Is it possible to set quota limit on key level?

[mariusz_panek]

Is it possible to set quota limit on key level?

Example: I want to have 3 users of my API,

I would like to give user A right to make 1000 calls / day

I would like to give user B right to make 5000 calls / day

I would like to give user C right to make 10000 calls / day

Later on another API user may be added with other customer limit. In the future I can have hundreds of users with custom quota limits.

Is it possible to achieve it with apigee? (I know that is doable with other(competitive) solution)

[sarthak]

Yes, you can. In Apigee you do that using API Products. You can learn more about API products here: http://apigee.com/docs/developer-services/content/what-api-product .

Let us know if this is what you were looking for or you.

[gnanasekaran]

yes, Quota can be configured for different type of API consumers, more details here - http://apigee.com/docs/api-services/reference/quot...

Look for Client ID / service plan.

These variables can be applied at various levels, at APIs, or at API products or group / individual developers or for each apps or for end user or even based on client ip

--

Since you mentioned about other solutions, are you evaluating apigee for your business? In that case, sales would be happy to assist you with more information on the solution based on your business needs

[anilsr]

Dear @mariusz.panek ,

Welcome to Apigee Community.

Yes, It's possible. You can achieve same using multiple ways with Quota Policy & Out of the box API Products.

Apigee Developer Portal gives great control how developers access your APIs by creating APPs tied to API Products.

If you use quota policy, Quota Supports CountRef to dynamically set Quota Allowed values,

<Allow count="2000" countRef="{FLOWVARIABLE}"/>

Flow Variable, You can either set using Javascript policy before quota policy to determine user type or use a variable from request payload to determine same.

Cheers,

Anil Sagar

[gauravjain_59]

Hi @Anil Sagar

I tried to use the above dynamic quota using flow variable set using Javascript policy.

I have the Quota Policy below

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<Quota async="false" continueOnError="false" enabled="true" name="Quota">

<DisplayName>Quota</DisplayName>

<FaultRules/>

<Properties/>

<Interval>60</Interval>

<TimeUnit>second</TimeUnit>

<Allow countRef="{throttleParam}" />

</Quota>

And the variable "throttleParam" is set using Javascript Policy and I am getting this value fine but somehow it is not able to replace the value in Quota Policy. Please let me know what is missing here

Please find the attached trace session, just replace the txt extension with xml as not allowing to upload xml file

trace-1454567703410.txt

Thanks

[gauravjain_59]

Hi @Anil Sagar @sgilson

Any inputs on my above query

Thanks in advance

[gauravjain_59]

Hi @Anil Sagar @sgilson

It's working without {} like below

<Allow countRef="throttleParam" />

Is it right ?

Thanks

[sarthak]

@GAURAV yes you are right. No curly braces inside """.

[mariusz_panek]

Hi, thanks for very quick answers! I'm astonished by the speed I got first answers...

But getting back to my use-case: API Products seems like a product or access level to product. What if I need to set dozens of 'Exceptions' in limits for some developers (or keys)?

I don't want to have dozens of products but one product with some custom settings on key level on some keys - is it doable?

about quota-polices - I have read the article - I know that I can set Identifier to ref="client_id" - which set that quota is enforced on each single key (and not on aggregate level) but this still does not solve my problem...

Is it even possible to set exceptions for some developers/keys in policies - if so - how to do it?

Is there a way that I can set limit really on key level? I mean if I could set it on key settings tab then I should be able to check key quota limit for this very specific key without digging up through all policies...

[sarthak]

Yes absolutely you can do that using custom attributes of an API Key/developer/app. All the three attributes have custom attributes and define those custom quota limits there and then in your quota policy you can refer to the custom attributes instead of the value defined in the product.

For developers and apps the custom attributes can be defined in the UI and for API key it can be only defined by the management API.

This is an example of the API call to update the App attribute with custom name-value pairs : http://apigee.com/docs/management/apis/post/organizations/%7Borg_name%7D/developers/%7Bdeveloper_ema...

At which level you want to do it depends on the use cases. If you are specifying quota for a developer (who has lets say 5 different Apps and the quota is for combined traffic across all the apps) then specify it as part of developer attributes. Else specify it as part of the app attributes either in the UI or via APIs

[mariusz_panek]

I guess it should solve my trouble.

I will test it right now. Thanks!

[anilsr]

@mariusz.panek , added a new answer with sample api proxies & policies, developer attribute screenshots and trace screenshots which demonstrates same. You need to create a product and add an api proxy to same, create developer apps to generate keys. Just took 10 - 15 minutes to implement same from scratch 🙂 keep me posted if you have any issues using attached proxy in new answer.

[anilsr · Accepted solution]

Dear @mariusz.panek ,

Please find attached api proxy that demonstrates same. You can just import this and test same. Create an API product and add your API proxy to product. You need to create couple of developers with custom attribute, apps for each developer to generate keys. Make sure you select the product while creating an developer app. Provided developer custom attributes screenshots.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyAPIKey async="false" continueOnError="false" enabled="true" name="Verify-API-Key-1">
    <DisplayName>Verify API Key-1</DisplayName>
    <Properties/>
    <APIKey ref="request.queryparam.apikey"/>
</VerifyAPIKey>

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Quota async="false" continueOnError="false" enabled="true" name="Quota-1">
    <DisplayName>Dynamic Quota</DisplayName>
    <Properties/>
    <Allow count="1000" countRef="verifyapikey.Verify-API-Key-1.developer.allowed_quota"/>
    <Interval ref="request.header.quota_count">1</Interval>
    <TimeUnit ref="request.header.quota_timeout">day</TimeUnit>
    <Identifier ref="client_id"/>
</Quota>

Cheers,

Anil Sagar

[mariusz_panek]

it works! thanks!

[anilsr]

@mariusz.panek , Awesome, Glad your query is resolved 🙂

[anilsr]

Dear @mariusz.panek ,

Just FYI,

Operator / API Admin need not to manually set these attributes. Apigee Edge Itself exposes many APIs to work with different entities inside Apigee Edge Platform. Apigee Developer Services integrates with Apigee Edge through these APIs & Allow your Developers to be onboarded into the platform seamlessly. We can able to configure these attributes automatically in developer portal where Admin / Operator can just enter value instead of keys & values. You can learn more about Apigee Developer Services here. Apigee Developer Portal is built on top of famous open source Drupal CMS. Please keep us posted if you have any queries.

Cheers,

Anil Sagar

[sjm2000]

do agree with Anil, however in rare cases , drupal is not allowed and hence no dev. portal due to security considerations (unfortunately) !!