How to restrict access to different resources in a restful API to consumers?

If I have a restful API with 2 resources in an API -

  • POST /r1
  • PATCH /r2

The API is protected with x-Gateway-APIKey request header.

Consumer 1 is allowed to access only /r1, and consumer 2 is allowed to access only /r2.
How to achieve the same?
With OAuth, I can restrict the consumers with scoping, however the API is to be protected only with x-Gateway-APIKey request header.

Please sugggest.

Hi @mofarhan,
As you said this can be easily achievable using OAuth scope.

The other option i could think of is to create the scope for each resources .
Under each scope use the identify and authorize policy.
Under authorize policy we should use API key and header name to authenticate the request.

In my use case i created an application and inside the application we have 2 headers one for each resource.

And now when i am invoking the request I am passing the header also apart from API key.
And this should get validated.

I am attaching the sample API along with application for you reference. (13.3 KB) (12.7 KB)

Curl command used for testing the API:
curl --location --request POST ‘http://replaceWithTenantName/gateway/WorkflowAPI/1.0/2mEU92D7mY’ \

–header ‘Content-Type: application/json’ \

–header ‘Accept: application/json’ \

–header 'x-Gateway-APIKey: c31bc8ba-1299-4034-badf-1c118abaa786 ’ \

–header ‘CustomerResourceID: 11223344’

Let me know if this solves your usecase problem.

Vikash Sharma

@Vikash_Sharma1 Thanks. Let me go through your solution. However, the product version I use is 10.7 and I am not able to import the same. I get this error - Importing an archive failed.
The selected archive is not supported by this API Gateway version. The archive was exported from API Gateway version: 11.0. If possible, please export them using a lower version.

I have developed this on higher version.
Putting some screenshot for your reference.



Let me know if this helps.

Vikash Sharma

Great. Crystal clear. Thanks for your support each time.