Skip to content

Key Concepts

APIs

APIs are the building blocks of API Manager. They represent a set of operations that developers can use in their apps. Each API is linked to a backend service that implements it, and its operations correspond to backend operations.

In API Manager, you can customize operations by controlling the domain name, versioning, environment, and endpoints.

Group APIs

You can group individual APIs for better organization and control over API consumption.

For instance, a healthcare organization that offers various APIs related to patient management, appointment scheduling, and medical records can group these APIs into a "Healthcare Services" group.

The organization can provide internal and partner users with easy access to all the relevant APIs they need for building healthcare applications. This grouping helps streamline the development process, ensures consistent permissions control, and allows for centralized management of the APIs within the group.

Organizations

API Manager provides a way to manage APIs on a large scale and create separate environments for different API services and consumers. Organizations are like workspaces that allow users to develop or consume APIs within a specific organization.

There are three types of organizations:

  1. Master Organization: This organization is created during the deployment of the API Manager and serves as the main organization for the platform.
  2. Internal Organization: Internal organizations represent workspaces for various API services within the organization. They provide separate instances of the API Manager platform for users to develop and publish their APIs.
  3. API Partner Organization: API partner organizations are external entities, such as vendors or partners, who want to consume the APIs provided by the organization. They have limited roles and permissions based on their specific partnership or vendor agreement.

Using organizations helps in segregating resources and providing a user-friendly environment for each organization within the API Manager. It allows users to onboard new APIs and consume resources specific to their organization without affecting other organizations on the platform.

For example, a bank-based organization may have internal organizations for loans, insurance, and accounts. Each internal organization represents a specific set of APIs related to that service. Additionally, the bank can invite API partner organizations, such as a fintech company, to consume their APIs for services like insurance or accounts.

Overall, organizations in API Manager provide a structured and controlled approach to managing APIs, ensuring efficient collaboration and resource allocation among different API services and consumers.

Users

Internal users: Internal users are individuals who are part of the organization or company that manages the API Manager. They have access to various roles and permissions within the API Manager platform.

Partner users: Partner users are individuals from external organizations who have been invited to consume the APIs provided by the organization using the API Manager. They may have limited access and specific permissions based on their role.

User Roles:

  • Admin: Admins have full access and control over the API Manager platform. They can manage APIs, subscriptions, users, and other related entities.
  • API Developer: Developer API users can deploy APIs to the marketplace, create subscriptions, and perform other related tasks.
  • API Consumer: Consumer API users can consume the APIs by subscribing to them or using them in their applications.
  • API Product Manager: PM API users have the role of inviting partner organizations to consume the APIs provided by the organization.

Rate Plans and Subscriptions

Rate plans define pricing and transaction limits for APIs and API Groups. Subscriptions are access deals between providers and consumers under those plans. See Rate Plans, Create Subscriptions, API Preferences, and API Group Preferences.

Gateway Environments and KVM

Gateway environments group domains for routing and API promotion. KVM Store holds environment-scoped key-value maps for gateway configuration. See Environments and KVM Store.

Approval Workflows

Manual approval workflows can gate API publish actions, subscription creation when rate plans are attached, and application creation. See Approval Workflows.

Gateway Policies

An API Gateway acts as a protective layer for backend services, routing calls, and preventing direct access to the backend. It achieves this through the implementation of gateway policies, which control the behavior of the API Gateway and ensure the security, reliability, and performance of the APIs.

You can create gateway policies and attach them to APIs to control and customize how requests are processed within your organization. These policies help ensure security, reliability, performance, and governance across your API ecosystem.

The available gateway policies include:

  • Throttling Policy – Limits the number of API requests allowed within a specified time interval (per second, minute, or hour) to prevent API misuse and maintain fair usage.
  • Blacklist IP Address Policy – Blocks a specific range of IP addresses from accessing the API for security or compliance purposes.
  • Whitelist IP Address Policy – Grants access only to approved IP addresses to ensure trusted API consumption.
  • Message Signature Policy – Validates the integrity and authenticity of requests by verifying the signature in API messages.
  • Load Balancing Policy – Distributes incoming traffic intelligently across multiple backend servers using algorithms such as Round Robin, IP Hash, or Least Connection.
  • Advanced Routing Policy – Enables conditional routing of requests based on the request path, headers, parameters, ensuring traffic reaches the correct backend service.
  • Transformation Policy – Allows transformation of requests and responses (for example, header modification) so that APIs remain compatible with different consumers and backends.
  • Caching Policy – Improves performance and reduces backend load by temporarily storing frequently accessed API responses at the gateway.
  • Mock API Response Policy – Returns preconfigured mock responses from the gateway, useful for testing and development when backend services are unavailable.

For instance, in an e-commerce platform, gateway policies work together to ensure secure, reliable, and optimized API interactions.

You can use the Throttling Policy to limit the number of checkout or search requests per customer, maintaining fair usage and preventing overload during high-traffic events like flash sales.
The Blacklist IP Address Policy helps prevent malicious users or restricted regions from accessing APIs, while the Whitelist IP Address Policy ensures only trusted systems such as payment gateways or logistics partners can call protected endpoints.
To maintain data integrity and authentic communication between services, the Message Signature Policy verifies every request’s authenticity using a predefined signature rule.
Performance and reliability are guaranteed through the Load Balancing Policy, which distributes incoming traffic intelligently across multiple backend servers to optimize response time.
The Advanced Routing Policy allows conditional forwarding — for example, routing payment service requests to secure servers and product search requests to a separate service cluster.
With the Transformation Policy, request or response headers and payloads can be modified dynamically, such as adjusting fields for third-party APIs that consume or return data in a different structure.
To boost overall efficiency, the Caching Policy stores frequently retrieved catalog or user data temporarily at the gateway, reducing backend calls and improving response speed.
During testing or staging, a Mock API Response Policy can simulate order or payment confirmations without invoking live services, enabling faster and safer development cycles.

Together, these gateway policies ensure APIs are managed with precision—balancing performance, security, and scalability to deliver a consistent and trustworthy experience for all users.

Version Control

Version control in an API manager enables organizations to introduce new features, improvements, and bug fixes without disrupting the existing ecosystem of client applications. By keeping multiple versions of the API running, users can upgrade to new APIs at their own pace. This ensures a smooth transition and allows organizations to provide enhanced functionalities while minimizing disruptions for their clients. For instance, a software company might use version control to release new updates and patches to their API without breaking existing apps.