- What's New
- Function Overview
- Product Bulletin
- Service Overview
- Billing
- Getting Started
-
User Guide
- Process of Using APIG
- Creating a User and Granting APIG Permissions
- Creating a Gateway
- Opening APIs
- (Optional) Configuring Authorization for API Calling
- Calling APIs
-
Managing APIs
- Overview
- Viewing or Modifying API Information
- Configuring Custom API Authentication
- Configuring API Parameter Orchestration Rules
- Customizing Error Response for APIs
- Cloning an API
- Taking an API Offline
- Importing and Exporting APIs
-
API Design File Extension Definitions
- x-apigateway-auth-type
- x-apigateway-request-type
- x-apigateway-match-mode
- x-apigateway-cors
- x-apigateway-is-send-fg-body-base64
- x-apigateway-any-method
- x-apigateway-backend
- x-apigateway-backend.parameters
- x-apigateway-backend.httpEndpoints
- x-apigateway-backend.httpVpcEndpoints
- x-apigateway-backend.functionEndpoints
- x-apigateway-backend.mockEndpoints
- x-apigateway-backend-policies
- x-apigateway-backend-policies.conditions
- x-apigateway-ratelimit
- x-apigateway-ratelimits
- x-apigateway-ratelimits.policy
- x-apigateway-ratelimits.policy.special
- x-apigateway-access-control
- x-apigateway-access-controls
- x-apigateway-access-controls.policy
- x-apigateway-plugins
- x-apigateway-auth-opt
- x-apigateway-result-normal-sample
- x-apigateway-result-failure-sample
- x-apigateway-authorizer
- x-apigateway-response
- x-apigateway-responses
- x-apigateway-pass-through
- x-apigateway-sample
- x-apigateway-content-type
- x-apigateway-orchestrations
- Configuring API Policies
- Configuring a Credential Policy
- Managing APIG Gateways
- Viewing Metrics and Configuring Alarms
- Viewing Audit Logs
- Shared Gateway (for Existing Users)
-
Best Practices
- Overview
-
API Openness
- Selectively Exposing CCE Workloads with a Dedicated Gateway
- Selectively Exposing Service Capabilities of a Data Center Using a Dedicated Gateway
- Exposing Backend Services Across VPCs Using a Dedicated Gateway
- Routing gRPC Service Requests Using a Dedicated Gateway
- Forwarding WebSocket Service Requests Using a Dedicated Gateway
- HTTP-to-HTTPS Auto Redirection with a Dedicated Gateway
- Calling Different Backend Services Using a Dedicated Gateway
- API Authentication
- API Policies
- API Security
- Developer Guide
-
API Reference
- Before You Start
- API Overview
- Calling APIs
-
Dedicated Gateway APIs (V2)
- API Group Management
- Environment Management
- Environment Variable Management
- Request Throttling Policy Management
-
API Management
- Creating an API
- Modifying an API
- Deleting an API
- Publishing an API or Taking an API Offline
- Querying API Details
- Querying APIs
- Verifying the API Definition
- Debugging an API
- Publishing APIs or Taking APIs Offline
- Querying Historical Versions of an API
- Switching the Version of an API
- Querying the Runtime Definition of an API
- Querying API Version Details
- Taking an API Version Offline
- Signature Key Management
- Binding/Unbinding Signature Keys
- Binding/Unbinding Request Throttling Policies
- Excluded Request Throttling Configuration
- App Authorization Management
- Resource Query
- Domain Name Management
- Access Control Policy Management
- Binding/Unbinding Access Control Policies
- Custom Authorizer Management
- API Import and Export
-
VPC Channel Management
- Creating a VPC Channel
- Updating a VPC Channel
- Deleting a VPC Channel
- Querying VPC Channel Details
- Querying VPC Channels
- Adding or Updating Backend Instances
- Querying Backend Servers of a VPC Channel
- Updating Backend Instances
- Removing a Backend Server
- Enabling Backend Servers
- Disabling Backend Servers
- Modifying VPC Channel Health Check
- Adding or Updating a Backend Server Group of a VPC Channel
- Querying Backend Server Groups of a VPC Channel
- Querying a Backend Server Group of a VPC Channel
- Deleting a Backend Server Group of a VPC Channel
- Updating a Backend Server Group of a VPC Channel
- Monitoring Information Query
- Group Response Management
- Tag Management
- Gateway Feature Management
- Configuration Management
-
Gateway Management
- Creating a Dedicated Gateway (Pay-Per-Use)
- Querying Dedicated Gateway Details
- Updating a Dedicated Gateway
- Querying the Creation Progress of a Dedicated Gateway
- Updating or Binding an EIP to a Dedicated Gateway
- Unbinding the EIP of a Dedicated Gateway
- Enabling Public Access for a Dedicated Gateway
- Updating the Outbound Access Bandwidth of a Dedicated Gateway
- Disabling Public Access for a Dedicated Gateway
- Enabling Public Inbound Access
- Updating Public Inbound Access Bandwidth of a Gateway
- Disabling Public Inbound Access for a Gateway
- Querying AZs
- Querying Dedicated Gateways
- Deleting a Dedicated Gateway
- Modifying the Specifications of a Pay-Per-Use Gateway
- Querying Gateway Constraints
- VPC Endpoint Management
- Gateway Tag Management
- Microservice Center Management
-
SSL Certificate Management
- Querying SSL Certificates
- Creating an SSL Certificate
- Binding a Domain Name with SSL Certificates
- Unbinding a Domain Name's SSL Certificates
- Querying Certificate Details
