Setting Up a Quota For an Api Product

[#1]

This is an example of how to setup a quota on the API product level rather that a per developer bases

Let's assumer we have a single developer with the following structure, each resolves to eventually invoke the same API proxy.

DevX application1 ----> Product 1 -----> api_proxy_A
DevX application2 ----> Product 2 -----> api_proxy_A

1. We 1st need to add an Verify API key policy so we can extract the key value, the default policy would look something like this

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyAPIKey async="false" continueOnError="false" enabled="true" name="Verify-API-Key-1">
    <DisplayName>Verify API Key-1</DisplayName>
    <Properties/>
    <APIKey ref="request.queryparam.apikey"/>
</VerifyAPIKey>

2. Directly after this we can add the quota policy to the flow. This is quota-1

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Quota name="Quota-1">
    <Identifier ref="verifyapikey.verify-api-key.apiproduct.name"/>
    <Interval ref="verifyapikey.Verify-API-Key-1.apiproduct.developer.quota.interval"/>
    <TimeUnit ref="verifyapikey.Verify-API-Key-1.apiproduct.developer.quota.timeunit "/>
    <Allow countRef="verifyapikey.Verify-API-Key-1.apiproduct.developer.quota.limit"/>
    <Distributed>true</Distributed>
    <Synchronous>true</Synchronous>
</Quota>

A couple of points are worth noting here. As the quota is distributed and synchronized you get a central counter value rather than a value per message processor.

I then set up the products with the following values,

1000 requests every month on Product 1
2000 requests every month on Product 2

As this is a test policy the values don't really matter. The specific environment would need to be considered for a real deployment

I then added an assign message to place the "available count value into a return header.

<AssignMessage async="false" continueOnError="false" enabled="true" name="Assign-Message-1">
<DisplayName>Assign Message-1</DisplayName>
<Properties/>
<Set>
<Headers>
<Header name="Available">{ratelimit.Quota-1.available.count}</Header>
</Headers>
</Set>
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
<AssignTo createNew="false" transport="http" type="request"/>
</AssignMessage>

This is useful for testing and for application developers themselves as they can programmatically check if you at or near the quota limit.

We then test this using the different API keys for the associated applications. Doing so we should see a different result returned in the "Available" HTTP header each time a request is being made.