Skip to main content
Feedback

Example: reusing a policy template across multiple deployed APIs

This example bundles a Role-Based Access Control check and a Circuit Breaker into one template and enforces both consistently on every API a team owns.

Prerequisites

  • Two or more APIs already deployed to a Gateway.
  • Permission to create and assign policy templates.
  • A tool for sending HTTP requests, such as Postman or curl, to verify that the Gateway enforces the template's policies.

Scenario overview

In this example, you build a template that bundles two policy rules and attach it to two deployed APIs at once:

  • Role-Based Access Control policy: rejects requests from callers without the required role.
  • Circuit Breaker policy: stops forwarding requests to a backend that is failing.
  • Execution timing: Before Request And Before Standard Policies for both rules, so they run before any other request-time processing.
  • Template attachment: one template, attached to two APIs in a single action, both at the root path (/).

Step 1: Create the policy rules you want to reuse

  1. Create a Role-Based Access Control policy rule that allows only the roles your baseline requires. Refer to Creating policy rules and Role-Based Access Control policy.
  2. Create a Circuit Breaker policy rule with the failure thresholds you want enforced on every API that uses this template. Refer to Circuit Breaker policy.

Step 2: Create the policy template

  1. Go to Configure APIs and Applications > Manage APIs, select the Policy Templates tab, and click Create Policy Template.
  2. Name it, for example Standard-API-Baseline, and add both policy rules from Step 1.
  3. Set Execution Timing to Before Request And Before Standard Policies for each rule, then click Save. The Gateway creates the template at version 1. Refer to Creating a policy template for the full steps.

Step 3: Attach the template to your APIs

  1. From the Policy Templates page, select Standard-API-Baseline and use its Add to API action.
  2. Select both deployed APIs you want to protect, leave the path as the default root path (/), and save. The Gateway attaches the same template version to both APIs immediately, confirmed by a success notification. Refer to Assigning a template to an API.

Step 4: Verify enforcement

  1. Send a request to one of the APIs using a caller identity that does not have the required role. The Gateway should reject the request based on the Role-Based Access Control policy, independent of any authorization logic in the backend itself.
  2. Send enough failing requests to the same API to trip the Circuit Breaker threshold, then send another request. The Gateway should stop forwarding requests to the backend and return an error rather than waiting on a backend that is already failing.

A rejected request typically returns an HTTP 403 for the Role-Based Access Control policy, or an HTTP 503 once the Circuit Breaker opens.

Step 5: Confirm version behavior when you update the template

  1. Edit Standard-API-Baseline and add a third policy rule, then save. Because the template is already attached to two APIs, the Gateway creates a new version instead of changing the version those APIs are using.
  2. Reopen either API's Policy Template tab. The API still shows the version you originally attached, not the new one.
  3. To move an API onto the new version, go to the Deployed APIs page, navigate to the Policy Templates tab for that API, unassign the current version, and then reassign it to the new version. Refer to Policy Templates list in Policy templates.
On this Page