Deutsche Bank adopts Google Cloud's Apigee for APIs

Deutsche Bank has adopted Google Cloud's Apigee as its central API management platform. The system now manages the bank's API ecosystem across internal services, partner connections and customer applications.

The move is central to Deutsche Bank's effort to replace a legacy estate built around monolithic systems with a more modular architecture. The platform is used to catalogue endpoints, apply security rules and oversee governance for APIs used in open banking, internal microservices and digital banking channels.

APIs have become central to how banks connect systems, share data and deliver services to customers and partners. Deutsche Bank said it needed a single management layer rather than separate teams building and governing interfaces independently.

Every endpoint, version and dependency is documented in a central catalogue, allowing development teams to find and reuse existing APIs instead of creating new ones for the same task. The platform also enforces standards such as OpenAPI specifications, schema validation and error handling through its policy framework.

Security controls

Security is one of the main areas where Deutsche Bank said the platform has changed its approach. The bank described its model as based on least-privilege access, using OAuth2 scopes and API key management to define what a service or application can reach.

That means a service can be limited to narrow functions such as reading account balances or recent transaction history, while more sensitive actions or deeper access require higher permissions. Access rights are centrally managed, audited and can be revoked quickly, according to Deutsche Bank.

The platform also records each API call, giving teams a log of who accessed what data and when. That level of traceability is particularly relevant for automated systems, which may generate very high volumes of requests if they are misconfigured.

Rate limits and quotas are used to contain the effects of faulty or excessive traffic. Deutsche Bank said those controls help reduce the impact when systems behave unexpectedly.

Operations view

Another focus is resilience. Deutsche Bank said the platform uses load balancing and auto-scaling to spread traffic across services, while health checks and circuit breakers help steer requests away from struggling systems.

For frequently accessed information, caching can return responses without placing additional load on underlying systems. This is important for services that must remain available around the clock, including balance checks and trading-related activity.

The platform also gives Deutsche Bank a single operational view of API traffic, error rates, usage by consumer and compliance measures. Operations teams, product managers and security teams use that data to monitor performance and identify unusual patterns.

Before adopting the platform, Deutsche Bank said its view of API performance was fragmented across different tools and systems. Bringing those measures together in unified dashboards has made it easier to track service quality and partner usage.

Banking shift

The broader shift reflects how large banks are reworking technology estates built long before open banking, fintech partnerships and mobile-first services became standard. Instead of exposing functions from isolated systems on an ad hoc basis, banks are increasingly putting API management layers in place to standardise access, documentation and controls.

Deutsche Bank linked that work to the growing use of more automated and data-driven services across financial institutions. It said newer forms of software, including systems that rely on real-time pattern recognition, predictive tools and AI-supported assistants, will place further demands on API infrastructure.

Those demands include lower latency, higher data throughput and secure orchestration across several APIs at once. Deutsche Bank said putting a flexible management platform in place means it can adapt that infrastructure rather than rebuild it as requirements change.

The bank also pointed to emerging integration standards including Model Context Protocol and Agent2Agent. Deutsche Bank said those approaches build on existing API infrastructure and could use elements already established in its environment, including OpenAPI specifications, OAuth2 controls and central governance.

It is also examining how newer types of servers and workflows could sit behind Apigee proxies, allowing the bank to keep security controls in place while supporting newer integration patterns. Internally, Deutsche Bank described this as an "always-API" approach, in which central management remains in place regardless of how services are consumed.

The bank outlined several lessons from the programme, including the importance of detailed documentation, role-based security and unified analytics. It also argued that API management should be treated as a long-term integration layer rather than a narrow tool for developers.

"Every banking capability will eventually be exposed as an API," Deutsche Bank said.