Integration & Platform Engineering · Banking & Financial Services · 4 min read
One Gateway to Rule Them All: Building an API-First Enterprise
70% faster
Reduction in time to integrate new third-party products and services
A regional bank with 17 disconnected legacy systems and no API strategy went from a 6-month average integration timeline to under 3 weeks, by building a centralized API platform that made every internal system consumable, composable, and secure.
Overview
Modern banking is an ecosystem business. The winners aren't always the banks with the best products, they're the ones who can partner, integrate, and distribute the fastest. A regional private bank that had grown through acquisitions found itself managing 17 disparate backend systems, each with its own connectivity model, authentication scheme, and data format. Building a new mobile feature meant negotiating with five different system teams. Onboarding a fintech partner took 6 months. The technical architecture was actively slowing business strategy. BlueeBlack was engaged to design and deliver an API Management platform that would turn the bank's system portfolio into a composable, secure, and developer-friendly platform.
The Challenge
The bank's integration landscape was a product of acquisition history and organic growth, not design. Legacy core banking systems, a third-party loan origination platform, an independent payments processor, separate insurance and investment platforms, and a home-grown mobile banking backend communicated through a web of point-to-point integrations: custom connectors, SOAP services, file-based batch transfers, and undocumented direct database queries. The "integration" team spent most of its time keeping existing connections alive, with little capacity for new work.
- 0117 backend systems with incompatible protocols (REST, SOAP, flat files, proprietary APIs)
- 02No API gateway, every integration was a bespoke, one-off build
- 03Average time to onboard a new fintech or open banking partner: 6 months
- 04No centralized authentication or authorization, each system managed its own security
- 05Zero API documentation, institutional knowledge lived only in the heads of long-tenure engineers
- 06Four separate mobile app backends, each calling different systems, changes required parallel updates across all four
The Approach
BlueeBlack began with a 4-week API Portfolio Assessment, cataloguing all 17 systems, their existing integrations, data models, and ownership. We identified 4 "integration-heavy" systems that accounted for 80% of all cross-system traffic, these became the first phase of the API platform build. We adopted a three-layer architecture: a Kong-based API Gateway for traffic management, authentication, and rate limiting; an Integration Middleware layer for protocol translation and data transformation; and a Developer Portal for internal teams and external partners to discover, test, and onboard APIs without involving the integration team.
What we built
- API Gateway (Kong Enterprise)Centralized gateway handling all inbound and outbound API traffic with OAuth 2.0, JWT authentication, rate limiting, and IP whitelisting as configurable policies
- Integration MiddlewareEvent-driven transformation layer handling protocol translation (SOAP-to-REST, flat-file-to-JSON), data normalization, and orchestration of multi-system workflows
- Developer PortalSelf-service portal with full API documentation (OpenAPI 3.0 specs), interactive sandbox testing, and API key provisioning, enabling fintech partners to integrate without manual handholding
- Event Bus (Apache Kafka)Asynchronous messaging layer for high-volume, event-driven integrations (transaction notifications, account events) reducing synchronous coupling
- Observability & SLA MonitoringPer-API latency, error rate, and usage analytics with SLA alerting and automated circuit-breaking
- Unified Mobile BackendConsolidation of four mobile backends into a single API layer, with client-specific response shaping
The Outcome
The first external fintech partner was onboarded in 17 days, against a historical baseline of 6 months. Internal teams reported that building new mobile features, which previously required coordinating across 4+ system teams, now required a single API call to the gateway. The bank launched an open banking program, previously considered impossible within the existing architecture, within 8 months of the platform going live. The integration team's composition shifted: maintenance work dropped from 80% of capacity to 35%, with the remainder redirected to building new API products.
Services — Platform Engineering · API Strategy · Systems Integration · Enterprise Architecture
Stack — Kong Enterprise · Apache Kafka · Node.js (middleware) · PostgreSQL · OpenAPI 3.0 · OAuth 2.0 · Docker · Kubernetes · AWS · Grafana
Impact at a glance
- Average partner integration time
- 6 months17 days
- Systems with documented APIs
- 2 of 1717 of 17
- Integration team time on maintenance
- 80%35%
- New mobile feature delivery time
- 6–8 weeks1–2 weeks
- Point-to-point integrations
- 436 (residual)
- Open banking partnerships enabled
- 0Active program
Next case study
When the Numbers Lie: Building a Data Platform That Tells the Truth
Be the nextwrite-up.
Free consultation · Replies within 24–48 hours