API Platform

Large organisations expose hundreds of services to their own apps, partners and regulators. Integration usually meant a heavy commercial integration suite with expensive licences and specialist developers, and every new API was code, review and a release. Few people could see which services were healthy and who was calling what.

1. 01

   A visual flow builder

   An API is a flow of nodes: receive, transform, call a backend, respond. Teams assemble flows by dragging and connecting nodes, so a new endpoint is a configuration change rather than a development project.

2. 02

   Security built in

   Every published API sits behind OAuth2 and JWT based authentication, with access managed in the platform instead of inside each service.

3. 03

   Runs where the client runs

   Banks keep most systems on their own servers, operators often run on cloud. The platform is containerised and deploys on cloud, on premise or as a hybrid of both.

4. 04

   Hardened data access

   Reviewing the code, I found query parameters assembled as text and specified real bind parameters for every database node across six database engines, plus a read only SQL node that inspects columns without running the query.

5. 05

   Visible in production

   A dashboard shows the status of every service and how each API is used, and metrics flow into Prometheus and Grafana alongside the rest of the infrastructure.

The roadmap that followed came from comparing the platform with commercial integration suites: branching and loops, versioned flows with rollback, per node tracing and replay, and triggers that run exactly once across instances.

React, TypeScript, Java, Spring Boot, Kubernetes, Kafka, RabbitMQ, ClickHouse