API Lifecycle Management with API Manager (Course #api-lifecycle)

Programme every line is something you do

6 modules · 18 topics · in course-flow order

1. Module 1

   Policy chains that hold under load

   Objective. Design an ordered API Manager policy chain so each partner endpoint runs rate limiting, throttling and CORS with verified behavior.

   • Calibrate Rate-Limiting and Spike-Control per partner contract (e.g. 50 req/s sustained, burst 100 for 10 s) and verify the HTTP 429 response
   • Configure the CORS policy: origin, method and header allow-lists plus preflight caching, avoiding wildcard grants on partner endpoints
   • Compose and order policies — Client-Id Enforcement before throttling — and budget 1-3 ms of added latency per hop
2. Module 2

   Consumer onboarding under control

   Objective. Operate application registration in API Manager so every consumer carries owned, revocable credentials bound to exactly one SLA tier.

   • Register consuming applications in API Manager and scope their visibility through business groups and environments
   • Issue client_id/client_secret credentials and attach contracts; rotate secrets on a 90-day cycle with dual-validity overlap
   • Audit the application registry quarterly and revoke orphaned contracts (target: no inactive application beyond 30 days)
3. Module 3

   Tokens enforced, trust never assumed

   Objective. Set up OAuth 2.0 grant types and JWT validation in API Manager so unsigned, expired or wrong-audience tokens die at the gateway.

   • Configure OAuth 2.0 token policies per scenario: client_credentials machine-to-machine, authorization_code + PKCE for portals
   • Validate JWT signatures locally against the IdP JWKS endpoint and enforce iss, aud and exp claims without remote introspection
   • Cost each option — cached JWKS roughly 1-2 ms per call, remote introspection 20-50 ms — and record the trade-off decision
4. Module 4

   Version without breaking

   Objective. Run versioning and deprecation inside API Manager so legacy versions retire on schedule without severing a single active contract.

   • Lock one versioning strategy — URI path (/v1) versus Accept header — and record it in your API governance standards
   • Stage deprecation with lifecycle states: bar new contracts on v1 and auto-notify active consumers 90 days ahead
   • Track migration on the contract dashboard until deprecated versions reach zero active contracts (target: 90-day exit)
5. Module 5

   SLA tiers proven at the gateway

   Objective. Define and enforce SLA tiers so every partner consumes exactly its contracted quota, with evidence collected at the gateway.

   • Model Silver/Gold/Platinum tiers (e.g. 10, 50, 200 req/s) and map each application contract to exactly one tier
   • Apply Client-Id Enforcement so uncontracted calls fail fast with 401/403 instead of reaching backend systems
   • Audit per-contract usage in API analytics and renegotiate quotas when a partner sustains over 80% of its ceiling
6. Module 6

   Capstone: A Partner Through the Full Lifecycle

   Objective. Run one Alderbank fintech through onboarding, tiered SLA, credential rotation and a version transition — measured.

   • Register the app, attach the Gold tier (50 req/s sustained) and prove Client-Id Enforcement rejects uncontracted calls with 401
   • Rotate a compromised client_secret without downtime; confirm stale credentials die while in-flight OAuth grants survive
   • Drill the v1 → v2 transition: bar new contracts, auto-notify 90 days out, drive active v1 contracts to zero

References & Official Documentation every claim above has a source

Module 1

• Rate Limiting PolicyMuleSoft Docs

Module 2

• Client Applications, Contracts, and CredentialsMuleSoft Docs

Module 3

• OAuth 2.0 Grant TypesSpecification
• RFC 7519: JSON Web Token (JWT)Specification
• JWT Validation PolicyMuleSoft Docs

Module 4

• Deprecating an API Instance on API ManagerMuleSoft Docs

Module 5

• Reviewing SLA Tiers ConceptsMuleSoft Docs

Module 6

• Client ID Enforcement PolicyMuleSoft Docs

More in API Management & Security