Deploying and Managing APIs and Integrations7% of the exam
API Manager policies, SLA tiers and contracts
Apply Mule Gateway policies from API Manager without touching code: Client ID Enforcement and where it reads credentials, contracts and SLA tiers with automatic or manual approval, and how Rate Limiting, Rate Limiting: SLA-Based and Spike Control treat excess traffic.
Manage API policies.
~7 min read · 8 practice questions ·
What the exam expects
- Explain how API Manager policies reach a paired app (no code change, no redeploy) and where they are enforced.
- Configure Client ID Enforcement: default
client_idandclient_secretheaders, or a custom expression such as a query parameter. - Set up SLA tiers with automatic or manual approval and approve a pending contract.
- Choose Rate Limiting, Rate Limiting: SLA-Based or Spike Control for a traffic requirement, and predict which requests get
429for a given identifier.
Key terms:
- Policy: a regulation (security, traffic, SLA) applied to an API instance in API Manager.
- Client application: a registered consumer with a generated client ID and client secret.
- Contract: the approved link between a client application and an API instance.
- SLA tier: a named access level with request limits and an approval mode.
- Identifier: the Rate Limiting expression that splits requests into groups with separate quotas.
Everything here is Mule Gateway, the gateway for APIs running on Mule; API Manager also applies policies to Omni Gateway instances, whose policy pages differ (Gateway Policies in API Manager).
Sources for this section (1)
Key facts
Code change for policies
- Detail
- None; applied from API Manager
Policy updates
- Detail
- Downloaded and reinjected without redeploy or restart
Client ID Enforcement default
- Detail
client_idandclient_secretheaders
Invalid client credentials
- Detail
401,WWW-Authenticateheader
Tier approval
- Detail
- Automatic or manual per tier
Approving a request
- Detail
- API Manager, instance, Contracts, Approve
Rate Limiting window
- Detail
- Fixed; excess gets
429
Identifier default
- Detail
- None: one quota for all requests
SLA-based without contract
- Detail
- Every request rejected
Spike Control window
- Detail
- Sliding; queues and retries
Order limit
- Detail
- API-level policies cannot precede automated ones; CORS runs first
Sources for this section (8)
- Mule Gateway Policies Overviewdocs.mulesoft.com (opens in a new tab)
- Client ID Enforcement Policydocs.mulesoft.com (opens in a new tab)
- Reviewing SLA Tiers Conceptsdocs.mulesoft.com (opens in a new tab)
- Approve or Reject Access Requestsdocs.mulesoft.com (opens in a new tab)
- Rate Limiting Policydocs.mulesoft.com (opens in a new tab)
- Rate Limiting: SLA-Based Policydocs.mulesoft.com (opens in a new tab)
- Spike Control Policydocs.mulesoft.com (opens in a new tab)
- Reordering Policiesdocs.mulesoft.com (opens in a new tab)
- Why must a Rate Limiting identifier reference headers in lowercase?
- When does the Distributed option share the Rate Limiting quota across nodes?
- Which permissions let a user approve or reject a pending access request?
- Why can you not move an API-level policy ahead of an automated policy, and which policy always runs first?
- Why does a client with no contract fail under Rate Limiting: SLA-Based?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the MuleSoft Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 40 lessons of the MuleSoft Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (8 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams