This site contains the documentation that is relevant to older WSO2 product versions and offerings.
For the latest WSO2 documentation, visit https://wso2.com/documentation/.

Enforcing Throttling and Resource Access Policies

Owned by Former user (Deleted)
Last updated: Oct 16, 2020 by Former user (Deleted)
2 min read

Throttling allows you to limit the number of hits to an API during a given period of time, typically to protect your APIs from security attacks and your backend services from overuse, regulate traffic according to infrastructure limitations and to regulate usage. For information on different levels of throttling in WSO2 Cloud, see Throttling tiers.

In this tutorial, you engage throttling and resource access policies at various levels to your API and observe how the API Gateway enforces them in the API.

Before you begin,

Let's get started.

  1. Sign in to the API Store and select the PhoneVerification API.

  2. Subscribe to the API using the Bronze tier if you haven't done so already.
     

  3. In the API Store, click the APPLICATIONS menu, click DefaultApplication to open it, and then click the Production Keys tab. If you already have an access token for the application, you may have to scroll down and click Re-generate. Access tokens expire 1 hour after creation unless you extend the period. 


    Let's invoke this API. 

  4. Click on the API, then go to its API Console tab and expand the GET method.
     

  5. Give values to the parameters (PhoneNumber 18006785432 and LicenseKey 0) and click Try it out to invoke the API.

  6. Note the response that appears in the API Console. As we used a valid phone number in this example, the response returns as valid.

  7. Note that you subscribed to the API on the Bronze throttling tier. The Bronze tier allows you to make a 1000 calls to the API per minute. If you exceed your quota, you get a throttling error as shown below.

    Let's try to invoke the API using an unavailable resource name.

  8. Click the APIs menu in the API Store, click the API you want to invoke and then copy the production URL in the API's Overview tab.
     

  9. Append the payload to the API's URL you copied earlier. For example, https://gateway.api.cloud.wso2.com:443/t/companyn3/phoneverify/1.0.0/CheckPhoneNumber?PhoneNumber=18006785432&LicenseKey=0.
    Let's invoke the API.

  10. Install cURL or any other REST client.

  11. Go to the command-line and invoke the API using the following cURL command. 
    Note that the PhoneVerification API's resource name is CheckPhoneNumber, but we use an undefined resource name as CheckPhoneNum.

    curl -k -H "Authorization: Bearer <access token in step 3>" '<API's URL in step 9>/CheckPhoneNum?PhoneNumber=18006785432&LicenseKey=0'

    Here's an example:

    curl -k -H "Authorization: Bearer 0bc0500523dddc5c973971f16b19103e" 'https://gateway.api.cloud.wso2.com:443/t/companyn3/phoneverify/1.0.0/CheckPhoneNum?PhoneNumber=18006785432&LicenseKey=0'
  12. Note that the call gets blocked by the API Gateway with a 'no matching resource' message. It doesn't reach your backend services as you are trying to access a REST resource that is not defined for the API. 

You have seen how the API Gateway enforces throttling and resource access policies for APIs.