# API Manager policies, SLA tiers and contracts

*MuleSoft Developer Study Guide · Deploying and Managing APIs and Integrations · Last updated October 28, 2026 · https://www.certifyforce.com/study-guide/mulesoft-developer/deploying-and-managing-apis-and-integrations/api-manager-policies-sla-tiers-and-contracts*

Apply Mule Gateway policies from API Manager without touching code: Client ID Enforcement and where it reads credentials, contracts and SLA tiers with automatic or manual approval, and how Rate Limiting, Rate Limiting: SLA-Based and Spike Control treat excess traffic.

- Certification: Salesforce MuleSoft Developer
- Exam section: Deploying and Managing APIs and Integrations
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-developer

**Official exam objective:**

> Manage API policies.

## What the exam expects

- Explain how API Manager policies reach a paired app (no code change, no redeploy) and where they are enforced.
- Configure Client ID Enforcement: default `client_id` and `client_secret` headers, or a custom expression such as a query parameter.
- Set up SLA tiers with automatic or manual approval and approve a pending contract.
- Choose Rate Limiting, Rate Limiting: SLA-Based or Spike Control for a traffic requirement, and predict which requests get `429` for a given identifier.

Key terms:
- **Policy**: a regulation (security, traffic, SLA) applied to an API instance in API Manager.
- **Client application**: a registered consumer with a generated client ID and client secret.
- **Contract**: the approved link between a client application and an API instance.
- **SLA tier**: a named access level with request limits and an approval mode.
- **Identifier**: the Rate Limiting expression that splits requests into groups with separate quotas.

Everything here is Mule Gateway, the gateway for APIs running on Mule; API Manager also applies policies to Omni Gateway instances, whose policy pages differ ([Gateway Policies in API Manager](https://docs.mulesoft.com/api-manager/latest/manage-policies-overview)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Code change for policies | None; applied from API Manager | [Mule Gateway Policies Overview](https://docs.mulesoft.com/mule-gateway/policies-policy-overview) |
| Policy updates | Downloaded and reinjected without redeploy or restart | [Mule Gateway Policies Overview](https://docs.mulesoft.com/mule-gateway/policies-policy-overview) |
| Client ID Enforcement default | `client_id` and `client_secret` headers | [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| Invalid client credentials | `401`, `WWW-Authenticate` header | [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| Tier approval | Automatic or manual per tier | [Reviewing SLA Tiers Concepts](https://docs.mulesoft.com/api-manager/latest/defining-sla-tiers) |
| Approving a request | API Manager, instance, Contracts, Approve | [Approve or Reject Access Requests](https://docs.mulesoft.com/api-manager/latest/manage-client-apps-latest-task) |
| Rate Limiting window | Fixed; excess gets `429` | [Rate Limiting Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting) |
| Identifier default | None: one quota for all requests | [Rate Limiting Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting) |
| SLA-based without contract | Every request rejected | [Rate Limiting: SLA-Based Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting-sla) |
| Spike Control window | Sliding; queues and retries | [Spike Control Policy](https://docs.mulesoft.com/mule-gateway/policies-included-spike-control) |
| Order limit | API-level policies cannot precede automated ones; CORS runs first | [Reordering Policies](https://docs.mulesoft.com/mule-gateway/policies-reorder) |

## Check yourself

- Why must a Rate Limiting identifier reference headers in lowercase?
- When does the Distributed option share the Rate Limiting quota across nodes?
- Which permissions let a user approve or reject a pending access request?
- Why can you not move an API-level policy ahead of an automated policy, and which policy always runs first?
- Why does a client with no contract fail under Rate Limiting: SLA-Based?

## Sources

- [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement)
- [Reviewing SLA Tiers Concepts](https://docs.mulesoft.com/api-manager/latest/defining-sla-tiers)
- [Approve or Reject Access Requests](https://docs.mulesoft.com/api-manager/latest/manage-client-apps-latest-task)
- [Rate Limiting Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting)
- [Rate Limiting: SLA-Based Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting-sla)
- [Spike Control Policy](https://docs.mulesoft.com/mule-gateway/policies-included-spike-control)
- [Mule Gateway Policies Overview](https://docs.mulesoft.com/mule-gateway/policies-policy-overview)
- [Gateway Policies in API Manager](https://docs.mulesoft.com/api-manager/latest/manage-policies-overview)
- [Reordering Policies](https://docs.mulesoft.com/mule-gateway/policies-reorder)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Developer pack (USD $19): https://www.certifyforce.com/practice-exams