Engaging Multiple Throttling Policies to a Single API

You can apply different throttling policies at the same time to a single API. This is called multi-layer throttling.

The following example shows how to have two throttling policies for a single API at a given time. The table below shows the throttling information of the two throttling policies.

Tier	throttle-l1	throttle-l2
free	300 per month	5 per 3 minutes
Silver	2000 per month	1 per 5 seconds
Gold - Unlimited	Unlimited	Unlimited

To engage the two throttling layers, you add two throttling tier definitions and engage them to the API using the steps below:

Go to the Synapse configuration file of the particular API located in <API-M_HOME>/repository/deployment/server/synapse-configs/default/api.

Copy the following content inside the <handlers> section in the API configuration.

<handler class="org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler"/>
<handler class="org.wso2.carbon.apimgt.gateway.handlers.throttling.APIThrottleHandler">
	<property name="id" value="B"/>
	<property name="policyKey" value="gov:/apimgt/applicationdata/throttling-l2.xml"/>
</handler>
<handler class="org.wso2.carbon.apimgt.gateway.handlers.throttling.APIThrottleHandler">
	<property name="id" value="A"/>
	<property name="policyKey" value="gov:/apimgt/applicationdata/tiers.xml"/>
</handler>

Replace the existing content of the /_system/governance/apimgt/applicationdata/tiers.xml file with following content.

throttling-l1.xml

<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:throttle="http://www.wso2.org/products/wso2commons/throttle">
    <throttle:MediatorThrottleAssertion>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">Gold</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>20</throttle:MaximumCount>
                        <throttle:UnitTime>60000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">Silver</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>2000</throttle:MaximumCount>
                        <throttle:UnitTime>2592000000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">free</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>300</throttle:MaximumCount>
                        <throttle:UnitTime>2592000000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">Unauthenticated</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>60</throttle:MaximumCount>
                        <throttle:UnitTime>60000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
    </throttle:MediatorThrottleAssertion>
</wsp:Policy>

Create an XML as throttling-l2.xml with the following content and add it to /_system/governance/apimgt/applicationdata registry location.
The code adds two policies for each role (free, Silver, Gold) and engages them to the APIs with different keys. Both throttling layers execute in runtime sequentially.

throttling-l2.xml

<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:throttle="http://www.wso2.org/products/wso2commons/throttle">
    <throttle:MediatorThrottleAssertion>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">Gold</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>20</throttle:MaximumCount>
                        <throttle:UnitTime>60000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">Silver</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>1</throttle:MaximumCount>
                        <throttle:UnitTime>5000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">Free</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>5</throttle:MaximumCount>
                        <throttle:UnitTime>180000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
        <wsp:Policy>
            <throttle:ID throttle:type="ROLE">Unauthenticated</throttle:ID>
            <wsp:Policy>
                <throttle:Control>
                    <wsp:Policy>
                        <throttle:MaximumCount>60</throttle:MaximumCount>
                        <throttle:UnitTime>60000</throttle:UnitTime>
                    </wsp:Policy>
                </throttle:Control>
            </wsp:Policy>
        </wsp:Policy>
    </throttle:MediatorThrottleAssertion>
</wsp:Policy>