• BASIC Authentication
• JWT
• Keycloak OAuth

• Policies
• IP Blocklist
• IP Allowlist

API Contracts and API Keys

Only public APIs can be accessed by any consumer. The only way for a client to consume a private API is by using an API contract. An API contract is a link between a client and an API through a plan offered by that API.

API contracts can only be created between clients and published APIs which are offered through at least one plan. An API contract cannot be created between a client and a public API.

When an API contract is created, the system generates a unique API Key. This key is unique per client and the same for all contracts of this client. All requests made to the API by a client through the gateway must include this API Key. The API Key is used to create the runtime policy chain from the policies configured on the API, plan and client.

• Plans
• APIs
• Clients

• API Settings (twice)
• Metrics

• Metrics
• Client Settings

The API Documentation button and a button to download the API definition file are also available here.

The API Documentation button grants access to the Swagger UI where the user can test the API (refer to Testing APIs for further information).

• JWT

• Plan Settings
• Client Settings

The order of the policies is important. The order in which the policies appear in the user interface determines the order they will be applied at runtime. You can drag a policy up and down the list to change the order:

• Plan Settings
• Client Settings

• Organization Settings
• Finding Organizations
• API Settings
• Finding APIs
• Client Settings

• Client Settings
• Registering a Client
• Managing a Private API Creating a Contract
  (ACADEMY)

Do not forget to click the Save button when you have finished.

• API Settings (several times)

If more than one version of the API is available, the latest version will be displayed on top. To see the details of earlier versions, expand the labels below the open details page.

• The Concepts of API Management

Use the drop-down list to define which user group can browse the API and the corresponding plan. This affects the view in the API Management itself as well as in the API Developer Portal:

• Organization Members (default): All members of the organization. The PAS user must be listed in one of the Identity Management groups API-Management-Users, API-Management-Administrators or API-Management-Developer-Portal-Users.
• API Management Users: Any PAS user listed in Identity Management groups API-Management-Users or API-Management-Administrators.
• API Developer Portal Visitors: Any PAS user listed in Identity Management group API-Management-Developer-Portal-Users and any user who visits the API Developer Portal, whether logged in or not.

For detailed information about the visibility concept, visit page The Concepts of API Management.

Click to add a new item to a list, click to show/hide the list of items.

• CORS

For security reasons, the approver needs to confirm his choice.

For security reasons, you need to confirm the deletion.

Use icon to copy the key to the clipboard.

The user gets a corresponding notification in the API Developer Portal.

API Management sets the CORS headers in the following order:

1. CORS headers from the CORS policy have the highest priority.
2. If no CORS policy has been defined, CORS headers from the external API are used.

• CORS

APIs in API Management represent real back-end APIs (Application Programming Interfaces). An API is also known as a service, meaning anything that can be invoked remotely by some sort of client. API Management provides a way to turn unmanaged (raw) back-end APIs into managed APIs by attaching policies to them.

Every managed API can be published as Public API or Private API or both:

• Public APIs are available to consumers without a key. Only policies defined on the API apply to public APIs.
• Private APIs are only accessible for known consumers, called clients. Every client has an individual key to access the API. Policies defined on the client, the selected plan in the contract and the API apply.

In API Management, users can create new APIs manually or easily import them from the API Catalog.

• The Concepts of API Management

The client is the consumer of the API:

• The client consumes managed APIs offered through API Management.
• Each client can consume multiple APIs within API Management. The relation between client and API is defined via a contract and a plan.
• As with an API or a plan, you can also add policies to a client. When creating a contract, an API-Key to invoke the API will be assigned.

• The Concepts of API Management

A contract relates a client to an API, using a plan.

• The Concepts of API Management

Almost everything in the API Management data model exists in the context of an organization:

• An organization is a logical unit within API Management. This can be a company, department, etc.
• An organization is a container of other elements: plans, APIs, and clients are defined per organization.
• Every user must be associated with at least one organization to be able to manage elements in the application.
• API Management implements role-based access control for users. You can give organization members different roles to restrict the actions he is able to perform and the elements he can manage within the organization.
• Membership for each organization can be easily managed in the Organization tab.

• The Concepts of API Management

A plan is a set of policies that defines the level of service API Management provides for an API.

• Plans enable users to define multiple different levels of service for their APIs.
• Plans specify the contract between a client and an API.
• It is common to define multiple plans with divergent configuration options for the same API.
  Example:
  An organization offers two plans for the same API: Plan A is more expensive than plan B, but it offers a higher level of API requests in a given (and configurable) period of time.

• The Concepts of API Management

Policies are at the lowest level of the data model, but they are the most important concept: A policy is a rule or a set of rules API Management uses to manage access to your APIs.

• Policies are applied to all API requests and represent a unit of work applied at runtime to the request by API Management.
• You can define a policy chain, a defined order in which the policies will be applied to API requests.

• The Concepts of API Management

Downloads the API definition file.

Displays the Open API definition (Swagger) and allows for making test calls if the API is available.

On the details page of a Public API, users can find further information about the API such as an extended description and the public endpoint.

• Plans
• Managing a Private API Creating an Organization
  (ACADEMY)

API Management uses the Identity Management to manage its users. This tool can manage users for multiple applications. Data for each application is stored in so called "realms":

• Users of Identity Management itself are stored to realm Master.
• Users of API Management and Log Analyzer are stored to realm Apiman.

Thus, you need to have to separate admin accounts: one for Identity Management, and one for API Management.

• Managing Users and Permissions

• Plan Settings
• Securing Designer Services via API Management

• Deleting an Organization
• Deleting a Plan
• Deleting an API
• Deleting a Client

• IP Blocklist
• IP Allowlist

1. First of all you can consult our complete technical documentation.
   The documentation is divided into several guides:
   
   • an API Management User's Guide
     You can search this documentation using the search box on the left, in top of the content tree.
   • Installation Guides for all modules
2. If you can't solve your problem with help of the documentation, you can file a ticket to our support team at support@scheer-pas.com.
   All mails to our support mailbox will open a ticket in our service desk.
   Optionally, you may use our service desk portal. There, you can manage your tickets and raise new support requests. Using the portal requires you to register your email address, which will not take much time.

3. To help you with your problem, our Support team needs some information on your software and environment. Please refer to Information to Include in a Support Request for more details on this.

• Troubleshooting

• Testing APIs
• Managing a Public API Testing API Access
  (ACADEMY)

If the configuration is invalid, an error message will be shown including further information about the error itself:

• Managing Gateways

If the gateway configuration is correct, you will get a success message:

• Managing Gateways

• Testing APIs
• Managing the Developer Portal

• Metrics (2x)

• Creating an Organization
• Managing a Private API Creating an Organization
  (ACADEMY)