Error as keymanagement.service.InvalidAPICallAsNoApiProductMatchFound

[hareeshkumarts]

Hi ,

I have created a proxy userservice(proxy for user Management which connects to bad end service with Json Request) and oauth(for Generating token)

I have created API product with adding above two proxies and then created developer and then created App .Status is approved now . Using Client Key and Client Secret , I can able to generate access token . But with the generated access token , I cannot able to access my user services proxy

{

    "fault": {

        "faultstring": "Invalid API call as no apiproduct match found",

        "detail": {

            "errorcode": "keymanagement.service.InvalidAPICallAsNoApiProductMatchFound"

        }

    }

}

Please help on this.

[muq_ash]

Hi. This could be due to the Key Approval Type you are using. Please look into the discussion in the shared thread: https://www.googlecloudcommunity.com/gc/Apigee/Invalid-API-call-as-no-apiproduct-match-found/m-p/372...

[dchiesa1]

You wrote "Using Client Key and Client Secret , I can able to generate access token".  From that,  I guess you set up a proxy to dispense tokens, and are using client_credentials grant type, and it's working for you.  That's good. 

InvalidAPICallAsNoApiProductMatchFound means the token you presented is valid, and known by Apigee, but ... it is not suitable for use in the API proxy that is calling OAuthV2/VerifyAccessToken.   Why?  This usually occurs because The API Product configuration does not include an operation for that API Proxy and path. 

API Products in Apigee are the "unit of consumption" for APIs. When you create an API product, you add operations to that product that define what the product allows. In the case of a REST API, each operation is a combination of three things:

• the name of an API Proxy 
• a set of one or more verbs (like GET, POST, DELETE, etc) and
• a path specification, which may include wildcards. 

So a simple operation might be {apiproxy1, GET, /foo } 

You can add one or more operations to the API Product. About wildcards: A path with a wildcard like /foo/* , matches /foo with any single additional segment.  /foo/bar matches but /foo/bar/baz does not.  A path with a wildcard like /foo/** matches with 1 or more segments. It would match /foo/bar as well as /foo/bar/baz . 

Let's suppose in this simple case you add just one operation to the API Product, as I described it above: {apiproxy:apiproxy1, verb:GET, pathsuffix:/foo } . Subsequently, when an app that is authorized for that API product, presents a token to the API proxy apiproxy1, and the request verb is GET and the request pathsuffix is /foo , .... then VerifyAccessToken will return success.  BUT, if the api proxy is is not "apiproxy1" or if the verb is not GET, or if the pathsuffix is not /foo , then you will see InvalidAPICallAsNoApiProductMatchFound . 

The solution is to add the correct operation into the API Product, which matches the REST call you would like to allow.

Does this help? 

I'll work on making a screencast on this topic - The API Products and operation mechanism is a such a cool feature of Apigee.  But here is a "sample" with a tutorial walkthrough, that shows you how operations work.