Governing web APIs on Anypoint Platform17% of the exam
Policies for Nonfunctional API Requirements
Select gateway controls for traffic, request structure and metadata, separating hard consumption limits, burst smoothing and browser-visible feedback.
Select appropriate API policies and other components of the API to support specific non-functional requirements (NFRs).
~7 min read · 6 practice questions
What the exam expects
- Select traffic, structural-protection and header policies for specific nonfunctional requirements.
- Separate a hard consumption allowance from smoothing temporary bursts.
- Evaluate identifier cardinality, queue capacity and caller waiting independently.
- Explain browser-visible policy feedback and layered SLA limits.
A policy adds processing around an API request or response; a quota bounds consumption in a window; an identifier groups requests for rate accounting; Spike Control regulates bursts; a CORS configuration governs browser cross-origin interaction; an SLA tier defines an application's access level and throughput limits (Rate limiting, Spike Control, CORS, SLA tiers).
Key facts
Identifier cardinality
- Detail
- Each distinct resolved value creates an algorithm; keep the domain bounded.
Hard quota
- Detail
- Excess HTTP requests receive 429 rather than being queued.
Queued resources
- Detail
- Spike Control retains connections and threads.
Separate budgets
- Detail
- Queuing Limit bounds capacity; delay and attempts govern retry waiting.
Nested JSON
- Detail
- Maximum Container Depth bounds nested objects and arrays.
Browser visibility
- Detail
- Exposed response headers differ from allowed request headers.
Ordinary header replacement
- Detail
- Remove the old request header before injecting its replacement.
Layered SLA
- Detail
- Multiple throughput limits can belong to one tier.
Sources for this section (6)
- Why should a browser-equivalent CORS test use a protocol-aware client rather than assume curl reproduces the browser?
- When a Header Injection string must contain literal single quotes, which configuration form should be used?
- When an upload uses multipart form data, does JSON Threat Protection support that request format?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the MuleSoft Platform Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 47 lessons of the MuleSoft Platform Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (6 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both