Mashery (now part of Boomi) vs. Salt Security API Protection Platform

Mashery is great when it comes to deployment to your own datacenter and when it comes to managing third party API's like Salesforce using Mashery Cloud version. I would be a little bit more careful when deploying it on Kubernetes as it was not designed for it. New version 5 is re-architected to run more on natively on Kubernetes, but we have not tested it yet.

Incentivized

Salt is highly recommended for anyone who wants to discover, monitor and protect their APIs against various types of attacks. Salt should not be used as a SIEM.

• Easy integration of the TIBCO Cloud Mashery developer portal allows simple onboarding and user and application management.
• Configuration of TIBCO Cloud Mashery is both flexible and focused to address the main tasks for an API Management solution.
• The built-in OAuth Token capabilities provide a quick start to properly manage application access.

Incentivized

• PII identification in API traffic.
• Divergence between API traffic and documentation (swagger files).
• Potential attacks with information to take counter measures.

• The "Control Center" admin dashboard is not performant. We have a lot of configuration data in Mashery (many endpoints, many plans, many users, many keys, etc.) and the website struggles with the volume of data it has to deal with.
• Their systems have limitations that make it more difficult for us to operate the way we would like. For example, there is a limit to the number of API Definitions we can create, as well as a limit to the number of Endpoints we can define in a Plan.
• Their support organization leaves a lot to be desired. Responses are slow, and when they do come they are often inadequate. We have to re-phrase the question to get them to answer it differently, or we have to repeatedly follow up to ask for additional clarifying information.

Incentivized

• The platform could have more options for exporting detailed data from attackers' dashboards.
• The Attackers dashboard could also have more options of filters in order to support the investigations of the attack.
• The OAS analysis could present a more detailed view of the found issues.

Ease of use.

Incentivized

i find some of the package adding and key are complex . UI experience is bad . Every step need front and backward navigation too much. It would be better if endpoint itself contain package and key addiction option

Incentivized

Support has been good overall.

Incentivized

Initially it was difficult to understand . after few day , it was easy

Incentivized

I've really only looked at Mashery since it has been around a very long time and has a rich feature set. I do know our platform teams are looking into AWS gateway but not sure this product has everything we need.

Incentivized

We tried controls offered by the IaaS providers but these were hard to manage and did not provide the visibility we wanted. We also protected APIs with a normal WAF but this was only helpful for assets we knew about and API attacks were not caught by the WAF.

• As a API Mediation layer it has helped with the troublesome port setup with internal and external clients. Meaning it made that easy to the client that they know where to go for access to an API.
• The interactive documentation is very well put together and has reduced the time that developers have to go back and forth with each other to figure how to call the API.

Incentivized

• Salt Security API Protection Platform has provided detailed information that is helping us to identify and investigate attacks in our environment