API development checklist

A summary, with links, of the key tasks for developing APIs in IBM® API Connect.

Task	Description
Set up the toolkit	The developer toolkit provides a command-line environment and an API Designer user interface, both of which enable you to develop and work with your APIs on your local machine; you publish your APIs to the Management server when ready. You can also develop your APIs directly on the Management server by using the API Manager user interface.
Create your API definitions	You can create API definitions in the following ways: Create a REST API definition either by composing the API definition, and its operations, from scratch, creating a proxy API that calls an existing endpoint, or importing an OpenAPI definition. Expose an existing SOAP service as an API. Create a GraphQL API proxy definition that proxies a backend GraphQL server.
Secure your APIs (OpenAPI 2.0) Secure your APIs (OpenAPI 3.0)	You configure security for an API by creating one or more security definitions that you then apply to your API, and to the operations in your API. Security mechanisms include basic authentication through a user registry, and token based authentication with OAuth.
Test your APIs	The user interfaces provide a test tool with which you can test your APIs through the gateway.
Productize and publish your APIs	To make your APIs available to application developers, you include them in a Product that you then publish to the gateway.
Apply visibility controls and rate limiting to your APIs	Visibility settings control which APIs the application developers can subscribe to. Rate limiting controls the usage of your APIs; for example, you can apply a rate limit of 100 calls per minute.
Develop your APIs by using the developer toolkit CLI	You can use the developer toolkit CLI to develop APIs based on OpenAPI definition files in YAML or JSON format.
Optionally add the API Connect outbound IP addresses to an allow-list	If you only want to allow connections from API Connect Enterprise as a Service for your application, add the IP addresses to an allow-list on your back-end system.