India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
API Enablement: Turning Legacy Systems into Secure, Versioned APIs
API enablement exposes capabilities locked inside legacy applications, such as core systems, SOAP services, stored procedures or batch files, as secure, versioned APIs that apps and partners can consume. NTSPL designs the API contracts, builds the facade and anti-corruption layer, and configures the gateway, identity and developer portal for lenders, cooperatives, insurers and other enterprises opening up to partners.
Delivered on
In scope
Why point-to-point integrations stall partner growth
Most Indian enterprises already have something they call APIs: a WSDL from 2011, a twice-daily SFTP drop, a DSA portal that screen-scrapes the loan system, and three point-to-point links nobody dares restart. Every new partner, whether a DSA aggregator, a bank for payouts or an Account Aggregator flow, becomes a 10-14 week custom project. Credentials are shared, rate limits do not exist, and when the core slows down every channel fails with it. The real problem is not missing endpoints; the core's data model leaks to every consumer, so nothing can change.
NTSPL starts with consumers, not the core. We catalogue the 20-40 operations partners and channels actually need, write OpenAPI 3.1 contracts in business language, and put an anti-corruption layer between those contracts and the legacy model. A managed gateway handles OAuth 2.0, mTLS for regulated partners, quotas and versioning, while caching and asynchronous patterns shield the core from bursts. Partners onboard themselves through a portal with a sandbox seeded with synthetic data.
When an API layer over legacy systems pays back
Signals you need API Enablement
- Onboarding each new partner (DSA, bank, aggregator, marketplace) takes 8+ weeks of custom integration.
- More than five consumers query the same legacy database directly or through shared service accounts.
- Unversioned SOAP or XML-over-HTTP services break the mobile app whenever the core is patched.
- Partner traffic at month-end or festival peaks pushes core CPU above 85% and slows branch users.
- Auditors flag shared credentials, missing rate limits or no per-partner audit trail on integrations.
When to choose something else
- High-volume asynchronous data movement between internal systems (CDC, events, file feeds) belongs to Cloud Native Integration, not a request-response API layer.
- If your core vendor already ships a supported API pack, license and govern it rather than building a facade.
- With one internal consumer and no partners planned, a direct service call costs less than a gateway programme.
API programme components we build
API catalogue and contracts
Operations listed from logs and consumer interviews; OpenAPI 3.1 contracts with error models, pagination and idempotency keys.
Facade and anti-corruption layer
Adapters that translate business resources into SOAP, stored-procedure, MQ or screen calls, hiding core codes and field names.
Gateway and security
OAuth 2.0/OIDC, mTLS for regulated partners, per-client quotas, payload validation and WAF rules.
Core protection
Response caching, async 202-accepted patterns and circuit breakers that cap partner load at a set share of core capacity.
Developer portal and sandbox
Self-service documentation, credentials, synthetic-data sandbox and an onboarding checklist.
Versioning and lifecycle
Major versions in the path, deprecation headers, consumer contract tests and per-partner usage analytics.
Contract-first facade over a legacy core
Contract-First API Facade over a Legacy Core
Partner and channel calls enter a managed gateway that authenticates, throttles and validates them against OpenAPI contracts. Facade services translate each business resource into calls the legacy core understands, with caching and async queues limiting the load that reaches the core.
Select any component
Contract-First API Facade over a Legacy Core: click any of its 10 components to see its role and the design choice NTSPL makes for it, or trace the 6-step primary path.
API gateways and tooling by cloud
We use API Gateway REST APIs with usage plans for per-partner quotas and mutual TLS on custom domains. Long-running SOAP calls run on ECS rather than Lambda to avoid integration timeouts.
API Management products and subscriptions map neatly to partner tiers, and its self-hosted gateway can sit beside an on-premises core that has not moved yet.
Apigee suits ecosystems of 50+ partners needing analytics or monetisation; smaller programmes use API Gateway with Cloud Run facades to keep cost proportional.
API design calls that are hard to reverse
Facade granularity
Model APIs on business resources such as loan application, disbursal status or farmer payout, not on core transactions. A useful test: if a partner needs more than three calls to complete one business step, the facade is too thin. Keep each facade service under about 15 operations and owned by one team; beyond that, split by resource.
Synchronous or asynchronous
Keep an operation synchronous only if the core answers within 800 ms at p95. For slower work, such as credit bureau pulls or batch-posted payments, return 202 with a status URL or a webhook. This keeps gateway timeouts out of the picture and lets a queue absorb month-end bursts instead of the core.
Partner authentication
Use OAuth 2.0 client credentials with scopes per API product for most partners, and add mTLS for banks and regulated entities that require it. Never accept a static API key alone for write operations. Rotate client secrets every 90 days and automate rotation through the developer portal so it actually happens.
