Traditional organizations are increasingly becoming software producing organizations. This software is enabling them to integrate business processes between different departments and with other organizations through Application Programming Interfaces (APIs). The main task of managing APIs is to ensure that the APIs are easy to use by third parties, such as providing helpful documentation, monitoring API performance, and even monetizing API usage. The knowledge on API management is scattered across academic literature. In this document, we describe a Systematic Literature Review (SLR) that has the goal of collecting API Management practices and capabilities related to API Management, as well as proposing a comprehensive definition of the topic. In the scope of this work, a practice is defined as any practice that has the express goal to improve, encourage and manage the usage of APIs. Capabilities are defined as the ability to achieve a certain goal related to API Management, through the execution of two or more interrelated practices. We follow a standard method for SLRs in software engineering. We managed to collect 24 unique definitions for the topic, 114 practices and 39 capabilities.
We define API Management as an activity that enables organizations to design, publish and deploy their APIs for (external) developers to consume. API Management capabilities such as controlling API lifecycles, access and authentication to APIs, monitoring, throttling and analyzing API usage, as well as providing security and documentation. These capabilities are often implemented through an integrated platform. This data set describes the API Management Focus Area Maturity Model (API-m-FAMM). In a structured manner, this model aims to support organizations that expose their API(s) to third-par…
Internet of Things (IoT) is a growing technology that relies on connected 'things' that gather data from peer devices and send data to servers via APIs (Application Programming Interfaces). The design quality of those APIs has a direct impact on their understandability and reusability. This study focuses on the linguistic design quality of REST APIs for IoT applications and assesses their linguistic quality by performing the detection of linguistic patterns and antipatterns in REST APIs for IoT applications. Linguistic antipatterns are considered poor practices in the naming, documentation, an…
API search involves finding components in an API that are relevant to a programming task. For example, a programmer may need a function in a C library that opens a new network connection, then another function that sends data across that connection. Unfortunately, programmers often have trouble finding the API components that they need. A strong scientific consensus is emerging towards developing interactive tool support that responds to conversational feedback, emulating the experience of asking a fellow human programmer for help. A major barrier to creating these interactive tools is impleme…
Traditionally, software APIs (application programming interfaces) have been viewed from a technical perspective, as a means to separate implementation from functional calls, and as a way to define a contract of software functionality. The technical benefits of APIs have been reported in numerous studies. Several reports from industry offer useful practical design considerations for APIs, including advice on collecting usage data, monetization strategies, and at what point to open an API to external parties. Although this advice can be useful, the focus is still often on the API, only without c…
The fast-growing Web API landscape brings clients more options than ever before---in theory. In practice, they cannot easily switch between different providers offering similar functionality. We discuss a vision for developing Web APIs based on reuse of interface parts called features. Through the introduction of 5 design principles, we investigate the impact of feature-based reuse on Web APIs. Applying these principles enables a granular reuse of client and server code, documentation, and tools. Together, they can foster a measurable ecosystem with cross-API compatibility, opening the door to…
With the growing success of the social Web, most Web developers have to interact with at least one social Web platform, which implies studying the related API specifications. These are often only informally described, may contain errors, lack harmonization, and generally speaking make the developer's work difficult. Most attempts to solve this problem, proposing formal description languages for Web service APIs, have had limited success outside of B2B applications; we believe it is due to their top-down nature. In addition, a programmer dealing with one or several of these APIs has to deal wit…
Management of project planning, monitoring, scheduling, estimation and risk management are critical issues faced by a project manager during development life cycle of software. In RUP, project management is considered as core discipline whose activities are carried in all phases during development of software products. On other side service monitoring is considered as best practice of SOA which leads to availability, auditing, debugging and tracing process. In this paper, authors define a strategy to incorporate the service monitoring of SOA into RUP to improve the artifacts of project managem…
GraphQL is a query language for APIs and a runtime to execute queries. Using GraphQL queries, clients define precisely what data they wish to retrieve or mutate on a server, leading to fewer round trips and reduced response sizes. Although interest in GraphQL is on the rise, with increasing adoption at major organizations, little is known about what GraphQL interfaces look like in practice. This lack of knowledge makes it hard for providers to understand what practices promote idiomatic, easy-to-use APIs, and what pitfalls to avoid. To address this gap, we study the design of GraphQL interface…
While organizations want to develop software products with reduced cost and flexible scope, stories about the applicability of agile practices to improve project development and performance in the software industry are scarce and focused on specific methodologies such as Scrum and XP. Given these facts, this paper aims to investigate, through practitioners' perceptions of value, which agile practices are being used to improve two performance criteria for software projects-cost and scope. Using a multivariate statistical technique known as Exploratory Factor Analysis (EFA), the results suggest …
Producing secure software is challenging. The poor usability of security APIs makes this even harder. Many recommendations have been proposed to support developers by improving the usability of cryptography libraries and APIs; rooted in wider best practice guidance in software engineering and API design. In this SLR, we systematize knowledge regarding these recommendations. We identify and analyze 65 papers spanning 45 years, offering a total of 883 recommendations.We undertake a thematic analysis to identify 7 core ways to improve usability of APIs. We find that most of the recommendations fo…
The second Software Engineering Institute Product Line Practice Workshop was a hands-on meeting held in November 1997 to share industry practices in software product lines and to explore the technical and non-technical issues involved. This report synthesizes the workshop presentations and discussions, which identified factors involved in product line practices and analyzed issues in the areas of software engineering, technical management, and enterprise management.
RESTful APIs are arguably the most popular endpoints for accessing Web services. Blackbox testing is one of the emerging techniques for ensuring the reliability of RESTful APIs. The major challenge in testing RESTful APIs is the need for correct sequences of API operation calls for in-depth testing. To build meaningful operation call sequences, researchers have proposed techniques to learn and utilize the API dependencies based on OpenAPI specifications. However, these techniques either lack the overall awareness of how all the APIs are connected or the flexibility of adaptively fixing the lea…
Context: Refactoring is recognized as an effective practice to maintain evolving software systems. For software libraries, we study how library developers refactor their Application Programming Interfaces (APIs), especially when it impacts client users by breaking an API of the library. Objective: Our work aims to understand how clients that use a library API are affected by refactoring activities. We target popular libraries that potentially impact more library client users. Method: We distinguish between library APIs based on their client-usage (refereed to as client-used APIs) in order to u…
Context: Software security patch management purports to support the process of patching known software security vulnerabilities. Given the increasing recognition of the importance of software security patch management, it is important and timely to systematically review and synthesise the relevant literature on this topic. Objective: This paper aims at systematically reviewing the state of the art of software security patch management to identify the socio-technical challenges in this regard, reported solutions (i.e., approaches, tools, and practices), the rigour of the evaluation and the indu…
REpresentational State Transfer (REST) is considered as one standard software architectural style to build web APIs that can integrate software systems over the internet. However, while connecting systems, RESTful APIs might also break the dependent applications that rely on their services when they introduce breaking changes, e.g., an older version of the API is no longer supported. To warn developers promptly and thus prevent critical impact on downstream applications, a deprecated-removed model should be followed, and deprecation-related information such as alternative approaches should als…
