# Policies for Nonfunctional API Requirements

*MuleSoft Platform Architect Study Guide · Governing web APIs on Anypoint Platform · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/governing-web-apis-on-anypoint-platform/policies-for-nonfunctional-api-requirements*

Select gateway controls for traffic, request structure and metadata, separating hard consumption limits, burst smoothing and browser-visible feedback.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Governing web APIs on Anypoint Platform
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Select appropriate API policies and other components of the API to support specific non-functional requirements (NFRs).

## What the exam expects

- Select traffic, structural-protection and header policies for specific nonfunctional requirements.
- Separate a hard consumption allowance from smoothing temporary bursts.
- Evaluate identifier cardinality, queue capacity and caller waiting independently.
- Explain browser-visible policy feedback and layered SLA limits.

A **policy** adds processing around an API request or response; a **quota** bounds consumption in a window; an **identifier** groups requests for rate accounting; **Spike Control** regulates bursts; a **CORS configuration** governs browser cross-origin interaction; an **SLA tier** defines an application's access level and throughput limits ([Rate limiting](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting), [Spike Control](https://docs.mulesoft.com/mule-gateway/policies-included-spike-control), [CORS](https://docs.mulesoft.com/mule-gateway/policies-included-cors), [SLA tiers](https://docs.mulesoft.com/api-manager/latest/defining-sla-tiers)).

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| Identifier cardinality | Each distinct resolved value creates an algorithm; keep the domain bounded. | [Rate limiting](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting) |
| Hard quota | Excess HTTP requests receive 429 rather than being queued. | [Rate limiting](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting) |
| Queued resources | Spike Control retains connections and threads. | [Spike Control](https://docs.mulesoft.com/mule-gateway/policies-included-spike-control) |
| Separate budgets | Queuing Limit bounds capacity; delay and attempts govern retry waiting. | [Spike Control](https://docs.mulesoft.com/mule-gateway/policies-included-spike-control) |
| Nested JSON | Maximum Container Depth bounds nested objects and arrays. | [JSON protection](https://docs.mulesoft.com/mule-gateway/policies-included-json-threat-protection) |
| Browser visibility | Exposed response headers differ from allowed request headers. | [CORS](https://docs.mulesoft.com/mule-gateway/policies-included-cors) |
| Ordinary header replacement | Remove the old request header before injecting its replacement. | [Header Injection](https://docs.mulesoft.com/mule-gateway/policies-included-header-injection) |
| Layered SLA | Multiple throughput limits can belong to one tier. | [SLA tiers](https://docs.mulesoft.com/api-manager/latest/defining-sla-tiers) |

## Check yourself

- Why should a browser-equivalent CORS test use a protocol-aware client rather than assume curl reproduces the browser?
- When a Header Injection string must contain literal single quotes, which configuration form should be used?
- When an upload uses multipart form data, does JSON Threat Protection support that request format?

## Sources

- [Rate Limiting Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting)
- [Spike Control Policy](https://docs.mulesoft.com/mule-gateway/policies-included-spike-control)
- [JSON Threat Protection Policy](https://docs.mulesoft.com/mule-gateway/policies-included-json-threat-protection)
- [Cross-Origin Resource Sharing Policy](https://docs.mulesoft.com/mule-gateway/policies-included-cors)
- [Header Injection Policy](https://docs.mulesoft.com/mule-gateway/policies-included-header-injection)
- [Reviewing SLA Tiers Concepts](https://docs.mulesoft.com/api-manager/latest/defining-sla-tiers)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams