Restricting access to sub-resources in an API proxy

[#1]

Say that I have the following API proxy: example.apigee.com/listen/

This proxy then has the following resources:

example.apigee.com/listen/metrics/

example.apigee.com/listen/1234/content/

example.apigee.com/listen/dashboard/

Is there a way to grant access to only some of these resources based on the API Product or Developer App? E.g. Granting access to /metrics, but restricting access to /dashboard

[anilsr]

Dear @christian.danielsen ,

Yes, Apigee API Product out of the box supports it. You can grant access to only some of these resources based on the API Product. The API resources bundled in a product can come from one or more APIs, so you can mix and match resources to create specialized feature sets.

For more details refer below docs,

• What is an API Product.
• Create API Products , Check point no 12. Adding Resource to API Product.

Cheers,

Anil Sagar

[#3]

Thanks for your quick answer. I've tried but I still can't get it to work. Let's say that I want to only grant access to /metrics : 1. In Apigee Edge I go to Publish -> Product -> Choose the product 2. Click Edit 3. I add ' metrics** ' as the only resource 4. Click Save But when I call the endpoint /dashboard, using that API Product I just restricted to only /metrics, it responds with HTTP 200 OK and data.

I've also tried restricting the resources with the following without luck: '/metrics**', '/*', '/', '**'

[anilsr]

How did you call your endpoint /dashboard ? Is you API proxy secured using policy like Verify API Key policy ? You need to create an App & use the key to make API call. API Products work along with Developer Apps, Security Policies like OAuth or Verify API key in Apigee. If your API Proxy is not secured then API Products doesn't make any sense. See securing your API docs here.

[#5]

Hi Anil, Yes, my API Proxy is secured using API Keys (Verify API Key policy) Although this is the case, it does not seem to work anyway.

[gnanasekaran]

Strange, can you post a screenshot of your resource configuration?

in a simple where you want only access to metrics,

your resource configuration should only contain

/metrics

/metrics**

/metrics/**