffic control and protection capabilities such as rate limiting and circuit breaking.

[0112] The API statistics module provides API call statistics and displays from multiple dimensions, including API subscribers, API publishers, and applications.

[0113] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes and related descriptions of each module in the API platform described above can be found in the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0114] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0115] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0116] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0117] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0118] The contents not described in detail in this specification are existing technologies known to those skilled in the art.

[0119] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. The above descriptions are exemplary and not exhaustive. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An API credential management method, characterized in that, include: In response to the API publisher's publishing action, publish the API to the API platform; In response to the API subscriber's application creation operation, the target application is created in the API platform, and the target API credentials are generated as the unique authentication key of the target application in the API platform. In response to the binding operation of the API subscriber, the target API is associated with the target API credential, and a target triple is created; The target API is determined by the API subscriber in the API platform based on the actual business needs of the target application; the target triple is used to record the association and binding relationship between the target API and the target API credential, as well as the validity period of the association and binding relationship; In response to the validity period setting operation of the API subscriber, determine the validity period of the association binding relationship in the target triple; In response to a target API call request from the API subscriber, the validity of the target API call request is determined, and the target API call request is rejected or forwarded to the publisher of the target API based on the determination result. The target API call request contains the target API credentials.

2. The API credential management method according to claim 1, characterized in that, The number of target APIs can be one or more; when the number of target APIs is multiple, the target API credentials shall establish an association and binding relationship with each target API and set the validity period of each association and binding relationship.

3. The API credential management method according to claim 2, characterized in that, The target triple is used for: When using the target API as the search condition, query and count the number of all API credentials that are associated with the target API in order to determine the total number of applications that call the target API; When using the target API credential as a search criterion, the total number of APIs associated with the target API credential is queried and counted to determine the total number of APIs called by the target application.

4. The API credential management method according to claim 1, characterized in that, In response to a target API call request from the API subscriber, the validity of the target API call request is determined, and based on the determination result, the target API call request is rejected or forwarded to the publisher of the target API, including: The target API credential is searched in the API platform. If the target API credential is not found, it is considered invalid, the target API call request is deemed invalid, and the target API call request is rejected. If the target API credentials are found in the API platform, the target API call request is authenticated based on the AK / SK mechanism. If the authentication fails, the target API call request is deemed invalid and rejected. If the identity authentication is successful, the target triplet corresponding to the target API credential is retrieved in the API platform. If the target triplet is not found, it means that the target API credential is not associated with the target API, the target API call request is deemed invalid, and the target API call request is rejected. If the target triple is found in the API platform, the validity period of the target triple is checked. If the validity period has expired, the target API call request is deemed invalid and rejected. If the set validity period has not expired, the target API call request is deemed valid, and the target API call request is forwarded to the publisher of the target API.

5. The API credential management method according to claim 1, characterized in that, The method further includes updating the expiration date in the target triplet in response to the expiration date extension operation of the API subscriber.

6. The API credential management method according to claim 1, characterized in that, The method further includes: in response to the API subscriber's unsubscribe operation of the target API, removing the association between the target API and the target API credential, and deleting the target triplet.

7. The API credential management method according to claim 1, characterized in that, The method further includes: in response to a target application deletion operation by the API subscriber, deleting the target API credential and all target triples associated with the target API credential.

8. The API credential management method according to claim 1, characterized in that, The method further includes: in response to the API publisher's API delisting request, querying whether there exists a valid triplet corresponding to the API, using the API to be delisted as an index; if it exists, then rejecting the API delisting request.

9. An API platform, characterized in that, include: The API publishing module is used to respond to the publishing operation of the API publisher and publish the API to the API platform; The API subscription module is used to respond to the application creation operation of the API subscriber, create the target application in the API platform, and generate the target API credentials as the unique authentication key of the target application in the API platform. The API management module includes a sub-module for association and binding, a sub-module for validity period setting, and a sub-module for API call request determination. The association binding submodule is used to respond to the binding operation of the API subscriber, associate the target API with the target API credential, and create a target triple; The target API is determined by the API subscriber in the API platform based on the actual business needs of the target application; the target triple is used to record the association and binding relationship between the target API and the target API credential, as well as the validity period of the association and binding relationship; The validity period setting submodule is used to determine the validity period of the association binding relationship in the target triple in response to the validity period setting operation of the API subscriber; The API call request determination submodule is used to respond to the target API call request from the API subscriber, determine the validity of the target API call request, and reject the target API call request or forward the target API call request to the publisher of the target API based on the determination result. The target API call request contains the target API credentials.

10. The API platform according to claim 9, characterized in that, The API management module also includes a validity period update submodule, an API unsubscription submodule, an application deletion submodule, and an API removal submodule; The validity period update submodule is used to update the validity period in the target triple in response to the validity period extension operation of the API subscriber; The API unsubscribe submodule is used to respond to the API subscriber's target API unsubscribe operation by removing the association between the target API and the target API credential, and deleting the target triplet. The application deletion submodule is used to delete the target API credential and all target triples associated with the target API credential in response to the target application deletion operation of the API subscriber. The API delisting submodule is used to respond to the API delisting request from the API publisher by querying whether there is a valid triplet corresponding to the API, using the API to be delisted as an index; if it exists, the API delisting request is rejected.

Images