One of the mutiple requests to review APIs currently in my inbox, is from the camera platform Dropcam. Every email or tweet I get, asking me to review an API, I at least click in to see what is happening, looking for that good story.
Sometimes the API itself, can be good enough to be the “thing” that I tell a story about, but most often it is about a specific approach the API provider takes. Regardless, I look throughr all aspects of an API, sign up for an account, play with endpoints, look through documentation and code, and terms of service—trying to find any angle for a compelling story.
When I clicked into Dropcam's developer area, I can’t sign up for the API, play with endpoints, review documentation and code, but I can look at terms of service! Dropcam asks that you apply to be part of their beta program, before you can look at or play with anything.
Dropcam assures me that their API is RESTful and uses its verbs, with all endpoints using HTTPS, and requests and responses in JSON. Dropcam uses oAuth for authentication and authorization, showing that all the proper technology and security building blocks are in place--thing is I need to see for myself.
I can understand putting an approval layer at the point someone wants to take their application public, but if someone owns a Dropcam, they should be able to signup and start hacking on their device and the supporting cloud infrastructure. With modern API management infrastructure you have the power to control what resources developers have access to, with identify the bad actors, without limiting who has access to learn about your platform.
Most importantly it prevents people like me from just reviewing the endpoints, documentation and the real meat of the Dropcam developer program. I’m not building an application, I just want to write a story about what is possible, and without playing with it I can’t do that. I’m not like many other tech journalists who will take a press release and rewrite it—I want to play!!
So far, that is my review Dropcam. Sorry. ;-(