Software engineering is one of the most recent additions in various disciplines of system engineering. It has emerged as a key obedience of system engineering in a quick succession of time. Various Software Engineering approaches are followed in order to produce comprehensive software solutions of affordable cost with reasonable delivery timeframe with less uncertainty. All these objectives are only satisfied when project's status is properly monitored and controlled; eXtreme Programming (XP) uses the best practices of AGILE methodology and helps in development of small size software very shar…
There is a lack of formal risk management techniques in agile software development methods Scrum. The need to manage risks in agile project management is also identified by various authors. Authors of this paper conducted a survey to find out the current practices in agile project management. Furthermore authors discuss the new integrated framework of Scrum and PRINCE2 with focus on risk management. Enrichment of Scrum with selected practices from the heavy-weight project management framework PRINCE2 promises better results in delivering software products especially in global development proje…
This article provides an overview of the Collective Knowledge technology (CK or cKnowledge). CK attempts to make it easier to reproduce ML&systems research, deploy ML models in production, and adapt them to continuously changing data sets, models, research techniques, software, and hardware. The CK concept is to decompose complex systems and ad-hoc research projects into reusable sub-components with unified APIs, CLI, and JSON meta description. Such components can be connected into portable workflows using DevOps principles combined with reusable automation actions, software detection plugins,…
Knowledge-intensive companies that adopt Agile Software Development (ASD) relay on efficient implementation of Knowledge Management (KM) strategies to promotes different Knowledge Processes (KPs) to gain competitive advantage. This study aims to explore how companies that adopt ASD implement KM strategies utilizing practices that promote the KPs in the different organizational layers. Through a systematic literature review, we analyzed 32 primary studies, selected by automated search and snowballing in the extant literature. To analyze the data, we applied narrative synthesis. Most of the iden…
This paper reports on our definition of guidelines for managing global software development (GSD) that implements the specific practice - manage requirements changes - of the Capability Maturity Model Integration (CMMI) Level 2. The guidelines present a model for change management and traceability that supports the implementation of the specific CMMI Level 2 goal. Also, to support the effective management of the system engineering processes, an adaptation of the Project Management Body of Knowledge (PMBOK) process group (PG) for project life-cycle practices is provided. We introduce a cloud-ba…
Managing Research Data, and making it available for use/reuse by others in line with the UKRI Concordat on Open Research Data and FAIR principles, is a major issue for research-intensive organisations. In this case study we outline an institute-wide review of data management in practice, carried out at the Rosalind Franklin Institute (The Franklin) in partnership with external consultants, Curlew Research, in March 2022. We aim to describe the processes involved in undertaking a review of the services already in place that support good practice in managing research data, and their uptake, with…
Several studies analyzed existing Web APIs against the constraints of REST to estimate the degree of REST compliance among state-of-the-art APIs. These studies revealed that only a small number of Web APIs are truly RESTful. Moreover, identified mismatches between theoretical REST concepts and practical implementations lead us to believe that practitioners perceive many rules and best practices aligned with these REST concepts differently in terms of their importance and impact on software quality. We therefore conducted a Delphi study in which we confronted eight Web API experts from industry…
IT operates in dynamic environments with the need always to change and adapt. There is a need to improve performance. Many gaps were found when we conduct the IT audit and we tried to seek to close gaps in capabilities. One way to the close these gaps is the adoption of good practices in wide industry use. There are several sources for good practices including public frameworks and standards such as ITIL, COBIT, CMMI, eSCM-SP, PRINCE2, ISO 9000, ISO/IEC 20000 and ISO/IEC 27001, etc. The paper propose ITIL frameworks to ITD Company for improving capabilities in service management.
Throughout 2021, GitGuardian's monitoring of public GitHub repositories revealed a two-fold increase in the number of secrets (database credentials, API keys, and other credentials) exposed compared to 2020, accumulating more than six million secrets. A systematic derivation of practices for managing secrets can help practitioners in secure development. The goal of our paper is to aid practitioners in avoiding the exposure of secrets by identifying secret management practices in software artifacts through a systematic derivation of practices disseminated in Internet artifacts. We conduct a gre…
Adoption of Large Language Models in Scrum Management: Insights from Brazilian Practitioners
VIRTUS Research, Development and Innovation Center (UFCG)（VIRTUS研究与创新中心（联邦大塞阿拉大学））；State University of Ceará (UECE)（塞阿拉州立大学）；Federal University of Cariri (UFCA)（卡拉里联邦大学）；Pontifical Catholic University of Rio de Janeiro (PUC-Rio)（里约热内卢天主教大学）
As software projects are very diverse, each software development process must be adjusted to the needs of the project and the corresponding development team. Frequently, we find different methods and practices combined in a so-called hybrid development method. Research has shown that these hybrid methods evolve over time and are devised based on experience. However, when devising a hybrid method, the methods and practices used should cover the whole software project with its different phases including, among others, project management, requirements analysis, quality management, risk management…
Detecting HTTP Status Code Misuses in REST APIs via Static and Dynamic Analysis
University of Namur（南纳慕尔大学）；Kristiania University of Applied Sciences（克里斯蒂安应用科学大学）；Oslo Metropolitan University（奥斯陆大都会大学）；SnT, University of Luxembourg（卢森堡大学科学与技术中心）
Tools for managing technical skills are used in many companies, but there has been little discussion about how such tools are used in practice. We report here on different types of actual usage in a medium-size software consulting company. We expected such tools to be used for allocating resources to new projects and for searching for competence to solve problems, but also observed two other types of usage: identifying new project opportunities, and skills upgrading. This multitude of uses support learning practices and motivates tool use both at individual and company levels, which is crucial…
This research, undertaken in highly structured software-intensive organizations, outlines challenges associated to agile, lean and DevOps practices and principles adoption. The approach collected data via a series of thirty (30) interviews, with practitioners from the EMEA region (Czech Republic, Estonia, Italy, Georgia, Greece, The Netherlands, Saudi Arabia, South Africa, UAE, UK), working in nine (9) different industry domains and ten (10) different countries. A set of agile, lean and DevOps practices and principles, which organizations choose to include in their DevOps adoption journeys wer…
Release management is one of the most important software processes and is a set of processes that includes the compilation, configuration, and management of software versions in different environments. In recent years, changes in processes, technologies, and tools and changes in practices and understanding have paved the way for more effective, efficient, sustainable, reusable models and methods in this field. The purpose of this study is to examine the DevOps idea to produce a flow, highlight their benefits, and investigate with a model how these philosophies, which are two of the most import…
Several studies have shown that automated support for different activities of the security patch management process has great potential for reducing delays in installing security patches. However, it is also important to understand how automation is used in practice, its limitations in meeting real-world needs and what practitioners really need, an area that has not been empirically investigated in the existing software engineering literature. This paper reports an empirical study aimed at investigating different aspects of automation for security patch management using semi-structured intervi…
Microservices have become a popular architectural style for data-driven applications, given their ability to functionally decompose an application into small and autonomous services to achieve scalability, strong isolation, and specialization of database systems to the workloads and data formats of each service. Despite the accelerating industrial adoption of this architectural style, an investigation of the state of the practice and challenges practitioners face regarding data management in microservices is lacking. To bridge this gap, we conducted a systematic literature review of representa…
Most programming languages, besides C, provide a native abstraction for character strings, but string APIs vary widely in size, expressiveness, and subjective convenience across languages. In Pharo, while at first glance the API of the String class seems rich, it often feels cumbersome in practice; to improve its usability, we faced the challenge of assessing its design. However, we found hardly any guideline about design forces and how they structure the design space, and no comprehensive analysis of the expected string operations and their different variations. In this article, we first anal…
Recent developments in the world of services on the Web show that both the number of available Web APIs as well as the applications built on top is constantly increasing. This trend is commonly attributed to the wide adoption of the REST architectural principles. Still, the development of Web APIs is rather autonomous and it is up to the providers to decide how to implement, expose and describe the Web APIs. The individual implementations are then commonly documented in textual form as part of a webpage, showing a wide variety in terms of content, structure and level of detail. As a result, cl…
An Empirical Study of OpenAI API Discussions on Stack Overflow
School of Artificial Intelligence and Computer Science, Nantong University（人工智能与计算机科学学院，南通大学）；State Key Lab. for Novel Software Technology, Nanjing University（新型软件技术国家重点实验室，南京大学）；Chang Chien College, Nantong University（长进学院，南通大学）；Computer School, Beijing Information Science and Technology University（计算机学院，北京信息科技大学）
本文首次对 Stack Overflow 上 2,874 个 OpenAI API 相关讨论进行实证研究，通过人工分类和主题建模识别开发人员面临的主要挑战，并为开发者、LLM 供应商和研究者提出可操作建议。
