# API Specifications and Policy Contracts

*MuleSoft Platform Architect Study Guide · Governing web APIs on Anypoint Platform · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/governing-web-apis-on-anypoint-platform/api-specifications-and-policy-contracts*

Align API specifications with configured policy inputs, accepted token and payload forms, intercepted methods and gateway-generated responses.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Governing web APIs on Anypoint Platform
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Identify any change(s) required to an API specification to reflect the application of an API policy with specific characteristics.

## What the exam expects

- Update an API contract when a policy changes required request credentials or accepted structure.
- Document policy-generated responses as well as implementation responses.
- Check whether a gateway policy intercepts a method the implementation expects to receive.
- Align token representations and constraints with the selected validation policy.

An **API specification** describes the consumer-facing contract; a **RAML trait** reuses method requirements; a **policy configuration** determines runtime enforcement; **JWS** is the signed JWT representation supported by this validator; a **structural limit** constrains an XML request's shape or content lengths ([Client ID Enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement), [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation), [XML protection](https://docs.mulesoft.com/mule-gateway/policies-included-xml-threat-protection)).

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| Credential placement | Match the specification to the configured extraction location. | [Client ID Enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| Reusable requirement | A trait can declare required fields and be applied with `is`. | [Client ID Enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) |
| REST quota exhaustion | Standard Rate Limiting rejects excess requests with HTTP 429. | [Rate limiting](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting) |
| Quota metadata | Enabled exposure adds limit, remaining quota and reset information. | [Rate limiting](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting) |
| Protected OPTIONS | CORS handles it as preflight rather than forwarding to the application. | [CORS](https://docs.mulesoft.com/mule-gateway/policies-included-cors) |
| JWT representation | JWT Validation supports JWS, not JWE. | [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation) |
| XML attribute allowance | Per element, excluding namespace declarations. | [XML protection](https://docs.mulesoft.com/mule-gateway/policies-included-xml-threat-protection) |
| XML rejection | Structural-policy rejection returns HTTP 400. | [XML protection](https://docs.mulesoft.com/mule-gateway/policies-included-xml-threat-protection) |

## Check yourself

- When a downstream flow needs a claim after JWT Validation succeeds, which property path exposes it?
- When interpreting Maximum Comment Length for XML, what does the setting measure?
- Why does an XML node-depth limit not bound the length of a text node?

## Sources

- [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement)
- [Rate Limiting Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting)
- [Cross-Origin Resource Sharing Policy](https://docs.mulesoft.com/mule-gateway/policies-included-cors)
- [JWT Validation Policy](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation)
- [XML Threat Protection Policy](https://docs.mulesoft.com/mule-gateway/policies-included-xml-threat-protection)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams