Вы находитесь на странице: 1из 71

SAP HANA Cloud Platform

API Management

s li de only w ith an image


Use this titl e
Agenda

§ Introduction and Value Proposition


§ Connecting to API Management from SAP CP
§ Overview of Concepts
§ Development of API Proxies and Products
§ Consumption of Products via Applications
§ Supplying the API Key at Runtime
§ Preparing SAP CP Destinations for Web IDE
§ Consuming API Proxies in Web IDE
§ Overview of API Proxy Policies
§ API Proxy Routing Overview
§ Understanding the API Policy Designer
§ Adding New API Policies

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 2


API Management
Introduction
Digital Transformation – Providing APIs To Drive Innovation

Systems of innovation

Days
Customers Employees Partners
SAP API Management – SAP HANA Cloud Platform
Pace of change

Systems of engagement (E.G. PI)

Security Mediation Traffic management Analytics Notification

Enterprise service bus/Integration


CRM ERP Database Data warehouse Data lake
Years

Systems of record

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 4


When to use API management (APIM)?

Internet of Things

Integration, SOA, ESB Employee apps (B2E)

Systems (ERP) modernization Developer ecosystems

Enterprise architecture Consumer apps (B2C)

Social, mobile, analytics, cloud Partner apps (B2B)

IT-as-a-Service

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 5


SAP API Management
Enabling Innovation and Bimodal IT*

API platform provides tools to expose and API analytics provides powerful tools Developer services provides tools
manage APIs for API usage analysis. to manage API usage by app
Helps create and consume APIs, be it building Show API usage based on IP address, developers.
API proxies as a service provider or using APIs, URL, and user ID information etc. Control access to APIs through a
SDKs, and other convenient services as an app Collect and analyze latency data. developer portal that exposes the
developer publicly available API products

SAP API MANAGEMENT


API PLATFORM API ANALYTICS DEVELOPER
SERVICES

* Bimodal IT is the practice of managing two separate, coherent modes of IT delivery, one focused on stability and the other on agility.
Mode 1 is traditional and sequential, emphasizing safety and accuracy. Mode 2 is exploratory and nonlinear, emphasizing agility and speed.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 6


API Management (APIM)
Connecting to APIM Through SAP CP
SAP API Management (APIM)
Accessing the API Management Services 1/2

Log on to your SAP CP account.


Select “Services” from the side bar
menu.
Scroll down to the section titled
“Integration”
Select “API Management”.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 8


SAP API Management (APIM)
Accessing the API Management Services 2/2

You now have access to the


various API Management (APIM)
tools:
Ÿ The API Portal for developing
API Proxies and Products.
Ÿ The Dev Portal for consuming
API Products as Applications.
Ÿ The destinations and roles used
by the API and Dev Portals.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 9


SAP API Management (APIM)
Home Screen

On the API Management home screen, you


see various analytic tiles that provide you
with a summary of your all your APIs.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 10


API Management
Overview of Concepts
SAP API Management
Overview of APIM entities

When using SAP API Management, you will be creating and working with four different entities:
1) API Providers : The backend business systems whose APIs need to be exposed
2) API Proxies : 1 or more URLs exposed by a backend system
3) Products : Aggregations of 1 or more API Proxies that form the unit of “API exposure”
4) Applications : Aggregations of 1 or more Products that form the unit of “API consumption”

Application Application Application Application

Product Product Product Product

API Proxy API Proxy API Proxy API Proxy API Proxy API Proxy API Proxy API Proxy

API Provider API Provider API Provider

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 12


SAP API Management
Development and Consumption

There are two distinct views of the APIM data. These are provided through two different tools:
Ÿ API Portal – Used by the developer of API Proxies and is concerned with exposing API Proxies as Products
Ÿ Dev Portal – Used by the consumer of the API Proxies and is concerned with creating Product subscriptions
known as “Applications”

Consumption of APIs through the Dev Portal

Application Application Application Application

Product Product Product Product

API Proxy API Proxy API Proxy API Proxy API Proxy API Proxy API Proxy API Proxy

API Provider API Provider API Provider

Development of API Proxies & Products through the API Portal

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 13


API Management
Development of API Proxies and Products
SAP API Management – API Development Using the API Portal
Create an API Provider

To start the configuration process, you must first create an API Provider.
In the API Portal, select “Configure” from the hamburger menu in the top left of the screen. Application
Now you can create a new API Provider.
Product

API Proxy

API Provider

Develop

Important:
The API Management service within SAP CP maintains its own set
of destinations that are independent from standard SAP CP
destinations!
© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 15
SAP API Management – API Development Using the API Portal
Create an API Proxy

Once a System has been created, you may now create an API Proxy for any service exposed
by that system, E.G. an OData service. In the API Portal, select “Manage” from the
hamburger menu, Application
Then select “API” from the Toolbar.
Now you can create a new API Proxy. Product

API Proxy

API Provider

Develop

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 16


SAP API Management – API Development Using the API Portal
Add an API Proxy to a Product

An API Proxy will remain hidden from the outside world until it is added to a Product.
Think of a Product as the basic unit of “API Exposure”.
Application
In the same “Manage” screen in which you created the API Proxy, select “Product” from the
toolbar.
Now you can expose API Proxies for consumption by adding them to a new Product. Product

API Proxy

API Provider

Develop

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 17


API Management
Consumption of Products via Applications
SAP API Management – API Consumption Using the Dev Portal
Browse API Products
Consume
Now switch to the API Management Dev Portal and select “Discover”.
You will now see a list of all the available API Products. By clicking on a Product, you will Application
see all the API Proxies it contains.
In the Dev Portal, you may only consume API Proxies; you cannot edit them.
Product

API Proxy

System

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 19


SAP API Management – API Consumption Using the Dev Portal
Subscribe to API Products by creating an Application
Consume
In order to consume API Proxies, you must first create a unit of “API Consumption” known
as an Application. You can think of an Application as “the set of API Products specific to the
needs of my particular use case”. Application
Select “Consume” from the hamburger menu. From here you can create a new Application
I.E. a new subscription to one or more Products specific to your particular requirements. Product

API Proxy

System

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 20


API Management
Preparing SAP CP Destinations for Web IDE
SAP API Management – Runtime Consumption of APIs
Consuming an API Proxy from Web IDE

The three steps necessary to make an API Proxy ready for consumption are now complete.
We have: Application
1. Created an API Proxy
2. Exposed the API Proxy to the outside world by adding it to a Product Product
3. Subscribed to that Product by creating an Application

API Proxy
We must now perform two preliminary configuration steps before we can consume our API
Proxy using a Template Wizard in Web IDE.

Once these configuration steps have been performed, they do not need to be repeated when creating further apps
in Web IDE.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 22


SAP API Management – Runtime Consumption of APIs
Consuming an API Proxy from Web IDE – Preliminary Configuration

In order for Web IDE to be able to consume API Proxies, we must create two SAP CP
destinations:
1. One used by the WEB IDE Template Wizard at design time
2. The other used by Web IDE apps at runtime

Design time Runtime


destination destination

HTTP HTTP
WebIDEEnabled = true WebIDEEnabled = true
WebIDEUsage = api_mgmt_catalog WebIDEUsage = api_mgmt_proxy

When creating these SAP CP destinations, you may give them any names you like.
However, you must ensure that the WebIDEEnabled and WebIDEUsage properties have been
set correctly.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 23


SAP API Management – Runtime Consumption of APIs
Create an SAP CP Destination for the Web IDE Template Wizard

Create an SAP CP destination for use by the template wizard at design time.
Ÿ You are free to choose any name and description you like for this destination
Ÿ Enter the URL to either your Dev Portal or some public API service such as the SAP API Hub
Ÿ You must add the additional properties shown below, otherwise Web IDE will not:
1. Be permitted to use this destination
2. Recognise this destination as a source of API Management Proxies

Destination Configuration

New Property
* Name: API_Management_Dev_Portal_Trial Additional Properties
Type: HTTP WebIDEEnabled true
Description: API Management Dev Portal WebIDEUsage api_mgmt_catalog

* URL: <Your dev portal URL goes here>

Proxy Type: Internet Use default JDK truststore


Authentication: AppToAppSSO

Edit Clone Export Delete Check Connection

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 24


SAP API Management – Runtime Consumption of APIs
Create an SAP CP Destination for Web IDE Apps at Runtime

Create an SAP CP destination for use by applications at runtime.


Ÿ You are free to choose any name and description you like for this destination
Ÿ The URL is formed from the fully qualified hostname and port number shown in the URL of your API Proxy
Ÿ You must add the additional properties shown below, otherwise Web IDE will not:
1. Be permitted to use this destination
2. Recognise this destination as the backend system for your app at runtime

Destination Configuration

New Property
* Name: API_Management_Endpoint_Trial Additional Properties
Type: HTTP WebIDEEnabled true
Description: API Management EndPoint trial HCP landscape WebIDEUsage api_mgmt_proxy

* URL: <Your API portal URL goes here>

Proxy Type: Internet Use default JDK truststore


Authentication: NoAuthentication

Edit Clone Export Delete Check Connection

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 25


API Management
Supplying the API Key At Runtime
SAP API Management – Overview of Dev Portal Tasks
Finding an Application’s API Key
Consume
Every Application (I.E. Product subscription) within API Management is assigned a unique
Application (or API) Key.
Application
This is a randomly generated security code that must* be supplied with all API requests.

Product

API Proxy

System

* The presence of an API Key is checked for by each API


Proxy individually; therefore, not all API Proxies subscribed to
through an Application will necessarily require an API Key.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 27


SAP API Management – Runtime Consumption of APIs
API Key – To supply, or not to supply? That is the question.

Each API Proxy performs its own check for an API Key.
As we know, multiple API Proxies can be added to the unit of exposure known as a Product.
And multiple Products can be subscribed to through the unit of consumption known as an Application.

Application

Product Product

API Proxy API Proxy API Proxy API Proxy API Proxy API Proxy
Check for API Key Check for API Key Check for API Key

Therefore at runtime, it is entirely possible that your Application will provide access to a mixture of API Proxies:
Ÿ Some that check for an API Key,
Ÿ And some that do not.
Consequently, from the perspective of Application consumption, it is best practice always to supply the API Key,
even if the individual API Proxy you are consuming does not require it.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 28


SAP API Management – Runtime Consumption of APIs
API Key – Should I send it in the HTTP Header or as a Query String Parameter?

Q: How can I discover whether or not an API


Proxy requires an API Key?
A: Test the API and check for 2 error messages:
“FailedToResolveAPIKey” and
HTTP status code “401 Unauthorized”

1) Error message from


the API policy

2) HTTP status code caused


by the API Policy failure

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 29


SAP API Management – Runtime Consumption of APIs
API Key – Should I send it in the HTTP Header or as a Query String Parameter?

If you get both of the error messages “FailedToResolveAPIKey” and “HTTP 401 Unauthorised”, then the text
shown in red below indicates where the API policy is looking to find the API Key.

Destination Configuration
{
"fault":{
"faultstring":"Failed to resolve API Key variable request.header.APIKey",
"detail":{
"errorcode":"steps.oauth.v2.FailedToResolveAPIKey"
} Here, the API policy is looking for an
} HTTP header field called “APIKey”
} Both are perfectly
But here, the API Policy is looking for a valid possibilities
query string parameter called “apikey”
Destination Configuration
{
"fault":{
"faultstring":"Failed to resolve API Key variable request.queryparam.apikey",
"detail":{
"errorcode":"steps.oauth.v2.FailedToResolveAPIKey"
}
}
}

CAUTION: Although it makes good sense to use a field name such as APIKey or apikey, this is not a requirement.
In reality, the field carrying this value can have any name the API Proxy developer wants!
© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 30
API Management
Consuming API Proxies in Web IDE
SAP API Management
Consuming API Proxies in Web IDE 1/4

Now that we have created the necessary SAP CP


destinations for use by Web IDE, we can use the
Template Wizard to generate an app for us.
In Web IDE, we will demonstrate this feature using
the SAP Fiori Master-Detail Application template.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 32


SAP API Management
Consuming API Proxies in Web IDE 2/4

Having given our app a name, we must chose


“Service Catalog” and then select the SAP CP
destination we just created for Web IDE at design
time.
Important:
In this example, the SAP CP destination we setup
for Web IDE at design time points to our own API
Dev Portal. Therefore, the list of API proxies we
now see are only those that we have configured.
Clicking on “Subscribe” does not (yet) create the
subscription to the API Proxy.
First, we must select the Product.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 33


SAP API Management
Consuming API Proxies in Web IDE 3/4

We now select the Product through which this API


Proxy has been exposed.
Remember!
Although only one Product is shown in the screen
shot, the same API Proxy could be exposed
through multiple Products.
Now when you click on “Select Product”, this is the
point in time at which a new Application (or
Product Subscription) is created in your Dev Portal.
Now move to the next screen.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 34


SAP API Management
Consuming API Proxies in Web IDE 4/4

We now see the normal template wizard screen in


which you specify the configuration of the Master-
Detail application.
Proceed through these screens in the normal
manner.
When the wizard completes, you will have an
application that needs one last alteration before
you can execute it.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 35


SAP API Management
Add the API Key to the App Descriptor file (manifest.json)

After the Template Wizard has generated your application, "sap.ui5": {


you need to add the API Key into the manifest.json file. ** snip **
Edit the manifest.json file and locate the default model by "models": {
navigating down the JSON object: "i18n": {
"type": "sap.ui.model.resource.ResourceModel",
sap.ui5: à "settings": {
models: à "bundleName": "com.sap.rig.demo.i18n.i18n"
}
"": },
At this point, we need to know two things about how the API "": {
Proxy processes the API Key: "dataSource": "mainService",
"settings": {
1. Will it look for this value in the HTTP headers or in the
"metadataUrlParams": {
query string? "sap-documentation": "heading"
2. In which field name should the API Key value be placed? },
"headers" : {
Once you have answered these questions, you can then edit
"APIKey" : "LeQAyRqelY5mW6GhgxgK4DY9il73I0aB"
manifest.json.
}
In this case, we add a new section called “headers” }
(highlighted in yellow) within which is the single property }
APIKey. },

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 36


API Management
Overview of API Proxy Policies
SAP API Management
Additional API Proxy Configuration and Functionality

After selecting an API Proxy, you see


its configuration overview.
We will now use the Policy Designer
to enhance the functionality of this
API Proxy.
An API Policy is an additional unit of
functionality that can be added to the
request/response cycle.
This is the heart of API Management.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 38


SAP API Management
API Policy Designer Screen Layout

The Policy Designer Screen is split into 4 main areas:


Policy Flow Routing

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 39


SAP API Management
API Policy Designer Screen Layout

The Policy Designer Screen is split into 4 main areas:


Policy Flow Routing

§ Endpoint Segments
§ Flow Processing
Stages
§ Scripts

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 40


SAP API Management
API Policy Designer Screen Layout

The Policy Designer Screen is split into 4 main areas:


Policy Flow Routing

§ Endpoint Segments
§ Flow Processing Policy Types
Stages
§ Scripts

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 41


SAP API Management
API Policy Designer Screen Layout

The Policy Designer Screen is split into 4 main areas:


Policy Flow Routing

§ Endpoint Segments
§ Flow Processing Policy Types
Stages
§ Scripts

Policy Properties and Script Editor


© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 42
SAP API Management
API Policy Designer Screen Layout

IMPORTANT:
The Policy Flow Routing diagram only shows you part of the overall request/response cycle.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 43


API Management
API Policy Flow Routing Overview
SAP API Management
API Policy Routing Overview – Inbound Proxy End Point Segment 1/3

API Management divides the request/response cycle into two distinct segments.
The difference between these segments determines whether or not the processing happens before or after the
Route Rules are applied.

Incoming Stream

Route
Rules

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 45


SAP API Management
API Policy Routing Overview – Inbound Proxy End Point Segment 1/3

The incoming request is received by API Management and any policies assigned to the Pre Flow processing
stage are executed.
For example, checking for the presence of an API Key or that a usage quota has not been exceeded etc.

Incoming Stream

Request Route
Pre Flow
Rules

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 46


SAP API Management
API Policy Routing Overview – Inbound Proxy End Point Segment 2/3

A Condition Flow is a predicate to which zero or more policies can be assigned. Any Condition Flow that evaluates to true will have its
policies executed. A Condition Flow is automatically generated for each collection in an OData service.
E.G. If you want a particular API Policy to run when a request is made to a specific OData Collection, then assign that API Policy to that
OData Collection’s Condition Flow.

Incoming Stream

Request Condition Route


Pre Flow
Flows Rules

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 47


SAP API Management
API Policy Routing Overview – Inbound Proxy End Point Segment 3/3

Once all the matching Condition Flows have been executed, any policies assigned to the Post Flow processing
stage are executed.

Incoming Stream

Request Condition Route


Pre Flow Post Flow
Flows Rules

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 48


SAP API Management
API Policy Routing Overview – Route Rules (You Shall Not Pass!)

Now we must decide whether or not the request should continue on to the backend system.
At this point, the Route Rules can, if necessary, abort the entire request and return a null response to the requestor.
E.G. if an HTTP request uses the HEAD or OPTIONS method, then there is no need to pass such a request on to the backend.
IMPORTANT: Only the first matching Route Rule will ever be executed.

Incoming Stream

Request Condition Route Default


Pre Flow Post Flow
Flows Rules
NONE

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 49


SAP API Management
API Policy Routing Overview – Inbound Target End Point Segment

Now that we know for certain the request will be passed to the backend, then another set of Pre Flow, Condition Flow and Post Flow
processing stages are performed in the Target Endpoint Segment.
The policies assigned to these processing stages focus on managing requests for the specific target system. E.G. Handling parameters
related to ad campaigns or the link referrer.

Incoming Stream

Request Condition Route Default Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 50


SAP API Management
API Policy Routing Overview – Outbound Target End Point Segment

Once the backend has serviced the request, then if present, the Pre Flow, Condition Flow and Post Flow
processing stages in the Target Endpoint segment are now executed on the Outgoing Stream.

Incoming Stream

Request Condition Route Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Condition
Post Flow Pre Flow
Flows

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 51


SAP API Management
API Policy Routing Overview – Outbound Proxy End Point Segment

If present, the final set of processing stages are now performed in the Proxy End Point segment.
Here, you would typically handle tasks such as format conversion or hiding internal server hostnames.

Incoming Stream

Request Condition Route Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

Proxy Endpoint Target Endpoint


Client Segment Segment Backend

Response
Condition Condition
Post Flow Pre Flow Post Flow Pre Flow
Flows Flows

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 52


API Management
Understanding the API Policy Designer
SAP API Management
Understanding the API Policy Designer

The Policy Flow editor provides a graphical representation of the incoming and outgoing policies assigned to one
stage of a processing segment.

Check IP add… Check API Ke… Check Quota …

IMPORTANT
This diagram does not show you all the policies that might be processed during the entire
request/response cycle.
It shows only the policies assigned to the selected stage of the selected segment.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 54


SAP API Management
Understanding the API Policy Designer – Select the Segment 1/2

From the Flows menu on the left of the Policy Designer, collapse both menu items and you will see that you are
looking at the two processing segments seen in the overview diagram below:

Ÿ Proxy Endpoint segment

Incoming Stream

Request Condition Route Default Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

NONE
Proxy Endpoint Target Endpoint
Client Segment Segment Backend

Response Condition Condition


Post Flow Pre Flow Post Flow Pre Flow
Flows Flows

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 55


SAP API Management
Understanding the API Policy Designer – Select the Segment 2/2

From the Flows menu on the left of the Policy Designer, collapse both menu items and you will see that you are
looking at the two processing segments seen in the overview diagram below:

Ÿ Proxy Endpoint segment


Ÿ Target Endpoint segment

Incoming Stream

Request Condition Route Default Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

NONE
Proxy Endpoint Target Endpoint
Client Segment Segment Backend

Response Condition Condition


Post Flow Pre Flow Post Flow Pre Flow
Flows Flows

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 56


SAP API Management
Understanding the API Policy Designer – Select the Stage within the Segment 1/3

Next, expand the ProxyEndpoint menu item and select PreFlow.


From the perspective of the overall request/response flow, the Policy Flow diagram shows you only these policies.

Incoming Stream

Request Condition Route Default Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

NONE
Proxy Endpoint Target Endpoint
Client Segment Segment Backend

Response Condition Condition


Post Flow Pre Flow Post Flow Pre Flow
Flows Flows

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 57


SAP API Management
Understanding the API Policy Designer – Select the Stage within the Segment 2/3

By selecting the PostFlow stage of the ProxyEndpoint segment, we are now looking only at these policies.

Incoming Stream

Request Condition Route Default Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

NONE
Proxy Endpoint Target Endpoint
Client Segment Segment Backend

Response Condition Condition


Post Flow Pre Flow Post Flow Pre Flow
Flows Flows

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 58


SAP API Management
Understanding the API Policy Designer – Select the Stage within the Segment 3/3

Finally, by selecting one of the Condition Flows of the ProxyEndpoint segment, we are now looking only at
these policies.

Incoming Stream

Request Condition Route Default Condition


Pre Flow Post Flow Pre Flow Post Flow
Flows Rules Flows

NONE
Proxy Endpoint Target Endpoint
Client Segment Segment Backend

Response Condition Condition


Post Flow Pre Flow Post Flow Pre Flow
Flows Flows

Outgoing Stream

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 59


SAP API Management
Understanding the API Policy Designer

Here, the Policy Flow diagram shows the policies assigned to the PreFlow stage of the ProxyEndpoint segment.

Check IP add… Check API Ke… Check Quota …

In this case, the Incoming Stream (the line along the top) has three policies assigned to it,
and the Outgoing Stream (the line along the bottom) has no policies assigned to it.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 60


SAP API Management
Understanding the API Policy Designer

If we now select the PostFlow stage, we can see a single policy has been assigned its Outgoing Stream.

Mask URL in…

In this case, this particular policy is designed to mask the hostname of internal servers that
might appear in the response.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 61


API Management
Adding New API Policies
SAP API Management
Adding New API Policies

Select the PreFlow stage of the ProxyEndpoint segment.


After pressing Edit in the bottom right hand corner of the screen, we can now add a new policy.

From the menu on the right, scroll down to the bottom of the list and press the plus sign next
to the “Verify API Key”.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 63


SAP API Management
Adding New API Policies

In the “Create Policy” pop-up screen, give the policy instance a name (“CheckAPIKey” in this case) and ensure
that it is assigned to the Incoming Request stream.

IMPORTANT
Do not use spaces within a Policy name.
Although this is permitted by the editor, one policy will not be able
to refer to any other policy that contains spaces in its name.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 64


SAP API Management
Adding New API Policies

Our CheckAPIKey policy has now been assigned to incoming stream of the PreFlow processing stage of the
ProxyEndpoint segment. In the editor window underneath the diagram, we can see the definition of this
particular policy.

CheckAPIKey

Edit the value of the ref field to point to the location in which this
policy expects to find the API Key value.
Here, by using request.header.APIKey, we are instructing
this policy to look in the HTTP header for a field called “APIKey”

Check API Key


1 <!--Specify in the APIKey element where to look for the variable containing the api key-->
2 <VerifyAPIKey async='true' continueOnError='false' enabled='true' xmlns='http://www.sap.com/apimgmt'>
3 <APIKey ref='request.header.APIKey'/>
4 </VerifyAPIKey>

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 65


API Management
Route Rules
SAP API Management
Route Rules – You Shall Not Pass!

Route Rules are used to decide whether or not a request should be passed to the backend system.
E.G. If the HTTP request uses the HEAD methods, then there is no reason to pass that request on to the backend.
To add a Route Rule, select the API Proxy you wish to modify.
Now press Edit

Select Route Rules from the Advanced properties menu

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 67


SAP API Management
Route Rules

In this case our route rule will reject incoming requests that use the HTTP method (or verb) “HEAD”.
The Target Endpoint dropdown list defines where the request will be routed if the condition evaluates to true.
By setting the Target Endpoint to NONE, we indicate that a null request is to be returned to the client if the condition
is route rule condition evaluates to true.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 68


SAP API Management
Route Rules

IMPORTANT
Route Rules are checked sequentially and only the first matching rule will be obeyed. After that, no further route
rules are tested. Therefore, you should place the most specific rules first and the most generic rules last.
Notice that the last entry is a “default” route rule with no condition. This ensures that after all the route rules have
been checked, all requests are routed to the default Target Endpoint.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 69


Thank You

Contact information:
chris.whealy@sap.com

© 2016 SAP SE or an SAP affiliate company. All rights reserved.


© 2016 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an
SAP affiliate company.

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE
(or an SAP affiliate company) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional trademark
information and notices.

Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors.

National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its
affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or
SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing
herein should be construed as constituting an additional warranty.

In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or
release any functionality mentioned therein. This document, or any related presentation, and SAP SE’s or its affiliated companies’ strategy and possible future
developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for
any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-
looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place
undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.

© 2016 SAP SE or an SAP affiliate company. All rights reserved. Customer 71

Вам также может понравиться