Adding policies to your APIs

how can you add policies to an API proxy in apigee API management to enforce security controls this is the third in a series of introductory videos on apogee API management if you follow the first two you have apogee API management setup and you've created a pass-through proxy you've successfully invoked it now let's extend it in this video we will show you how to add a policy to perform rate limiting we'll see how to update policy configuration and we'll learn about request and response flows and we'll get a quick introduction to the apogee Community a great online resource for getting help let's go [Music] in the apogee UI navigate to the proxy list and the first proxy you created select the overview tab from here undeploy the proxy after that it will no longer be listening for inbound requests [Music] flip to the develop tab to modify the proxy here you can change any of the choices you made previously in the Wizard the base path and the target endpoint and you can add policies in apogee policies are reusable logic steps that perform a specific action on the request these can be enforced on the request flow after the proxy receives the inbound request but before the proxy connects with the target or on the response flow after the proxy receives the response from the target but before it sends that response to the original client let's add a rate limit policy I want apogee to enforce that on the request flow so I'll select the proxy endpoint the request pre-flow and click the icon to add a policy I need to create a new policy here there's a list to choose from all the built-in policy types their policies for caching credential verification Spike arrest threat protection and more each policy has different configuration options let's click the link to find documentation on the quota policy back in the apogee proxy editor I'll add a quota policy to enforce the rate limit each policy gets a name I'll name this one quota one then click create and add it to my flow here I see it displayed in the proxy editor clicking on the link I can see the pre-populated configuration for the quota policy showing lots of options the quota policy in apogee is remarkably flexible based on my reading of the documentation I'm going to replace that configuration with something simpler a basic configuration that tells apogee to allow four requests per minute now save the proxy as a new revision and deploy that revision again this will take a few moments after which the updated proxy will be handling inbound requests now I'll flip to my browser Tab and reload it several times after a few requests you can see that the rate limit gets enforced the error message tells the caller that a limit has been reached foreign if I like I can modify the quota configuration to allow oh maybe 100 requests per minute it's that easy and I can add another policy this one will execute in the response flow I want to add a few headers to the response that the client will receive describing the rate limits we use the assign message policy for that assigned message can manipulate any part of a request or response message including the headers and the documentation page for a sign message gives lots of examples save and deploy the new revision to get this new rate limit and the new response headers now flipping to my terminal window I can invoke the updated proxy from curl and yes we can see the new headers in the response there's a lot of flexibility with apogee if you ever need assistance you can visit the apogee community it's available right here at this icon it provides a knowledge base and a q a forum for all things apogee for example if you have a question on the quota policy it's easy to search or you can post a new question plenty of experts are willing to help you out [Music] let's wrap up in this video you learned about policies as the configurable logic that allows you to enforce controls on your API proxies you saw the proxy editor and you deployed new revisions of proxies with different policies you learned about the quota and assigned message policies and I showed you the apogee Community an invaluable support resource in the next video I'll cover how to add API key verification to an API proxy we'll see you there and don't forget to like And subscribe [Music]