- Deleting an SSL Certificate
- Modifying an SSL Certificate
- Binding an SSL Certificate to a Domain Name
- Unbinding an SSL Certificate from a Domain Name
- Querying Domain Names of an SSL Certificate
-
Plug-in Management
- Creating a Plug-in
- Modifying a Plug-in
- Deleting a Plug-in
- Querying Plug-ins
- Querying Plug-in Details
- Binding a Plug-in to APIs
- Binding an API with Plug-ins
- Unbinding a Plug-in from All APIs
- Unbinding an API's Plug-ins
- Querying APIs Bound with a Plug-in
- Querying Plug-ins Bound to an API
- Querying APIs to Which a Plug-in Can Be Bound
- Querying Plug-ins That Can Be Bound to an API
-
Credential Management
- Creating an App
- Modifying an App
- Deleting an App
- Resetting the AppSecret of an App
- Verifying an App
- Querying App Details
- Querying Apps
- Creating an AppCode
- Generating an AppCode
- Deleting an AppCode
- Querying AppCode Details
- Querying AppCodes of an App
- Querying Quotas Associated with a Credential
- Configuring Access Control Settings for an App
- Querying Access Control Details About an App
- Deleting Access Control Settings of an App
-
Credential Quota Management
- Creating a Credential Quota
- Querying Credential Quota Details
- Querying Credential Quotas
- Modifying a Credential Quota
- Deleting a Credential Quota
- Querying the Credentials Bound to a Specified Quota
- Binding a Credential Quota with Credentials
- Unbinding a Credential Quota from a Credential
- Querying Credentials That Can Be Bound to a Credential Quota
- Asynchronous Task Management
- Orchestration Rule Management
- Gateway Custom Inbound Port Management
-
Shared Gateway APIs (for Existing Users)
- API Group Management
-
API Management
- Object Model
- Creating an API
- Modifying an API
- Deleting an API
- Publishing an API
- Taking an API Offline
- Publishing Multiple APIs or Taking Multiple APIs Offline
- Querying API Details
- Querying an API List
- Querying Historical API Versions
- Taking an Effective Version of an API Offline
- Querying Details of an API Version
- Querying the Runtime Definition of an API
- Debugging an API
- App Management
- App Authorization Management
- Environment Management
- Environment Variable Management
- Request Throttling Policy Management
- Binding Request Throttling Policies
- Excluded Request Throttling Configuration
- Access Control Policy Management
-
Binding Access Control Policies
- Object Model
- Binding an Access Control Policy to an API
- Querying the List of Access Control Policies Bound to an API
- Querying the List of APIs Bound to an Access Control Policy
- Querying the List of APIs Not Bound to an Access Control Policy
- Unbinding an Access Control Policy from an API
- Unbinding Multiple Access Control Policies from APIs
- Querying Subscription Information in KooGallery
- Configuration Management
- Resource Query
- Signature Key Management
- Binding Signature Keys
- Domain Name Management
- VPC Channel Management
- Querying Metrics
- OpenAPI
- Custom Authorizer Management
- Permissions Policies and Supported Actions
- Appendix
- Change History
- SDK Reference
-
FAQs
- Common FAQs
- Product Consulting FAQs
-
Opening APIs
- Why Can't I Create APIs?
- How Do I Define Response Codes for an API?
- Can I Specify a Private Network Load Balancer Address for the Backend Service?
- Can I Specify the Backend Address as a Subnet IP Address?
- Does APIG Support Multiple Backend Endpoints?
- Can I Bind Private Domain Names for API Access?
- Why Do I Fail to Call an API Across Domains?
- How Do I Use APIG to Open Up Services Deployed on Huawei Cloud?
- Publishing an API
-
Calling APIs
- What Are the Possible Causes for an API Calling Failure?
- Why Am I Seeing the Error Message "414 Request URI too large" When I Call an API?
- Why Am I Seeing the Error Message "The API does not exist or has not been published in the environment" When I Call an API?
- Why Am I Seeing the Error Message "No backend available" When I Call an API?
- Why Am I Seeing the Error Message "Backend unavailable" or "Backend timeout" When I Invoke the Backend Service?
- Why Am I Seeing the Error Message "Backend domain name resolution failed" When I Invoke the Backend Service?
- Why Am I Seeing the Error Message "Incorrect IAM authentication information" When I Call an API?
- Why Am I Seeing the Error Message "Incorrect app authentication information" When I Call an API?
- Why Doesn't Modification of the backend_timeout Parameter Take Effect?
- Does APIG Have a Limit on the Size of the API Request Body?
- Is There a Limit on the Size of the Response to an API Request?
- How Do I Call an API Using App Authentication in iOS System?
- Why Can't I Create a Header Parameter Named x-auth-token for an API Called Through IAM Authentication?
- Can Mobile Apps Call APIs?
- Can Applications Deployed in a VPC Call APIs?
- Does APIG Support WebSocket Data Transmission?
- How Will the Requests for an API with Multiple Backend Policies Be Matched and Executed?
- How Can I Access Backend Services over Public Networks Through APIG?
- API Authentication
-
API Policies
- Can I Configure the Maximum Number of Concurrent Requests?
- Is the Restriction of 1,000 Requests Per Day to a Debugging Domain Name Applied to Enterprise Accounts?
- Does APIG Have Bandwidth Limits?
- Why Doesn't a Request Throttling Policy Take Effect?
- How Do I Provide an Open API to Specific Users?
- Are Client IP Addresses Verified for Access Control?
- Importing and Exporting APIs
- Videos
-
More Documents
-
User Guide (Kuala Lumpur Region)
- Service Overview
- Getting Started
- Comparing Versions
- Overview
-
API Management
- Creating an API Group
- Binding a Domain Name
- Creating an Environment Variable
- Creating a Gateway Response
- Creating an API
- Cloning an API
- CORS
- Debugging an API
- Authorizing API Access
- Publishing an API
- Taking an API Offline
-
Importing and Exorting APIs
- Restrictions and Compatibility
- Importing APIs
- Exporting APIs
-
Extended Definition
- x-apigateway-auth-type
- x-apigateway-request-type
- x-apigateway-match-mode
- x-apigateway-cors
- x-apigateway-any-method
- x-apigateway-backend
- x-apigateway-backend.parameters
- x-apigateway-backend.httpEndpoints
- x-apigateway-backend.httpVpcEndpoints
- x-apigateway-backend.functionEndpoints
- x-apigateway-backend.mockEndpoints
- x-apigateway-backend-policies
- x-apigateway-backend-policies.conditions
- x-apigateway-ratelimit
- x-apigateway-ratelimits
- x-apigateway-ratelimits.policy
- x-apigateway-ratelimits.policy.special
- x-apigateway-access-control
- x-apigateway-access-controls
- x-apigateway-access-controls.policy
- x-apigateway-plugins
- Viewing APIs
- HTTP 2.0
- API Policies
- Credentials
- Monitoring & Analysis
- Gateway Management
- SDKs
- Published API Calling
- Permissions Management
- Auditing
-
FAQs
- Common FAQs
-
API Creation
- How Do I Define Response Codes for an API?
- How Do I Specify the Host Port for a VPC Channel (or Load Balance Channel)?
- How Do I Set the Backend Address If I Will Not Use a VPC Channel (or Load Balance Channel)?
- How Can I Configure the Backend Service Address?
- Can I Specify a Private Network Load Balancer Address for the Backend Service?
- Can I Specify the Backend Address as a Subnet IP Address?
- Does APIG Support Multiple Backend Endpoints?
- What Should I Do After Applying for an Independent Domain Name?
- Can I Bind Private Domain Names for API Access?
- Why Does an API Failed to Be Called Across Domains?
-
API Calling
- What Are the Possible Causes for an API Calling Failure?
- What Should I Do If an Error Code Is Returned During API Calling?
- Why Am I Seeing the Error Message "414 Request URI too large" When I Call an API?
- What Should I Do If "The API does not exist or has not been published in the environment." Is Displayed?
- Why Am I Seeing the Message "No backend available"?
- What Are the Possible Causes If the Message "Backend unavailable" or "Backend timeout" Is Displayed?
- Why Am I Seeing the Message "Backend domain name resolution failed" When a Backend Service Is Called?
- Why Doesn't Modification of the backend_timeout Parameter Take Effect?
- How Do I Switch the Environment for API Calling?
- What Is the Maximum Size of an API Request Package?
- How Do I Perform App Authentication in iOS System?
- Why Can't I Create a Header Parameter Named x-auth-token for an API Called Through IAM Authentication?
- App (Credential) FAQs
- Can Mobile Apps Call APIs?
- Can Applications Deployed in a VPC Call APIs?
- Does APIG Support WebSocket Data Transmission?
- Does APIG Support Persistent Connections?
- How Will the Requests for an API with Multiple Backend Policies Be Matched and Executed?
- Is There a Limit on the Size of the Response to an API Request?
- How Can I Access Backend Services over Public Networks Through APIG?
-
API Authentication
- Does APIG Support HTTPS Two-Way Authentication?
- How Do I Call an API That Does Not Require Authentication?
- Which TLS Versions Does APIG Support?
- Does APIG Support Custom Authentication?
- Will the Request Body Be Signed for Security Authentication?
- Common Errors Related to IAM Authentication Information
- What Should I Do If the App Authentication Information Is Incorrect?
- API Control Policies
- API Publishing
- API Import and Export
- API Security
- Other FAQs
- Change History
- Developer Guide (Kuala Lumpur Region)
-
API Reference (Kuala Lumpur Region)
- Before You Start
- Calling APIs
-
Dedicated Gateway APIs (V2)
- API Group Management
- Environment Management
- Environment Variable Management
- Request Throttling Policy Management
-
API Management
- Creating an API
- Modifying an API
- Deleting an API
- Publishing an API or Taking an API Offline
- Querying API Details
- Querying APIs
- Verifying the API Definition
- Debugging an API
- Publishing APIs or Taking APIs Offline
- Querying Historical Versions of an API
- Switching the Version of an API
- Querying the Runtime Definition of an API
- Querying API Version Details
- Taking an API Version Offline
- Signature Key Management
- Binding/Unbinding Signature Keys
- Binding/Unbinding Request Throttling Policies
- Excluded Request Throttling Configuration
- App Authorization Management
- Resource Query
- Domain Name Management
- Access Control Policy Management
- Binding/Unbinding Access Control Policies
- Custom Authorizer Management
- API Import and Export
-
VPC Channel Management
- Creating a VPC Channel
- Updating a VPC Channel
- Deleting a VPC Channel
- Querying VPC Channel Details
- Querying VPC Channels
- Adding or Updating Backend Instances
- Querying Backend Servers of a VPC Channel
- Updating Backend Instances
- Removing a Backend Server
- Enabling Backend Servers
- Disabling Backend Servers
- Modifying VPC Channel Health Check
- Adding or Updating a Backend Server Group of a VPC Channel
- Querying Backend Server Groups of a VPC Channel
- Querying a Backend Server Group of a VPC Channel
- Deleting a Backend Server Group of a VPC Channel
- Updating a Backend Server Group of a VPC Channel
- Monitoring Information Query
- Group Response Management
- Tag Management
- Gateway Feature Management
- Configuration Management
-
Gateway Management
- Creating a Dedicated Gateway (Pay-Per-Use)
- Querying Dedicated Gateway Details
- Updating a Dedicated Gateway
- Querying the Creation Progress of a Dedicated Gateway
- Updating or Binding an EIP to a Dedicated Gateway
- Unbinding the EIP of a Dedicated Gateway
- Enabling Public Access for a Dedicated Gateway
- Updating the Outbound Access Bandwidth of a Dedicated Gateway
- Disabling Public Access for a Dedicated Gateway
- Enabling Public Inbound Access
- Updating Public Inbound Access Bandwidth of a Gateway
- Disabling Public Inbound Access for a Gateway
- Querying AZs
- Querying Dedicated Gateways
- Deleting a Dedicated Gateway
- Modifying the Specifications of a Pay-Per-Use Gateway
- Querying Gateway Constraints
- VPC Endpoint Management
- Gateway Tag Management
-
SSL Certificate Management
- Querying SSL Certificates
- Creating an SSL Certificate
- Binding a Domain Name with SSL Certificates
- Unbinding a Domain Name's SSL Certificates
- Querying Certificate Details
- Deleting an SSL Certificate
- Modifying an SSL Certificate
- Binding an SSL Certificate to a Domain Name
- Unbinding an SSL Certificate from a Domain Name
- Querying Domain Names of an SSL Certificate
-
Plug-in Management
- Creating a Plug-in
- Modifying a Plug-in
- Deleting a Plug-in
- Querying Plug-ins
- Querying Plug-in Details
- Binding a Plug-in to APIs
- Binding an API with Plug-ins
- Unbinding a Plug-in from All APIs
- Unbinding an API's Plug-ins
- Querying APIs Bound with a Plug-in
- Querying Plug-ins Bound to an API
- Querying APIs to Which a Plug-in Can Be Bound
- Querying Plug-ins That Can Be Bound to an API
-
Credential Management
- Creating an App
- Modifying an App
- Deleting an App
- Resetting the AppSecret of an App
- Verifying an App
- Querying App Details
- Querying Apps
- Creating an AppCode
- Generating an AppCode
- Deleting an AppCode
- Querying AppCode Details
- Querying AppCodes of an App
- Querying Quotas Associated with a Credential
- Configuring Access Control Settings for an App
- Querying Access Control Details About an App
- Deleting Access Control Settings of an App
-
Credential Quota Management
- Creating a Credential Quota
- Querying Credential Quota Details
- Querying Credential Quotas
- Modifying a Credential Quota
- Deleting a Credential Quota
- Querying the Credentials Bound to a Specified Quota
- Binding a Credential Quota with Credentials
- Unbinding a Credential Quota from a Credential
- Querying Credentials That Can Be Bound to a Credential Quota
- Asynchronous Task Management
- Permissions Policies and Supported Actions
- Appendix
- Change History
-
User Guide (ME-Abu Dhabi Region)
- Service Overview
- Getting Started
- Comparing Versions
- Overview
-
API Management
- Creating an API Group
- Importing a CCE Workload
- Binding a Domain Name
- Creating an Environment Variable
- Creating a Gateway Response
- Creating an API
- Creating a gRPC API
- Cloning an API
- CORS
- Debugging an API
- Authorizing API Access
- Publishing an API
- Taking an API Offline
-
Importing and Exorting APIs
- Restrictions and Compatibility
- Importing APIs
- Exporting APIs
-
Extended Definition
- x-apigateway-auth-type
- x-apigateway-request-type
- x-apigateway-match-mode
- x-apigateway-cors
- x-apigateway-is-send-fg-body-base64
- x-apigateway-any-method
- x-apigateway-backend
- x-apigateway-backend.parameters
- x-apigateway-backend.httpEndpoints
- x-apigateway-backend.httpVpcEndpoints
- x-apigateway-backend.functionEndpoints
- x-apigateway-backend.mockEndpoints
- x-apigateway-backend-policies
- x-apigateway-backend-policies.conditions
- x-apigateway-ratelimit
- x-apigateway-ratelimits
- x-apigateway-ratelimits.policy
- x-apigateway-ratelimits.policy.special
- x-apigateway-access-control
- x-apigateway-access-controls
- x-apigateway-access-controls.policy
- x-apigateway-plugins
- Viewing APIs
- HTTP 2.0
- API Policies
- Credentials
- Monitoring & Analysis
- Gateway Management
- SDKs
- Published API Calling
- Permissions Management
- Auditing
-
FAQs
- Common FAQs
-
API Creation
- Why Can't I Create APIs?
- How Do I Define Response Codes for an API?
- How Do I Specify the Host Port for a VPC Channel (or Load Balance Channel)?
- How Do I Set the Backend Address If I Will Not Use a VPC Channel (or Load Balance Channel)?
- How Can I Configure the Backend Service Address?
- Can I Specify a Private Network Load Balancer Address for the Backend Service?
- Can I Specify the Backend Address as a Subnet IP Address?
- Does APIG Support Multiple Backend Endpoints?
- What Should I Do After Applying for an Independent Domain Name?
- Can I Bind Private Domain Names for API Access?
- Why Does an API Failed to Be Called Across Domains?
-
API Calling
- What Are the Possible Causes for an API Calling Failure?
- What Should I Do If an Error Code Is Returned During API Calling?
- Why Am I Seeing the Error Message "414 Request URI too large" When I Call an API?
- What Should I Do If "The API does not exist or has not been published in the environment." Is Displayed?
- Why Am I Seeing the Message "No backend available"?
- What Are the Possible Causes If the Message "Backend unavailable" or "Backend timeout" Is Displayed?
- Why Am I Seeing the Message "Backend domain name resolution failed" When a Backend Service Is Called?
- Why Doesn't Modification of the backend_timeout Parameter Take Effect?
- How Do I Switch the Environment for API Calling?
- What Is the Maximum Size of an API Request Package?
- How Do I Perform App Authentication in iOS System?
- Why Can't I Create a Header Parameter Named x-auth-token for an API Called Through IAM Authentication?
- App (Credential) FAQs
- Can Mobile Apps Call APIs?
- Can Applications Deployed in a VPC Call APIs?
- Does APIG Support WebSocket Data Transmission?
- Does APIG Support Persistent Connections?
- How Will the Requests for an API with Multiple Backend Policies Be Matched and Executed?
- Is There a Limit on the Size of the Response to an API Request?
- How Can I Access Backend Services over Public Networks Through APIG?
-
API Authentication
- Does APIG Support HTTPS Two-Way Authentication?
- How Do I Call an API That Does Not Require Authentication?
- Which TLS Versions Does APIG Support?
- Does APIG Support Custom Authentication?
- Will the Request Body Be Signed for Security Authentication?
- Common Errors Related to IAM Authentication Information
- What Should I Do If the App Authentication Information Is Incorrect?
- API Control Policies
- API Publishing
- API Import and Export
- API Security
- Other FAQs
- Change History
- Developer Guide (ME-Abu Dhabi Region)
-
API Reference (ME-Abu Dhabi Region)
- Before You Start
- Calling APIs
-
Dedicated Gateway APIs (V2)
- API Group Management
- Environment Management
- Environment Variable Management
- Request Throttling Policy Management
-
API Management
- Creating an API
- Modifying an API
- Deleting an API
- Publishing an API or Taking an API Offline
- Querying API Details
- Querying APIs
- Verifying the API Definition
- Debugging an API
- Publishing APIs or Taking APIs Offline
- Querying Historical Versions of an API
- Switching the Version of an API
- Querying the Runtime Definition of an API
- Querying API Version Details
- Taking an API Version Offline
- Signature Key Management
- Binding/Unbinding Signature Keys
- Binding/Unbinding Request Throttling Policies
- Excluded Request Throttling Configuration
- App Authorization Management
- Resource Query
- Domain Name Management
- Access Control Policy Management
- Binding/Unbinding Access Control Policies
- Custom Authorizer Management
- API Import and Export
-
VPC Channel Management
- Creating a VPC Channel
- Updating a VPC Channel
- Deleting a VPC Channel
- Querying VPC Channel Details
- Querying VPC Channels
- Adding or Updating Backend Instances
- Querying Backend Servers of a VPC Channel
- Updating Backend Instances
- Removing a Backend Server
- Enabling Backend Servers
- Disabling Backend Servers
- Modifying VPC Channel Health Check
- Adding or Updating a Backend Server Group of a VPC Channel
- Querying Backend Server Groups of a VPC Channel
- Querying a Backend Server Group of a VPC Channel
- Deleting a Backend Server Group of a VPC Channel
- Updating a Backend Server Group of a VPC Channel
- Monitoring Information Query
- Group Response Management
- Tag Management
- Gateway Feature Management
- Configuration Management
-
Gateway Management
- Creating a Dedicated Gateway (Pay-Per-Use)
- Querying Dedicated Gateway Details
- Updating a Dedicated Gateway
- Querying the Creation Progress of a Dedicated Gateway
- Updating or Binding an EIP to a Dedicated Gateway
- Unbinding the EIP of a Dedicated Gateway
- Enabling Public Access for a Dedicated Gateway
- Updating the Outbound Access Bandwidth of a Dedicated Gateway
- Disabling Public Access for a Dedicated Gateway
- Enabling Public Inbound Access
- Updating Public Inbound Access Bandwidth of a Gateway
- Disabling Public Inbound Access for a Gateway
- Querying AZs
- Querying Dedicated Gateways
- Deleting a Dedicated Gateway
- Modifying the Specifications of a Pay-Per-Use Gateway
- Querying Gateway Constraints
- VPC Endpoint Management
- Gateway Tag Management
- Microservice Center Management
-
SSL Certificate Management
- Querying SSL Certificates
- Creating an SSL Certificate
- Binding a Domain Name with SSL Certificates
- Unbinding a Domain Name's SSL Certificates
- Querying Certificate Details
- Deleting an SSL Certificate
- Modifying an SSL Certificate
- Binding an SSL Certificate to a Domain Name
- Unbinding an SSL Certificate from a Domain Name
- Querying Domain Names of an SSL Certificate
-
Plug-in Management
- Creating a Plug-in
- Modifying a Plug-in
- Deleting a Plug-in
- Querying Plug-ins
- Querying Plug-in Details
- Binding a Plug-in to APIs
- Binding an API with Plug-ins
- Unbinding a Plug-in from All APIs
- Unbinding an API's Plug-ins
- Querying APIs Bound with a Plug-in
- Querying Plug-ins Bound to an API
- Querying APIs to Which a Plug-in Can Be Bound
- Querying Plug-ins That Can Be Bound to an API
-
Credential Management
- Creating an App
- Modifying an App
- Deleting an App
- Resetting the AppSecret of an App
- Verifying an App
- Querying App Details
- Querying Apps
- Creating an AppCode
- Generating an AppCode
- Deleting an AppCode
- Querying AppCode Details
- Querying AppCodes of an App
- Querying Quotas Associated with a Credential
- Configuring Access Control Settings for an App
- Querying Access Control Details About an App
- Deleting Access Control Settings of an App
-
Credential Quota Management
- This API is used to creat a credential quota.
- Querying Credential Quota Details
- Querying Credential Quotas
- Modifying a Credential Quota
- Deleting a Credential Quota
- Querying the Credentials Bound to a Specified Quota
- Binding a Credential Quota with Credentials
- Unbinding a Credential Quota from a Credential
- Querying Credentials That Can Be Bound to a Credential Quota
- Asynchronous Task Management
- Permissions Policies and Supported Actions
- Appendix
- Change History
-
Best Practices (ME-Abu Dhabi Region)
- Selectively Exposing CCE Workloads with a Dedicated Gateway
- Selectively Exposing Service Capabilities of a Data Center Using a Dedicated Gateway
- Developing a Custom Authorizer with FunctionGraph
- Exposing Backend Services Across VPCs Using a Dedicated Gateway
- Interconnecting a Dedicated Gateway with WAF
- Request Throttling 2.0 with a Dedicated Gateway
- Two-Factor Authentication with a Dedicated Gateway
- HTTP-to-HTTPS Auto Redirection with a Dedicated Gateway
- Client Authentication with a Dedicated Gateway
- Invoking an API Policy Backend via Frontend Authentication Parameters (System Parameter)
- Forwarding WebSocket Services Using Dedicated Gateway
- Change History
- User Guide (Paris Region)
-
Developer Guide (Paris Region)
- Application Scenarios
- Calling APIs Through App Authentication
- Calling APIs Through IAM Authentication
- Creating Signatures for Backend Requests
-
Importing and Exporting APIs
- Restrictions and Compatibility
- Extended Definition
- API Import Precautions
- Examples of Importing APIs
- API Export Precautions
- Change History
-
API Reference (Paris Region)
- Before You Start
- Calling APIs
- Getting Started
-
Shared Gateway APIs
- API Group Management
-
API Management
- Object Model
- Registering an API
- Modifying an API
- Deleting an API
- Publishing an API
- Taking an API Offline
- Publishing Multiple APIs or Taking Multiple APIs Offline
- Querying API Details
- Querying an API List
- Querying Historical API Versions
- Taking an Effective Version of an API Offline
- Querying Details of an API Version
- Querying the Runtime Definition of an API
- Debugging an API
- App Management
- App Authorization Management
- Environment Management
- Environment Variable Management
- Request Throttling Policy Management
- Binding Request Throttling Policies
- Excluded Request Throttling Configuration
- Access Control Policy Management
-
Binding Access Control Policies
- Object Model
- Binding an Access Control Policy to an API
- Querying the List of Access Control Policies Bound to an API
- Querying the List of APIs Bound to an Access Control Policy
- Querying the List of APIs Not Bound to an Access Control Policy
- Unbinding an Access Control Policy from an API
- Unbinding Multiple Access Control Policies from APIs
- Querying Subscription Information in the Marketplace
- Resource Query
- Signature Key Management
- Binding Signature Keys
- Domain Name Management
- VPC Channel Management
- OpenAPI
- Custom Authorizer Management
- Appendix
- Change History
-
Dedicated API Gateway User Guide (Paris Region)
- Service Overview
- Getting Started
- Comparing Versions
- Overview
-
API Management
- Creating an API Group
- Binding a Domain Name
- Creating an Environment Variable
- Creating a Gateway Response
- Creating an API
- CORS
- Debugging an API
- Authorizing API Access
- Publishing an API
- Taking an API Offline
-
Importing and Exorting APIs
- Restrictions and Compatibility
- Importing APIs
- Exporting APIs
-
Extended Definition
- x-apigateway-auth-type
- x-apigateway-request-type
- x-apigateway-match-mode
- x-apigateway-cors
- x-apigateway-any-method
- x-apigateway-backend
- x-apigateway-backend.parameters
- x-apigateway-backend.httpEndpoints
- x-apigateway-backend.httpVpcEndpoints
- x-apigateway-backend.functionEndpoints
- x-apigateway-backend.mockEndpoints
- x-apigateway-backend-policies
- x-apigateway-backend-policies.conditions
- x-apigateway-ratelimit
- x-apigateway-ratelimits
- x-apigateway-ratelimits.policy
- x-apigateway-ratelimits.policy.special
- x-apigateway-access-control
- x-apigateway-access-controls
- x-apigateway-access-controls.policy
- x-apigateway-plugins
- Viewing APIs
- API Policies
- Credentials
- Monitoring & Analysis
- Gateway Management
- Published API Calling
- Permissions Management
- Auditing
-
FAQs
- Common FAQs
-
API Creation
- How Do I Define Response Codes for an API?
- How Do I Specify the Host Port for a VPC Channel (or Load Balance Channel)?
- How Do I Set the Backend Address If I Will Not Use a VPC Channel (or Load Balance Channel)?
- How Can I Configure the Backend Service Address?
- Can I Specify a Private Network Load Balancer Address for the Backend Service?
- Can I Specify the Backend Address as a Subnet IP Address?
- Does APIG Support Multiple Backend Endpoints?
- What Should I Do After Applying for an Independent Domain Name?
- Can I Bind Private Domain Names for API Access?
- Why Does an API Failed to Be Called Across Domains?
-
API Calling
- What Are the Possible Causes for an API Calling Failure?
- What Should I Do If an Error Code Is Returned During API Calling?
- Why Am I Seeing the Error Message "414 Request URI too large" When I Call an API?
- What Should I Do If "The API does not exist or has not been published in the environment." Is Displayed?
- Why Am I Seeing the Message "No backend available"?
- What Are the Possible Causes If the Message "Backend unavailable" or "Backend timeout" Is Displayed?
- Why Am I Seeing the Message "Backend domain name resolution failed" When a Backend Service Is Called?
- Why Doesn't Modification of the backend_timeout Parameter Take Effect?
- How Do I Switch the Environment for API Calling?
- What Is the Maximum Size of an API Request Package?
- How Do I Perform App Authentication in iOS System?
- Why Can't I Create a Header Parameter Named x-auth-token for an API Called Through IAM Authentication?
- App (Credential) FAQs
- Can Mobile Apps Call APIs?
- Can Applications Deployed in a VPC Call APIs?
- Does APIG Support WebSocket Data Transmission?
- Does APIG Support Persistent Connections?
- How Will the Requests for an API with Multiple Backend Policies Be Matched and Executed?
- Is There a Limit on the Size of the Response to an API Request?
- How Can I Access Backend Services over Public Networks Through APIG?
-
API Authentication
- Does APIG Support HTTPS Two-Way Authentication?
- How Do I Call an API That Does Not Require Authentication?
- Which TLS Versions Does APIG Support?
- Does APIG Support Custom Authentication?
- Will the Request Body Be Signed for Security Authentication?
- Common Errors Related to IAM Authentication Information
- API Control Policies
- API Publishing
- API Import and Export
- API Security
- Other FAQs
- Change History
- Dedicated API Gateway Developer Guide (Paris Region)
-
Dedicated API Gateway API Reference (Paris Region)
- Before You Start
- Calling APIs
-
Dedicated Gateway APIs (V2)
- API Group Management
- Environment Management
- Environment Variable Management
- Request Throttling Policy Management
-
API Management
- Creating an API
- Modifying an API
- Deleting an API
- Publishing an API or Taking an API Offline
- Querying API Details
- Querying APIs
- Debugging an API
- Publishing APIs or Taking APIs Offline
- Querying Historical Versions of an API
- Switching the Version of an API
- Querying the Runtime Definition of an API
- Querying API Version Details
- Taking an API Version Offline
- Signature Key Management
- Binding/Unbinding Signature Keys
- Binding/Unbinding Request Throttling Policies
- Excluded Request Throttling Configuration
- App Authorization Management
- Resource Query
- App Management
- Domain Name Management
- Access Control Policy Management
- Binding/Unbinding Access Control Policies
- Custom Authorizer Management
- API Import and Export
- VPC Channel Management
- Monitoring Information Query
- Group Response Management
- Tag Management
- Gateway Feature Management
- Configuration Management
-
Gateway Management
- Creating a Dedicated Gateway (Pay-Per-Use)
- Querying Dedicated Gateway Details
- Updating a Dedicated Gateway
- Querying the Creation Progress of a Dedicated Gateway
- Updating or Binding an EIP to a Dedicated Gateway
- Unbinding the EIP of a Dedicated Gateway
- Enabling Public Access for a Dedicated Gateway
- Updating the Outbound Access Bandwidth of a Dedicated Gateway
- Disabling Public Access for a Dedicated Gateway
- Querying AZs
- Querying Dedicated Gateways
- Deleting a Dedicated Gateway
- Permissions Policies and Supported Actions
- Appendix
- Change History
-
User Guide (Kuala Lumpur Region)
- General Reference
Copied.
Configuring Two-factor Authentication (App + Custom)
Scenario
Two-factor authentication allows you to customize an API authentication policy together with the app or IAM authentication. This section describes how to create an API that uses two-factor authentication (app + custom).
Advantages
You can use a custom authorizer to ensure API security.
Restrictions
The custom authorizer depends on FunctionGraph. Before creating a custom authorizer, you need to create a function.
General Procedure
- Create a function.
The function will be used for custom authentication.
- Create a custom authorizer.
Set the authorizer type to Frontend, and select the function created in the previous step.
- Create an API.
Set authentication mode to App, enable Two-Factor Authentication, and select the custom authorizer created in the previous step.
- Create a credential.
APIs that use app authentication require a credential to call. Create a credential to generate an ID and key/secret pair.
- Bind the credential to the created API.
APIs that use app authentication can be called only with bound credentials.
- Verify the API.
Call the API to check whether two-factor authentication is configured successfully.
Implementation Procedure
- Log in to the FunctionGraph console. On the Dashboard page, click Create Function.
- Set the parameters according to the following table, and click Create Function.
Table 1 Function configuration Parameter
Description
Create With
Select Create from scratch.
Function Type
Default: Event Function
Region
Select the same region as that of APIG.
Project
Projects group and isolate resources (including compute, storage, and network resources) across physical regions. A default project is provided for each Huawei Cloud region, and subprojects can be created under each default project. Users can be granted permissions to access all resources in a specific project. The selected region is used by default.
Function Name
Set this name as planned.
Enterprise Project
Enterprise projects group and manage resources across regions. Resources in enterprise projects are logically isolated. Select default.
Agency
An agency that delegates FunctionGraph to access other cloud services. For this example, select Use no agency.
Runtime
Select Python 3.9.
- After the function is created, go to the function details page. On the Configuration tab, choose Environment Variables in the left pane, and click Edit Environment Variable > Add.
Table 2 Configuring environment variables Parameter
Description
Key
Name of the environment variable. Add the token and test environment variables. token is a header for identity authentication, and test is for parameter query.
Value
Environment variable value. Set the value of token to Basic dXNlcjE6cGFzc3dvcmQ= and test to user@123.
Encrypted
If enabled, the environment variable value is encrypted and displayed as an asterisk (*). During parameter transmission, the key value is also encrypted. Encrypt the sensitive token key in this example.
- On the Code tab, copy the following code to index.py, and click Deploy. For details about coding, see Creating a Function for Frontend Custom Authentication.
# -*- coding:utf-8 -*- import json def handler(event, context): testParameter = context.getUserData('test'); userToken = context.getUserData('token'); if event["headers"].get("token") == userToken and event["queryStringParameters"].get("test") == testParameter: resp = { 'statusCode': 200, 'body': json.dumps({ "status":"allow", "context":{ "user":"auth success" } }) } else: resp = { 'statusCode': 401, 'body': json.dumps({ "status":"deny", }) } return json.dumps(resp)
- Configure a test event to debug the code.
- Select Configure Test Event from the drop-down list and configure a test event. Set the following code as the test event. The parameter values in the test event must be the same as those of the environment variables.
{ "headers": { "token": "Basic dXNlcjE6cGFzc3dvcmQ=" }, "queryStringParameters": { "test": "user@123" } }
- Click Test. If the following information is displayed, the code debugging is successful.
- Click Deploy.
- Select Configure Test Event from the drop-down list and configure a test event. Set the following code as the test event. The parameter values in the test event must be the same as those of the environment variables.
- Set the parameters according to the following table, and click Create Function.
- Go to the APIG console, and choose API Management > API Policies.
On the Custom Authorizers tab, create a custom authorizer.
Table 3 Custom authorizer configuration Parameter
Description
Name
Set this name as planned.
Type
Select Frontend.
Function URN
Click Select and select the created function.
Version/Alias
Version is selected by default.
Max. Cache Age (s)
30
Identity Sources
Set two identity sources: header token and query string test.
- Choose API Management > APIs, and click Create API > Create API.
- Configure the frontend information according to the following table.
Table 4 Frontend configuration Parameter
Description
API Name
Enter an API name.
Group
Group to which the API belongs. The default value is DEFAULT.
URL
Method: Request method of the API. Set this parameter to GET.
Protocol: Request protocol of the API. Set this parameter to HTTPS.
Subdomain Name: The system automatically allocates a subdomain name to each API group for internal testing. The subdomain name can be accessed 1,000 times a day.
Path: Path for requesting the API. Enter /api/two_factor_authorization.
Gateway Response
Select a response to be displayed if the gateway fails to process an API request.
The default gateway response is default.
Authentication Mode
API authentication mode. Set this parameter to App.
Two-Factor Authentication
Enable this option and select a custom authorizer.
- Click Next and set the backend type to Mock.
Select a status code, set the response, and click Finish.
- Publish the API.
- Configure the frontend information according to the following table.
- In the navigation pane, choose API Management > Credentials.
Click Create Credential, enter a credential name, and click OK.
- Bind the credential to the API.
Click the credential name to go to the details page. In the APIs area, click Bind to APIs, select an API, and click OK.
- Verify the API.
- Call the API on the debugging page of APIG to verify if two-factor authentication is configured successfully.
Add test on the Parameters tab and add token on the Headers tab. Use the same parameter values set for the custom authentication function. If the parameter values are different, the server will return a 401 message indicating that the authentication fails.
- Alternatively, call the API with a curl command. Download the JavaScript SDK first. To call the API, input a key and secret as well as the header and query string to generate a curl command, and then copy this command to your CLI for execution. For details, see curl in the API Gateway Developer Guide.
- Call the API on the debugging page of APIG to verify if two-factor authentication is configured successfully.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot