Administer APIs in API Manager

Overview

API administrators use API Manager to administer the managed APIs that are exposed to API consumers. The API administrator is a business or operational role who understands the business capability of the APIs, which clients want to access them, and for what reasons. The API administrator does not necessarily have deep knowledge of the API Gateway, and is not familiar with the Policy Studio developer tool.

The API administrator role is responsible for API Manager. This role manages and monitors the virtualized APIs and the clients that use those APIs. API administrator tasks include the following:

• Managing organizations—registering organizations and defining which APIs they are authorized to access
• Managing client applications—managing client application credentials and API authorizations
• Managing users—API consumers, organization administrators, and API administrators
• Managing API quotas—system-level and client application-level quotas
• Monitoring and reporting on API usage

These tasks are performed using the intuitive API Manager web interface. This topic focuses on the concepts and workflows in API administration, and shows some examples of using the API Manager web interface.

API administration concepts

This section describes the main components and concepts in API administration.

API Manager access control

The API administrator has full access to API Manager, and can create, read, update, and delete organizations, users, and applications. The API administrator has management responsibility for applications and users. When users are being registered, the API administrator can approve or reject new users. Users can create applications, but they must first be approved by the API administrator. If users want to request access to another API for an approved application, the API access must also be approved. User and application management can be automatically approved. In addition, the API administrator can delegate the user and application management responsibility to organization administrators. But only the API administrator can edit quotas.

The organization administrator has full read access to users and applications in their organization. If application management is delegated, they can also create, update, and delete. The organization administrator can monitor all applications in their organization. They also have the same permissions as API consumers or application developer users.

The API consumer can create, read, update, and delete their applications. They can also give shared access to other users, granting permissions to view and monitor, or full access. If auto-approval is disabled, the user must wait for approval for new applications from the API administrator, or organization administrator if they have been delegated management responsibility. A user has full read access to all other users in the organization.

Ensure API Manager is configured correctly

Before you begin using API Manager as an API administrator, you must ensure that API Manager has been enabled and configured correctly for your environment. For example, this includes configuring API Manager settings such as the following:

• Monitoring metrics
• Identity provider
• Quota storage
• SMTP server

For more details, see Configure API management settings in Policy Studio.

Log in to API Manager

The API administrator can use the following URL to log in to API Manager:

https://HOSTNAME:8075

This displays the following login dialog:

Enter the API administrator credentials that you specified when installing API Manager:

• Login name
• Password

API administrator view

When an API administrator logs on to API Manager, it displays a specific view for the API administrator. This includes the following:

• Monitoring:
  View historical reports and statistics on all client applications in the domain. For more details, see Administer APIs in API Manager.
• Client Registry:
  Create, manage, or delete client Organizations, Application Developers, and Applications in the domain. For example, this includes assigning users to specific organizations (named or Community), and to specific roles (API administrator, organization administrator, or API consumer user).
• Policy Management:
  Manage system and application default quotas, and OAuth authorizations. Quotas are maximum message rates for APIs and methods (for example, the number of messages or megabytes in a specified time period). For more details, see Manage quotas.This view also enables you to manage stored OAuth authorizations made by protected resource owners.
• API Catalog:
  Browse all virtualized APIs provided in an API Gateway group. For more details, see Virtualize REST APIs in API Manager.
• Settings:
  Manage the following settings:

For details on how to configure each of these settings, see Configure web-based settings in API Manager.

The following shows an example API administrator view in API Manager. This shows setting an Application Default quota of 25 messages per second:

Organization administrator view

The view displayed for organization administrator is a subset of the view displayed for the API administrator. For example, the organization administrator cannot view Policy Management, API Manager Settings, or Alerts. The following shows an example view:

Manage quotas

API administrators can use the Policy Management > Default Quotas tab to manage the maximum message traffic rate sent by applications to APIs using application-default or system-level quotas. Alternatively, API administrators can set application-specific quotas in the Client Registry > Applications > Quota tab. For more details on quota types, see Quotas.

System and application-default quotas

To create a system or application-default quota, perform the following steps:

1. On the Default Quotas tab, click Application Default or System, depending on the quota type you wish to create.
2. Click Add API, and select an API from the list (for example, a Swagger-based Petstore API). Alternatively, select All API. For details on registering APIs, see Register REST APIs in API Manager.
3. If you selected a specific API, you can select whether the quota applies to All Methods or to a specific method (for example, updatePet).
4. Select Throttle and enter a number of messages, or Throttle MB and enter a number of megabytes.
5. Enter the amount of time, and select the time unit (for example 5 seconds). For more details, see Quota time windows.

The following example system quota plan shows a mix of quotas that apply to all APIs and specific APIs (for all methods and a specific method):

If an application-specific quota is defined, this completely overrides the application-default quota and its associated rules. The API Catalog view in the API Manager console only shows application-default quotas.

Application-specific quotas

To create an application-specific quota, perform the following steps:

1. In the API Manager menu, click Client Registry > Applications.
2. Click the application name (for example, Test App), and click the Quota tab.
3. Select Override default application quota.
4. Click Add API, and select an API from the list (for example, a Swagger-based Petstore API). Alternatively, select All API. For details on registering APIs, see Register REST APIs in API Manager.
5. If you selected a specific API, you can select whether the quota applies to All Methods or to a specific method (for example, updatePet).
6. Select Throttle and enter a number of messages, or Throttle MB and enter a number of megabytes.
7. Enter the amount of time, and select the time unit (for example 5 seconds). For more details, see Quota time windows.

