Api Proxy should be accessed based on json attribute defined in API Product

[priyanka9289]

As a part of refracting the Apigee proxy, we are creating client specific proxies.

Permissions should set at API product level to allow only certain API's instead of giving access to complete Proxy.

We are working on a refined access on our API using API Product. 

Current Scenario : 1 Api Proxy has 4 Api's. 

/request1 GET

/request2 POST

/request2 GET

/request2 POST

Case- 1 : Create a APIProduct-1 which allow Developer app to access 

/request1 GET and 

/request2 POST

Case-2 : Create a APIProduct-2 which allow Developer app to access

/request1 POST and 

/request2 GET

Note : The custom attribute that I mentioned in APIProduct-1 is 

{[ { “path” : “/myrequest1", “method”: “GET”}, { “path” : “/myrequest2", “method”: “POST”}, ]}

APIProduct-2 is 

{[ { “path” : “/myrequest1", “method”: “POST”}, { “path” : “/myrequest2", “method”: “GET”}, ]}

Question : What policy / scope need to add before the flow ? Which it checks what is the attribute coming from Product , if it matches the resource path and method to allow . 

[dchiesa1]

I think what you want to accomplish is already possible with the API Product Operations mechanism.  

You don't need a custom attribute to make this happen. It's builtin to Apigee.

To "check" the authorization, just include VerifyAPIKey or VerifyAccessToken.  That will check the in-process API call against the operations listed on the API Product.