Skip to main content
Feedback

Assigning policy templates to APIs

Assigning a policy template attaches its bundled policy rules to one or more deployed APIs, putting those rules into effect on each API's request and response flow.

Attaching a template requires specifying the applicable URI path. The Gateway pre-fills the field with a forward slash (/), and all paths must start with a forward slash. In the UI, clearing the field entirely triggers a validation error and disables the Attach action until a valid path is entered; if an empty path is sent directly to the backend, it defaults to storing (/) as the path. A path cannot exceed 60 characters.

The platform supports combining templates, APIs, and paths in several ways:

  • Select Policy Template on Manage APIs > Deployed APIs page operates as a multi-select field, allowing the attachment of several templates to an API in a single action. Refer to step 3.

  • The Add to API action on the Policy Templates page attaches one template version to multiple deployed APIs in a single action. Refer to step 3.

  • Executing the attach action repeatedly with different paths attaches the same template across multiple paths on the same API. Refer to step 3.

  • Attaching different templates across different paths on the same API allows combining broad governance templates at the root path with endpoint-specific templates on individual paths. Refer to step 3.

The Gateway prevents deploying multiple versions of the same template to the same path simultaneously, rejecting reattachment if the template already applies to that path.

When conflicting policies apply to the same path, the Gateway resolves the order of execution as follows:

  • If two templates attached to the same path include conflicting configurations of the same policy subtype (for example, two IP filtering policies with different rules), they execute in attachment order: whichever was attached first runs first.
  • If a template includes conflicting policies, such as multiple authentication methods, the rule configured to run first takes precedence.
  • When a standalone policy rule and a policy template share the same path, HTTP methods, and execution timing, the standalone rule executes first, followed by the template's rules.

Templates attached to the same path run in a set order, which you can change by dragging and dropping them in the UI, but only if they all apply to the same HTTP methods. If they apply to different methods, the Gateway orders them by method specificity instead, and manual reordering is turned off for that path. A new template attached to a path is added to the end of the sequence, and you can then reorder as needed.

Assigning a template to an API

Prerequisites

  • If using the UI, at least one existing policy template. Refer to Creating policy templates. If using the GraphQL API instead, you do not need to create the template beforehand, it can be created inline as part of the attach mutation.
  • The API you want to govern, already deployed to a Gateway. The Gateway blocks template attachment on an API that is not deployed yet.

To assign a template to an API:

  1. Choose your entry point:

    • Navigate to Manage APIs > Deployed APIs and open the API you want to govern. Go to its Policy Template tab, and click Attach Policy Template.
    • Or, from the Policy Templates page, use the Add to API action for the template you want to attach.

  2. Depending on your entry point:

    • If using the API's Attach Policy Template page, the API is already chosen; search for and select the template(s) to attach.
    • If using Add to API from the Policy Templates page, confirm the Current Branch (defaults to the branch you were viewing when you opened the dialog), then select the deployed API or APIs to attach the template to. The deployed-API picker only lists APIs deployed on that branch.

  3. Enter the URI path the template applies to. The version of the template you selected earlier is applied automatically; this dialog has no separate version picker.

    • To assign multiple templates to the same API at the same path in a single action, select each template you want in Attach Policy Template. All selected templates share the one URI Path field on that form.
    • To assign one template to multiple APIs in a single action, use the template's Add to API action from the Policy Templates page, and select multiple deployed APIs in the same dialog.
    • To attach the same template at more than one path on the same API, repeat this procedure for that API with a different path.
    • To attach different templates at different paths on the same API, for example a broad template at the root path plus more specific templates at individual endpoints, repeat this procedure for that API, using a different template and a different path each time. Each attachment appears as its own accordion entry, showing its own path, without affecting the others.

  4. Click Attach. The Gateway attaches the template.

When you attach a template to multiple APIs in one action, the Gateway confirms the attachment with a notification message, and the template's API Count on the Policy Templates page updates automatically.

  1. Alternatively, to unassign a template that is already attached to an API:
    1. Open the API you want to update, go to its Policy Template tab, and expand the entry for the template you want to remove.
    2. Click Unassign, then confirm the removal in the dialog that appears. Canceling keeps the template attached.

The Gateway removes the template immediately and shows a confirmation notification.

You can also attach and remove policy templates on a deployed API programmatically using the apiPolicyTemplateApply mutation.

On this Page