how to perform quota based limitations?

[#1]

I want to know if there is any way to restrict API access on a per-user basis. We want to provide our customers an API server to enable them to access the data inside our servers. This will be used by automation frameworks and other tools to utilize the data. Our requirement is to implement quota based limitations(API limitations) based on the user whether its based on the API key that we send customer ID there will be specific header fields that we send in our API request and based on those we need to say if this tenant has reached their limit or not say 1000 per day per tenant.

I've looked at API Gateway but it's not possible to implement user based limitations over your API. Could someone please help here.

[sgilson]

Did you see the Identifier element of the Quota policy? You can see that doc here.

Stephen

[anilsr]

@Varun Malhotra , Welcome to Apigee Community.

Yes, It's possible & quick to implement same in Apigee Edge. Have you tried implementing same ? When you mean user , Is it app user / app developer ? Like @sgilson said, you need to use identifier element in quota policy. You can implement quota limitations on any request parameters like headers, query params, request payload / response parameters like response payload , response headers etc... Quota policy is very flexible to implement various use cases. Please give it a try & keep us posted with more details if you see any issue at any point of time.

[nmallesh]

Hi @Varun Malhotra

Like already said, Use the <Identifier> tag to define separate counters for every user.

You could specify that a query param named id contains the unique identifier, perhaps IP address or any other value that uniquely identifies the user.

<Quota name="QuotaPolicy"type="calendar">

<Identifier ref="request.queryparam.userId"/>

<StartTime>2014-02-18 10:00:00</StartTime>

<Interval>5</Interval> <TimeUnit>hour</TimeUnit> <Allowcount="99"/> </Quota>

Hope this helps, thank you.

[#5]

Thanks for the suggestion. Have one more doubt, currently I am exploring APIGEE platform from couple of days and found it quite interesting. However, I'm confused how would we begin, for example whether we'll to Create Product(collection of APIs), then Create Developer accounts and register their applications or it's possible to directly create API proxy, point it to our backend, apply all the required policies and share the URL of our API proxy so that developers apps can start consuming our APIs.

[#6]

@Nisha Mallesh