# Security Across API Led Layers

*MuleSoft Platform Architect Study Guide · Governing web APIs on Anypoint Platform · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/governing-web-apis-on-anypoint-platform/security-across-api-led-layers*

Choose layer-appropriate browser, token, scope and application-contract checks, preserving authenticated identity through policy composition.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Governing web APIs on Anypoint Platform
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Secure web APIs using API policies appropriately chosen for the API's tier (System, Process, Experience).

## What the exam expects

- Select controls for the actual callers and trust boundary of each API-led tier.
- Separate browser-origin rules, token validity, scopes and application contracts.
- Enforce combined permissions when a Process operation performs multiple protected actions.
- Preserve validated application identity when composing authentication and SLA policies.

An **Experience boundary** faces its consumer; a **Process boundary** protects composed business work; a **System boundary** protects access to a system capability; a **scope** expresses token authorization; an **API contract** grants a client application access to an instance. Tier responsibilities are developed in **API Tier Ownership and Change**; the policy checks below address these distinct trust decisions ([Mule OAuth enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement), [Client enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement)).

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| Browser boundary | CORS governs approved cross-origin interaction, not token validity. | [CORS](https://docs.mulesoft.com/mule-gateway/policies-included-cors) |
| Mule provider enforcement | Validates tokens from the Mule OAuth provider; does not generate them. | [Mule OAuth enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement) |
| Combined permissions | Contains all scopes requires every configured scope. | [Mule OAuth enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement) |
| Validated client identity | Following SLA enforcement can use authentication.principal after OAuth validation. | [Mule OAuth enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement) |
| Separate contract check | Clearing Skip Client ID Validation preserves application-access validation. | [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation) |
| Required token claims | Expected audience and expiration must be mandatory when absence must fail. | [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation) |
| Signing requirement | Configure expected method and matching verification key. | [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation) |
| Custom validation type | Custom-claim expressions must return Boolean values. | [JWT Validation](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation) |

## Check yourself

- When an HTTP requester forwards an eligible user-property field from the validation response, how is its backend header name formed?
- Why is a descriptive string unsuitable as a JWT custom-claim validation result?
- When a Mule OAuth validation response contains mail, which in-flow path reads that value?

## Sources

- [OAuth 2.0 Access Token Enforcement Using Mule OAuth Provider](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement)
- [Cross-Origin Resource Sharing Policy](https://docs.mulesoft.com/mule-gateway/policies-included-cors)
- [JWT Validation Policy](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation)
- [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams