Opening Keynote: The future of API (Platform) architecture

I started API Platform in 2014 as a tiny bundle for the Symfony framework. 7 years later, that tiny bundle has grown into a popular fully-fledged framework with a lot of features, server-side and client-side libraries and an awesome community.

The last 7 years has proven that API Platform design was the right one. Most apps are now API-driven, JavaScript is ubiquitous and the web of data powers most AI technologies and is the backbone of our modern societies.

What’s next? Let’s dive into the architecture that will power API Platform for the next 7 years!

Project “reboot” : Why PHP and Symfony are still into the game for any new project

In 2020 we faced an important challenge: reboot a project from scratch and think again the architecture and technologies chosen two years ago.

This talk explains why we chose Symfony + API-Platform + Mercure in order to build a fast and scalable application, easy to improve and maintain. The objective was to recode 4 years of work in 6 months.

Context: for the last couple of years, two in-house developers were in charge of developing an API entirely in NodeJS + GraphQL. NodeJS seemed a good choice at that…

The journey towards API Platform 3

API Platform’s first commit was made in January 2015, my first contribution came few months later in August. Since then, I’ve contributed to more then 200 commits and in the last years I’ve maintained the repository alongside Kevin Dunglas. Today we’re working on the next major release, API Platform 3 and it is quite a journey.

From fixing bugs to bringing simplicity by following the Symfony’s backward compatibility promise, I’ll explain how we planed and built this new version. I’ll explain our thought process, the issues we encountered, errors we made, and how we attempted to organise everything to bring you a clean and pleasant upgrade process! On top of this, we’ll cover every new feature you need to be aware of!

A suitable serialization with API Platform and Symfony

API Platform is built around the serialization process, which is the process of representing an object in a format that can be sent and persisted.

A strong dependency exists between API Platform and Symfony’s Serializer component. Both of them are providing several technical solutions about object serialization. Groups, ContextBuilders, Serializers, DataTransformers, DTOs, Access controls… So many available tools that are addressing specific needs. Some of them are easy to implement, others are powerful. But, how to choose the adapted technical solution according to its needs?

During this talk, we will cover some technical solutions and we will focus on the needs they try to address in order to use them wisely.

​

Better PHP Sites with the Caddy Web Server

​

Last year, API Platform refactored its stack to use Caddy as the web server, the crucial component that regulates all the traffic between your apps and clients.

Although application developers often overlook the web server, understanding it can improve the quality of your services, simplify your stack, reduce costs, and make you more productive.

In this talk by the Caddy author, learn how API Platform leverages Caddy to enhance your PHP apps with greater security and privacy, scalability, mobility, and a better overall developer experience.

API Platform Next.js client generator: contributing as a junior developer.

Next.js is now the default framework used to generate the client in the API Platform distribution, why? What are the latest changes, how can you use them?

More than a changelog, I’ll show you that you don’t need to be an expert to contribute to the API Platform project.

The API mindset: tech, product, business and legal

APIs are not anymore only technical interfaces. They are product interfaces, company interfaces, people interfaces, legal interfaces. In this talk, Mehdi will share with you ideas and stories from:

• The creation of the first APIs in 1968 and what we can still learn from them today
• How APIs become product in the last 10 years enabling the success of great companies like Stripe, Twilio, Sendgrid, Segment etc…
• What to understand to build the next 10 years’ APIs that will shape our programmable world.

Secure and Practical Authentication in API Platform

The Security part of your API is not something that belongs to API Platform itself. Instead, the framework lets you rely on the Symfony Security integration, including Symfony’s built-in authenticators and community bundles that build on top of it.

Stateful VS stateless, Cookies VS Headers, Standard protocols VS home-made authentication flows… There’s a lot of alternatives, which can make it very hard to find the right one.

In this talk we will review all these possibilities to see how you should secure your API depending on your application and infrastructure. Last but not least, we will discover a novelty that will help solving this issue.

Sylius and API Platform. The story of integration

Being a part of the Symfony ecosystem gives access to the vast number of open-source solutions built on top. A lot of people voluntarily committed the time to make impressive, multipurpose solutions. One of these solutions is the API Platform, the most mature framework for API development.

