Best Architecture Practices for API Management and Consumer Access Control
Hello everyone, I have a question concerning the API manager. So in the past we have mostly worked with API policy manager and creating Api Keys (associated with a role) for the consumers. My question: Which architecture or best practice do you use when it comes to creating and publishing APIs:
- 1.
Create one API with api Keys (and roles so you can use expressions in the policies that they can only use certain endpoints) and send it secure to the consumer.
- a.
e.g I have an api key that is associated with role generalRead -> in the authorize by role policy I write the condition: request.method == "GET"
- 3.
Create multiple small APIs and publish them with a subscription (subscriptions manager). So that you can manage which parts consumers can use of the APIs combined.
myapi-public (only allowed endpoints)
myapi-admin (restricted endpoints)
- d.
myapi-write (write endpoints)