The following example shows an application-specific quota plan that includes a mix of quotas that apply to all APIs and methods, and to a specific API and method:

Quota time windows

When specifying time windows in quota rules, the quota opens when the API is called at the current second, minute, day, or week, depending on the time unit specified in the quota rule.

For example, you have defined a quota rule on API A and method B that throttles the message count to N messages per hour. Then assume API A and method B was invoked at 14:33 for the first time. The specified rule is activated at the time of the first API call, setting the time window to start at the hour (14:00:00.000). If you get another call at 14:35, the counter is incremented, and its value is validated against the limit (N). If you get another call at 17:33, the new time window start will start at the hour (17:00:00.000), and the counter is reset to 0 before reflecting the API call from 17:33.

Multiple quota rules per method

You can also specify quotas with multiple rules for the same API methods for all quota types (system, application default, and application specific). For example, a system-level quota for a pet store API is specified with the following rules for the addPet method:

• 10 messages every 5 seconds
• 1000 messages every 1 day

Both quota rules apply to the same API method.

Manage OAuth authorizations

API Manager enables API administrators to view and revoke OAuth authorizations made by protected resource owners. This enables you to manage all client application authorizations to access OAuth-protected APIs. This also means that resource owners do not need to re-authorize application requests.

When client applications are authorized to access OAuth-protected APIs, they are issued with an access token and optionally a refresh token. API Manager displays the authorizations granted to each client application, including the scope. Revoking an OAuth authorization means that the access and refresh tokens that the client application has are no longer valid.

The Policy Management > OAuth Authorizations tab enables you to manage the stored OAuth authorizations made by protected resource owners.

The following details are displayed:

• SUBJECT: The name of the OAuth resource owner (for example, sample_user).
• SCOPES: The OAuth scopes used to managed access to the protected resource (for example, resource.Write, openid).
• CREATED: When the authorization was first made.

To revoke a stored authorization, and block further requests from the client application, select the resource owner name under SUBJECT, and click Remove. For more details, see the API Gateway OAuth User Guide.

Manage organizations

API administrators can use the Client Registry > Organizations tab to create and edit organizations.

Create an organization

To create an organization, perform the following steps:

1. Click New organization in the toolbar.
2. Configure the following general fields:
   • Image: Click to add a graphical image for the organization (for example, .png, .gif, or .jpeg file).
   • Organization name: Enter a name for the organization. This field is required.
   • Email: Enter an email address for the organization.
   • Enabled: Select whether the organization is enabled. The organization is enabled by default.
   • API Development: Select whether the organization is enabled for API development. This setting is disabled by default.

Note

You must first enable an organization for API development before you can begin registering REST APIs for that organization. For more details, see Register REST APIs in API Manager. When the organization has registered APIs, you cannot disable this setting.

3. • Virtual host: Enter the virtual host and port on which unpublished APIs belonging to this organization are available. The host name should be DNS resolvable.

3. Configure the following additional attributes:
   • Phone: Enter a phone number for the organization if available.
   • Description: Enter a short description of the organization.

4. Click Add API to select the APIs that the organization can access.
5. Click Generate code to generate optional registration codes used to simplify onboarding of new users into the organization. You can specify the Maximum number of users per code and The code is valid until. These codes are provided to new users who can input them when self-registering in API Manager. These users are then automatically registered in the organization.
6. Click Create in the toolbar.

Edit an organization

When organizations have been created, you can click an organization name in the Managing organizations screen to edit its settings. You can also perform the following tasks:

• Click Add API to select the APIs that the organization can access.
• Click Generate code to generate optional registration codes used to onboard new users into the organization. You can specify the Maximum number of users per code and when The code is valid until. You can provide these registration codes to new users who can input them when self-registering in API Manager.
• Click to view the Users and Applications in that organization.

Manage users

API administrators and organization administrators can use the Client Registry > Application Developers tab to create and edit the administrator users and the API consumers that use the APIs virtualized in the API Catalog.

Create a user

To create a user, perform the following steps:

1. Click New user in the toolbar.
2. Configure the following general fields:
   • Image: Click to add a graphical image for the user (for example, .png, .gif, or .jpeg file).
   • Login Name: Enter a globally unique name to identify the user, which is entered by the user when logging in to API Manager. This can be changed only by an API administrator, and is read-only for all other users. This field is required.

   Note

   Changing a user’s login-name prevents that user from logging in. You must ensure that the user is notified of any change.

   • Name: Enter the user's first name and surname to be used as a display name. This field is required.
   • Email: Enter an email address for the user. This field is required.

   Note

   This must be globally unique when the Login Name is set to the email address.

   • Enabled: Select whether the user is enabled. The user is enabled by default.

3. Configure the following membership fields:
   • Organization: Select the organization that the user belongs to. The default list includes the API Development organization only. For details on creating organizations, see Manage organizations.
   • Role: Select one of the following required roles for the user:
     • API Manager Administrator: This is the API administrator with full access rights.
     • Organization Administrator: This administrator has a subset of access rights within an organization.
     • User: This is the client application developer user (API consumer).
     • For more details on user roles, see API management concepts.

4. Configure the following additional attributes:
   • Phone: Enter a phone number for the user.
   • Description: Enter a short description of the user.
5. Click Create in the toolbar.

Edit a user

When users have been created, you can click a user name in the Managing users screen to edit its settings. You can also perform the following:

• Click to view the user's Organization and Applications.
• Click Reset password to generate a random password and send it to the user's email address.
• Click Change password to enter a new user password in the dialog.

Manage applications

API administrators, organization administrators, and application developers (API consumers) can use the Client Registry > Applications tab. This enables you to create and edit the client applications that use the APIs virtualized in the API Catalog.

For details on managing applications, see Consume APIs in API Manager.