How to best to handle complex flow logic?

We’re currently looking at how best to handle certain flows in our infrastructure. Whenever we have complex flows in API proxies, we end up with hard to maintain code, and we’re looking for a solution.

For example, we have one API that places an order. During the ‘place order’ API call, if the user is not known, we perform a service callout to create a customer record. If the callout fails, we still want to continue with the ‘place order’, but without a customer. If the call does succeed we want to use the new customer and create a login account for them. And so on. In these cases we end with long chains of policies, with complex conditions on each step.

It’s hard to read, error prone, and hard to extend.

We’re trying to find a way to create more maintainable code in the above situation. Shared flows don’t help, because they spread the logic across different places, making it harder to read and code, and still require complex conditions.

Hosted targets seem like the solution here, but…When we use hosted targets in the above scenario, we have to perform calls from the hosted target to our back-office systems. However, hosted targets lack access to key-value maps, target servers, and certificates, etc. meaning we have to code target server information and security measures inside the hosted targets. That’s not ideal.

The calls from the hosted target also don’t end up in the analytics, meaning we have no way to see what the load on our back-office is.

Another solution would be to move the above code from Apigee to back-ends. However, that means adding an extra layer of software, which we then have to maintain and monitor.

My questions are:

• How have other people handled similar scenarios?
• Are hosted targets the way to go?
• If so, will future updates add the ability to access target servers, add analytics, etc.?
• If there are other alternatives besides hosted targets, what are they?
• How best to monitor load on back-office systems in these cases?