Governing web APIs on Anypoint Platform17% of the exam
Client Credentials and API Contracts
Send application credentials according to the selected enforcement policy while separating user authentication, runtime identity and instance-specific contracts.
Describe in what circumstances and how to pass client ID and secret to a web API.
~7 min read · 3 practice questions
What the exam expects
- Determine when an API request must carry client application credentials.
- Keep user authentication, application identity and runtime credentials distinct.
- Match credential placement to the applied policy's extraction configuration.
- Reuse an application identity across instance-specific access contracts appropriately.
A client ID identifies a registered consumer application; its client secret is the associated application credential; an API contract grants access to a particular instance; a credentials origin tells the policy where to extract values; LDAP Basic authentication validates a directory user's credentials (Contracts and credentials, Client enforcement, LDAP policy).
Key facts
Credential subject
- Detail
- Application credentials identify the consuming client application.
Access requirement
- Detail
- Client enforcement requires an approved application contract.
Configured location
- Detail
- Basic origin or custom expressions determine request extraction.
Separate identities
- Detail
- LDAP can read user Basic credentials while client enforcement reads separate app headers.
Optional secret
- Detail
- A blank custom secret expression makes that policy input optional.
Reused application
- Detail
- Same-provider access to another instance needs a separate approved contract, not new app credentials.
Runtime credentials
- Detail
- Platform/environment credentials link runtime to platform, rather than identifying an API consumer.
Contract cardinality
- Detail
- One contract per instance and application at a time.
- When auditing a previously configured LDAP User Password, can the stored value be viewed or retrieved?
- When entering the LDAP Server URL, which network detail must be included?
- When invalid credentials reach Client ID Enforcement in Custom mode, which WWW-Authenticate value identifies that mode?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the MuleSoft Platform Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 47 lessons of the MuleSoft Platform Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (3 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both