475 lines
14 KiB
Markdown
475 lines
14 KiB
Markdown
# API Management - Comprehensive Reference
|
|
|
|
**Source**: SAP BTP Integration Suite Documentation
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/tree/main/docs/apim/API-Management](https://github.com/SAP-docs/sap-btp-integration-suite/tree/main/docs/apim/API-Management)
|
|
**Last Updated**: 2025-11-22
|
|
|
|
---
|
|
|
|
## Table of Contents
|
|
|
|
1. [Overview](#overview)
|
|
2. [API Proxy Structure](#api-proxy-structure)
|
|
3. [Creating API Proxies](#creating-api-proxies)
|
|
4. [Policies Reference](#policies-reference)
|
|
5. [Developer Hub](#developer-hub)
|
|
6. [Analytics](#analytics)
|
|
7. [Best Practices](#best-practices)
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
API Management provides complete API lifecycle management including:
|
|
- API design and creation
|
|
- Security and access control
|
|
- Traffic management
|
|
- Analytics and monitoring
|
|
- Developer engagement
|
|
|
|
**Core Components**:
|
|
| Component | Purpose |
|
|
|-----------|---------|
|
|
| API Proxy | Facade for backend services |
|
|
| Policies | Runtime behavior rules |
|
|
| Products | API bundles for subscription |
|
|
| Developer Hub | Developer portal |
|
|
| Analytics | Usage insights |
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/what-is-api-management-0aef763.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/what-is-api-management-0aef763.md)
|
|
|
|
---
|
|
|
|
## API Proxy Structure
|
|
|
|
### Flow Architecture
|
|
|
|
```
|
|
API Proxy
|
|
┌─────────────────────────────────────────────────────────────┐
|
|
│ │
|
|
│ Client Request │
|
|
│ ↓ │
|
|
│ ┌─────────────────────┐ ┌─────────────────────┐ │
|
|
│ │ Proxy Endpoint │ │ Target Endpoint │ │
|
|
│ ├─────────────────────┤ ├─────────────────────┤ │
|
|
│ │ PreFlow │ │ PreFlow │ │
|
|
│ │ ↓ │ │ ↓ │ │
|
|
│ │ Conditional Flows │ →→ │ Conditional Flows │ →→ Backend
|
|
│ │ ↓ │ │ ↓ │ │
|
|
│ │ PostFlow │ │ PostFlow │ │
|
|
│ │ ↓ │ │ ↓ │ │
|
|
│ │ FaultRules │ │ FaultRules │ │
|
|
│ └─────────────────────┘ └─────────────────────┘ │
|
|
│ │
|
|
│ Backend Response │
|
|
│ ↓ │
|
|
│ (Flows execute in reverse for response) │
|
|
│ ↓ │
|
|
│ Client Response │
|
|
│ │
|
|
└─────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
### Proxy Endpoint
|
|
Handles incoming client requests.
|
|
|
|
**Configuration**:
|
|
- Virtual host and base path
|
|
- Route rules
|
|
- Request/response policies
|
|
- Fault handling
|
|
|
|
### Target Endpoint
|
|
Connects to backend services.
|
|
|
|
**Configuration**:
|
|
- Backend URL
|
|
- Load balancing
|
|
- Health monitoring
|
|
- Connection settings
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-proxy-structure-4dfd54a.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-proxy-structure-4dfd54a.md)
|
|
|
|
---
|
|
|
|
## Creating API Proxies
|
|
|
|
### Methods
|
|
|
|
1. **From API Provider**
|
|
- Connect to SAP or non-SAP systems
|
|
- Import API definitions automatically
|
|
|
|
2. **From URL**
|
|
- Direct target endpoint URL
|
|
- Manual configuration
|
|
|
|
3. **From API Designer**
|
|
- Design OpenAPI specification
|
|
- Generate proxy from design
|
|
|
|
4. **From Existing Proxy**
|
|
- Copy and modify existing proxy
|
|
- Clone for similar use cases
|
|
|
|
5. **From Cloud Integration**
|
|
- Expose iFlow endpoints as APIs
|
|
- Apply API policies to integration flows
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/different-methods-of-creating-an-api-proxy-4ac0431.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/different-methods-of-creating-an-api-proxy-4ac0431.md)
|
|
|
|
### API Versioning
|
|
|
|
**Strategies**:
|
|
- URI versioning: `/v1/resource`
|
|
- Header versioning: `X-API-Version: 1`
|
|
- Query parameter: `?version=1`
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-versioning-b3cda3b.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-versioning-b3cda3b.md)
|
|
|
|
### API Revisions
|
|
|
|
Create non-destructive updates:
|
|
- Draft revisions for testing
|
|
- Deploy specific revisions
|
|
- Rollback to previous versions
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-revisions-58097ac.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-revisions-58097ac.md)
|
|
|
|
---
|
|
|
|
## Policies Reference
|
|
|
|
### Common Attributes
|
|
|
|
All policies support:
|
|
```xml
|
|
<PolicyName enabled="true" continueOnError="false" async="false">
|
|
<!-- Configuration -->
|
|
</PolicyName>
|
|
```
|
|
|
|
| Attribute | Description |
|
|
|-----------|-------------|
|
|
| `enabled` | Policy active (true/false) |
|
|
| `continueOnError` | Continue on failure |
|
|
| `async` | Execute asynchronously |
|
|
|
|
### Security Policies
|
|
|
|
#### Verify API Key
|
|
```xml
|
|
<VerifyAPIKey>
|
|
<APIKey ref="request.header.x-api-key"/>
|
|
</VerifyAPIKey>
|
|
```
|
|
|
|
#### OAuth 2.0
|
|
Supports grant types:
|
|
- Client Credentials
|
|
- Authorization Code
|
|
- Password
|
|
- Implicit
|
|
|
|
```xml
|
|
<OAuthV2 name="OAuth-Validate">
|
|
<Operation>VerifyAccessToken</Operation>
|
|
</OAuthV2>
|
|
```
|
|
|
|
#### Basic Authentication
|
|
```xml
|
|
<BasicAuthentication name="BasicAuth">
|
|
<Operation>Decode</Operation>
|
|
<User ref="request.header.username"/>
|
|
<Password ref="request.header.password"/>
|
|
</BasicAuthentication>
|
|
```
|
|
|
|
#### SAML Assertion
|
|
Validate SAML tokens for SSO scenarios.
|
|
|
|
#### Access Control
|
|
IP-based access restrictions.
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/verify-api-key-4d15a04.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/verify-api-key-4d15a04.md)
|
|
|
|
### Traffic Management Policies
|
|
|
|
#### Quota
|
|
Limit API calls over time periods.
|
|
```xml
|
|
<Quota name="CheckQuota">
|
|
<Interval>1</Interval>
|
|
<TimeUnit>month</TimeUnit>
|
|
<Allow count="1000"/>
|
|
</Quota>
|
|
```
|
|
|
|
**Types**:
|
|
- Default: Fixed allocation
|
|
- FlexQuota: Dynamic allocation
|
|
- Calendar: Time-based periods
|
|
|
|
#### Spike Arrest
|
|
Prevent traffic spikes.
|
|
```xml
|
|
<SpikeArrest name="SpikeControl">
|
|
<Rate>30pm</Rate>
|
|
</SpikeArrest>
|
|
```
|
|
|
|
**Rate formats**: `Xpm` (per minute), `Xps` (per second)
|
|
|
|
#### Concurrent Rate Limit
|
|
Limit simultaneous connections.
|
|
|
|
#### Response Cache
|
|
Cache backend responses.
|
|
```xml
|
|
<ResponseCache name="CacheResponse">
|
|
<CacheKey>
|
|
<KeyFragment ref="request.uri"/>
|
|
</CacheKey>
|
|
<ExpirySettings>
|
|
<TimeoutInSec>3600</TimeoutInSec>
|
|
</ExpirySettings>
|
|
</ResponseCache>
|
|
```
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/quota-1f742c1.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/quota-1f742c1.md)
|
|
|
|
### Mediation Policies
|
|
|
|
#### Assign Message
|
|
Modify request/response.
|
|
```xml
|
|
<AssignMessage name="SetHeaders">
|
|
<Set>
|
|
<Headers>
|
|
<Header name="X-Custom">value</Header>
|
|
</Headers>
|
|
</Set>
|
|
<AssignTo>request</AssignTo>
|
|
</AssignMessage>
|
|
```
|
|
|
|
#### Extract Variables
|
|
Extract data from messages.
|
|
```xml
|
|
<ExtractVariables name="ExtractData">
|
|
<JSONPayload>
|
|
<Variable name="userId">
|
|
<JSONPath>$.user.id</JSONPath>
|
|
</Variable>
|
|
</JSONPayload>
|
|
</ExtractVariables>
|
|
```
|
|
|
|
#### JSON to XML / XML to JSON
|
|
Format conversion.
|
|
|
|
#### XSL Transform
|
|
Apply XSLT transformations.
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/assign-message-523efe6.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/assign-message-523efe6.md)
|
|
|
|
### Extension Policies
|
|
|
|
#### JavaScript
|
|
Custom logic with JavaScript.
|
|
```xml
|
|
<Javascript name="CustomLogic">
|
|
<ResourceURL>jsc://script.js</ResourceURL>
|
|
</Javascript>
|
|
```
|
|
|
|
#### Python Script
|
|
Custom logic with Python.
|
|
|
|
#### Service Callout
|
|
Call external services.
|
|
```xml
|
|
<ServiceCallout name="CallService">
|
|
<HTTPTargetConnection>
|
|
<URL>[https://service.example.com</URL>](https://service.example.com</URL>)
|
|
</HTTPTargetConnection>
|
|
</ServiceCallout>
|
|
```
|
|
|
|
### Threat Protection Policies
|
|
|
|
#### JSON Threat Protection
|
|
```xml
|
|
<JSONThreatProtection name="JSONProtect">
|
|
<ArrayElementCount>20</ArrayElementCount>
|
|
<ContainerDepth>10</ContainerDepth>
|
|
<ObjectEntryCount>15</ObjectEntryCount>
|
|
<StringValueLength>500</StringValueLength>
|
|
</JSONThreatProtection>
|
|
```
|
|
|
|
#### XML Threat Protection
|
|
Prevent XML bombs and malformed XML.
|
|
|
|
#### Regular Expression Protection
|
|
Block injection attacks.
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/json-threat-protection-952cbd7.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/json-threat-protection-952cbd7.md)
|
|
|
|
### Fault Handling
|
|
|
|
#### Raise Fault
|
|
Generate custom errors.
|
|
```xml
|
|
<RaiseFault name="InvalidRequest">
|
|
<FaultResponse>
|
|
<Set>
|
|
<StatusCode>400</StatusCode>
|
|
<ReasonPhrase>Bad Request</ReasonPhrase>
|
|
<Payload contentType="application/json">
|
|
{"error": "Invalid input"}
|
|
</Payload>
|
|
</Set>
|
|
</FaultResponse>
|
|
</RaiseFault>
|
|
```
|
|
|
|
### Logging Policies
|
|
|
|
#### Message Logging
|
|
Log to external systems.
|
|
|
|
#### Statistics Collector
|
|
Collect custom metrics.
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/policy-types-c918e28.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/policy-types-c918e28.md)
|
|
|
|
---
|
|
|
|
## Developer Hub
|
|
|
|
### Overview
|
|
Self-service portal for API discovery and subscription.
|
|
|
|
**Features**:
|
|
- API documentation
|
|
- Interactive testing
|
|
- Application registration
|
|
- Subscription management
|
|
- Analytics dashboard
|
|
|
|
### Products
|
|
Bundle APIs for subscription.
|
|
|
|
**Configuration**:
|
|
- Included APIs
|
|
- Rate plans
|
|
- Access control
|
|
- Custom attributes
|
|
|
|
### Applications
|
|
Developer registrations for API access.
|
|
|
|
**Workflow**:
|
|
1. Developer registers on portal
|
|
2. Creates application
|
|
3. Subscribes to products
|
|
4. Receives API key/credentials
|
|
5. Accesses APIs
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/ISuite/developer-hub-41f7c45.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/ISuite/developer-hub-41f7c45.md)
|
|
|
|
---
|
|
|
|
## Analytics
|
|
|
|
### Dashboard Views
|
|
- API usage trends
|
|
- Response times
|
|
- Error rates
|
|
- Developer activity
|
|
- Geographic distribution
|
|
|
|
### Custom Reports
|
|
Create custom analytics with:
|
|
- Dimensions (what to measure)
|
|
- Measures (how to aggregate)
|
|
- Filters (what to include)
|
|
|
|
### Statistics Collector Policy
|
|
Capture custom metrics in API flows.
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-analytics-6766dc3.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-analytics-6766dc3.md)
|
|
|
|
---
|
|
|
|
## Best Practices
|
|
|
|
### Security
|
|
1. Always use API keys or OAuth
|
|
2. Apply threat protection policies
|
|
3. Validate input data
|
|
4. Use HTTPS only
|
|
5. Implement rate limiting
|
|
|
|
### Performance
|
|
1. Cache responses where appropriate
|
|
2. Use compression
|
|
3. Minimize policy chain length
|
|
4. Stream large payloads
|
|
|
|
### Design
|
|
1. Use consistent naming conventions
|
|
2. Version APIs properly
|
|
3. Document all endpoints
|
|
4. Use policy templates for reuse
|
|
5. Test with API debugger
|
|
|
|
### Operations
|
|
1. Monitor analytics regularly
|
|
2. Set up alerts for errors
|
|
3. Review quota usage
|
|
4. Keep certificates updated
|
|
|
|
---
|
|
|
|
## Variables Reference
|
|
|
|
### Request Variables
|
|
```
|
|
request.header.{name}
|
|
request.queryparam.{name}
|
|
request.path
|
|
request.uri
|
|
request.verb
|
|
```
|
|
|
|
### Response Variables
|
|
```
|
|
response.header.{name}
|
|
response.status.code
|
|
response.content
|
|
```
|
|
|
|
### Flow Variables
|
|
```
|
|
proxy.basepath
|
|
proxy.pathsuffix
|
|
target.url
|
|
error.message
|
|
error.status.code
|
|
```
|
|
|
|
**Documentation**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/variable-references-4f8993f.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/variable-references-4f8993f.md)
|
|
|
|
---
|
|
|
|
## Related Documentation
|
|
|
|
- **Policies Guide**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/policies-7e4f3e5.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/policies-7e4f3e5.md)
|
|
- **Policy Types**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/policy-types-c918e28.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/policy-types-c918e28.md)
|
|
- **API Proxy**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-proxy-8962643.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/apim/API-Management/api-proxy-8962643.md)
|
|
- **Developer Hub**: [https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/ISuite/developer-hub-41f7c45.md](https://github.com/SAP-docs/sap-btp-integration-suite/blob/main/docs/ISuite/developer-hub-41f7c45.md)
|