In Sylius, it was always our goal to take advantage of the best of the breed and integrate with others. Keeping this in mind, we have decided to combine both projects and deliver a new quality in the headless e-commerce world.

How did it go to integrate new infrastructure to the existing, pretty big codebase? What were the main challenges that we encountered, and how did we solve them? What are the key take-outs from our integrations? I will answer these and a few more questions during my talk.

How To Become A React-admin Grandmaster In 237 Easy Steps

​

From the users’ point of view, the auto-generated admin based on your API Platform backend isn’t much better than PhpMyAdmin.

Beyond data grids and forms, the react-admin library offers tons of hooks, components and UI elements that can turn a boring admin into an app that is a joy to us. Yes, even for customer facing apps! And if you don’t speak JS, this talk might be the one that convinces you to dive in.

Unified permission management between API and client

API Platform offers the possibility of creating robust and modular applications, however it is common to require a permissions system to manage users and their abilities.

I will present in this talk my implementation to operate an advanced permissions system based on multiple criterias, in a unified way. This allows flexible and automatic management of both the security of the API (access control for resources, automatic filters, etc.) but also the security of the client (in Vue.js), to control the UI and its functionalities according to the current user’s rights, transparent hot reload of permissions included in case of modifications!

API Horror Stories from an Unnamed Coworking Company

I got a call from a friend who worked for Unnamed Coworking Company, “Phil, our APIs are all terrible, can you come and help?” After 18 months of almost daily P1’s and P0’s, I left that company drastically better off than it was, and picked up a lot of hilarious stories.

1) Monoliths? Megaliths!

Two giant monolith APIs handled pretty much everything, every single system would need something from one of them, whether is was OAuth tokens, user information, company information, billing and subscription details, etc. These megaliths had at least 20 upstream dependencies, so if any of those out, half the company would go down. No timeouts were used anywhere, so random 10s responses were common.

2) Mututally Assured Destruction

Both megaliths asl relied on each other, so if either one slows down they both get infinitely slower, and then the entire company crashes, because literally no application would work without these two services being up.

3) Blocking Processes Blocking People

You’ve turned up on the first of the month to start working at your new office, but the keycard system is taking 2 minutes per card per attempt, and all those blocking synchronous attempts have knocked over the entire ecosystem of the whole company. You’ll have to ask reception to use the bathroom until we “fix it” (demand reduces).

4) No Time for Docs, Let’s Rewrite!

Seeing as nothing was ever documented, “there’s no time for documentation!” Later we’d forget how endpoints worked, which was “fine” because the client wasnt changing, but if a new client appeared we’d have to write a brand new version of the endpoint which had different requirements so other clients could use it.

5) Mystery Stampeding Herd

Something is knocking over our systems, but we only know it’s using Faraday v0.8.7, which application is that?

All this, and more, in a fun and whacky ride of when everything goes wrong and nobody else knows how to stop it happening again.

French tech & Start up Nation, what else?

This is a little ethico-practical questioning on the future of digital technology. I’d like to talk about the questions that are bothering me about our responsibility but also our capacity to act on the tools and services we create every day.

What if, together, we had more power than it seems?

Why JSON-LD and what is it?

From its infancy, API Platform enables developers to create JSON-LD APIs. The “-LD” part is often forgotten.

In this talk, I will walk you through what is JSON-LD and the very much related Resource Description Framework (RDF) and why they exist. We will discuss its importance in this growing world of data and how such formats enable interoperability and decentralisation.

Symfony Runtime: wrapping API Platform in a lambda

Symfony 5.3 has released a new component named Runtime. It allows to encapsulate any PHP application in a closure, to get all the benefits of functional programming. Especially, it allows to separate the applications from global variables. Being now free of any implicit context, our applications will be able to be moved from one execution engine to another. PHP-FPM, ReactPHP, AWS Lambda, Swoole, etc.?

Let me introduce you to a component that could become essential soon in the PHP ecosystem. If you are interested in high performance of course!