Versioning policy
Put major versions in the path (v1, v2) and allow additive changes without a bump. Support each major version for at least 12 months after its successor ships, publish deprecation and sunset headers, and use per-partner analytics to contact remaining callers 90 days before retirement rather than discovering them on shutdown day.
From API catalogue to first partner live
Consumer and call catalogue
Mine web-server and database logs and interview partners to list the operations really used and their volumes.
Contract design
Write OpenAPI 3.1 contracts and the error model, reviewed with business owners and two pilot partners.
Facade build
Build anti-corruption services, caching and async patterns, tested against recorded core responses.
Gateway, identity and portal
Configure policies, OAuth and mTLS, quotas, WAF and the sandbox portal as code.
Pilot partner and load test
Load test at 3x forecast peak, onboard one pilot partner, then open the portal to the next cohort.
What you receive
API programme health indicators
| KPI | Typical target |
|---|---|
| Partner onboarding time | Under 3 weeks |
| Core CPU consumed by API traffic at peak | Capped at 25-30% |
| p95 latency of synchronous operations | Under 800 ms |
| Breaking changes shipped within a major version | Zero |
| Share of integrations routed through the gateway | Over 90% within 12 months |
Failure modes when exposing legacy systems
| Risk | How NTSPL prevents it |
|---|---|
| Leaking the core's data model through the API | Contracts are reviewed against a list of banned core field names and codes before approval. |
| Partner bursts degrading branch users | Quotas and facade concurrency limits are set from core capacity tests; heavy reads go to cache or a replica. |
| Shadow integrations surviving beside the gateway | Direct database users and SFTP drops are inventoried, each with a retirement date and account removal as the exit test. |
| Security review blocking launch late | Threat modelling against the OWASP API Security Top 10 happens at contract stage, not after build. |
Apigee, Azure API Management or Amazon API Gateway for legacy API enablement?
Choose by where your consumers and core sit, not by feature lists. Azure API Management fits when the core stays on-premises for a while: its self-hosted gateway runs next to the legacy system and the built-in developer portal manages partner subscriptions. Apigee is strongest for large partner ecosystems that need analytics, monetisation and complex policy chains, at a higher base cost. Amazon API Gateway is the cheapest for usage-priced, AWS-hosted facades, but needs extra work for a branded partner portal. For most Indian mid-market programmes with under 30 partners, API Management or API Gateway is enough.
Key facts: API Enablement
API Enablement in Practice
2 API Enablement scenarios, from Housing finance (HFC) and Cooperative dairy, plus related platform case studies.
Housing finance company cuts aggregator onboarding from 12 weeks to 9 days with APIs
Milk union exposes farmer payment and milk-pour data to three banks through APIs
Small finance bank onboards fintech partners in 3 weeks instead of 4 months
Dealership group cuts OEM warranty claim rejections by integrating DMS through Service Bus
API Enablement: Frequently Asked Questions
What does an API enablement programme cost?
A first release of 20-30 operations with gateway, portal and two pilot partners typically takes 8-10 weeks and INR 25-45 lakh in services. Gateway run cost ranges from about INR 15,000 a month on usage-priced gateways to several lakh a month for enterprise tiers, so we size the gateway to expected partner volume.
How do API controls map to RBI and CERT-In requirements?
For RBI-regulated entities we apply mTLS and scoped OAuth for partner access, per-partner audit logs and data minimisation in responses, in line with RBI's 2023 Master Direction on IT governance, risk, controls and assurance. Gateway logs stay in India for 180 days to meet CERT-In's April 2022 directions, and API incidents feed your 6-hour reporting process.
Can you expose a mainframe or AS/400 system?
Yes, through interfaces it already has: CICS transactions, MQ queues, Db2 stored procedures or RPG programs behind connectors. The facade runs off-platform, so the mainframe sees the same transaction types as today, and cached reference data reduces MIPS consumption and batch-window pressure.
Should partner APIs use GraphQL instead of REST?
Use REST for partner APIs: it is easier to secure, cache and rate-limit per operation, and partners expect OpenAPI documents. GraphQL works well as a backend-for-frontend for your own mobile app, where screens combine several resources, sitting behind the same gateway.
How do we stop partners breaking when the core is upgraded?
The anti-corruption layer absorbs core changes. When core fields or codes change, only the adapter changes and the contract stays fixed. Consumer contract tests run in the facade pipeline, so a core upgrade that would break a partner fails the build before it reaches production.
How should APIs handle personal data under the DPDP Act 2023?
Each operation returns only the fields its purpose needs. Identifiers such as Aadhaar and account numbers are masked by default, and consent or purpose references are logged where the business process requires them, keeping the API layer consistent with DPDP purpose limitation.