Overview

General Procedure

The following figure shows the procedure for using APIG to host APIs.

Exposing APIs

Enterprises or developers selectively expose and monetize their services and data through APIG.

Figure 2 API exposing process

1. Create a gateway.

   A gateway is an independent resource space where all operations are performed. Resources of different gateways are isolated from each other.

2. Create an API group.

   Each API belongs to an API group. Create an API group before creating an API.

3. Bind a domain name.

   Before exposing an API, bind an independent domain name to the target group so that API callers can access the API.

   You can debug the API using the debugging domain name allocated to the group to which the API belongs. The domain name can be accessed a maximum of 1000 times every day.

4. Create an API.

   Encapsulate existing backend services into standard RESTful APIs and expose them to external systems.

   After creating an API, configure the following settings to control API access:

   • Traditional policies
     • Request throttling

       Request throttling controls the number of times an API can be called within a time period to protect backend services.

     • Access control

       Set a blacklist or whitelist to deny or allow API access from specific IP addresses or accounts.

     • Signature keys

       Signature keys are used by backend services to verify the identity of APIG.

   • Plug-in policies
     • CORS

       This policy provides the capabilities of specifying preflight request headers and response headers and automatically creating preflight request APIs for cross-origin API access.

     • Response Cache

       You can configure a response cache policy to cache responses returned by the backend service in APIG. When a client sends the same request, APIG does not need to send the request to the backend service but directly returns the cached response.

     • HTTP Response Header Management

       You can customize HTTP response headers that will be contained in an API response.

     • Request Throttling 2.0

       This policy enables you to limit the number of times an API can be called within a specific time period. Parameter-based, basic, and excluded throttling is supported.

     • Kafka Log Push

       This policy pushes API calling logs to Kafka so that users can easily obtain them.

     • Circuit Breaker

       This policy protects your backend service when a performance issue occurs.

     • Third-Party Authorizer

       You can configure your own service to authenticate API requests.

5. Debug the API.

   Verify whether the API is working normally.

6. Publish the API.

   The API can be called only after it has been published in an environment.

Calling APIs

Enterprises and developers obtain and call APIs of other providers, thereby reducing development time and costs.