Qantas makes architectural changes to its API management platform

Qantas has made a series of architectural changes to its API management platform, improving its reliability and resiliency, which has encouraged usage.

Speaking at WSO2Con Asia 2025 in Sri Lanka at the end of last month, principal engineer in the integration and engineering domain at Qantas IT, Waleed Ahmed, said the airline has used the open source WSO2 API Management as the foundation of its platform since 2018.

“Since the introduction of the platform, we have done multiple successful upgrades and migration projects to evolve the platform [and to] adopt the new features introduced in WSO2 products,” Ahmed said.

The ability to evolve largely came about by moving to version 4.1 of the platform, which was released back in April 2022.

Before then, the platform was cloud-based but had some architectural limitations, according to Ahmed.

“The deployment was database-centric … [with] almost all the components connected to the centralised database,” he said.

“We were heavily reliant on disk storage for some state sharing between the data plane and the control plane, and we were also relying on custom plugins and [the] WSO2 - Analytics product, which no longer exists, as well as [the] business process manager of WSO2. 

“Although the platform was performant, the number of components was large, [and] we had challenges making all the components highly available.

“[Additionally], because of the dependency on the database, we were having some restrictions on scaling up the data plane to cope with increased or changing traffic needs.”

The airline treated the version upgrade as an impetus to “transition to an event-hub architecture”, based on changes made to WSO2 API Management from version 3.2 on.

“The beauty of this architecture is that we are able to eliminate all the need to have any disk space or sharing between the data plane and the control plane,” Ahmed said.

“This not only helped us to have an agile and stateless platform but also to be able to extend the deployments of the data plane into different areas like embedding the data plane or new data plane sets into our service mesh, without almost any change in the deployment configuration or the API landscape definitions.”

Ahmed said that with an event-driven architectural setup, “the data plane no longer depends on the database altogether.”

“So, this new platform architecture allowed us not only to get off the hard dependency of disk and database-centric deployments, but also to implement high availability on all the components,” he said.

The second architectural change saw Qantas containerise the API management platform.

This, Ahmed said, aligned the platform with Qantas’ “immutable infrastructure strategy” and also led to security and maintainability improvements.

Other changes made to the platform were to enhance observability and logging, providing “deep visibility on the API traffic in general but also on how the platform is behaving.”

The intent was to enable “API developers or backend engineers to troubleshoot issues, and find trending errors or any kind of differences in the API traffic.”

“This gives us real proactive and early detection of errors in a safe way that we can share with almost all the tenants in the platform,” Ahmed said.

The airline also built “a unified API lifecycle management interface” that embeds “governance and control logic to all the APIs onboarded to the platform from the very early days of API development.”

“For example, if someone is trying to deploy an API to the internet for the very first time, we block this exposure of the API to the internet until we are sure that the security assessment process has been implemented,” Ahmed said.

The overall result of these efforts is a “really highly resilient platform that can withstand issues in different components or even in its main database,” he added.

“Yes, anything can fail, but we are able to recover and isolate issues with a more streamlined approach.

“With this reliability and resiliency, we are able to build communities around the platform, which is the most important achievement that we are able to get from having [this] trustworthy platform.”

Ahmed added that the platform had had “zero outages” and a “very minimal number of critical incidents” over the past two years.