WSO2 API Manager is a complete solution for publishing APIs, creating and managing a developer community and for routing API traffic in a scalable manner. It leverages the integration, security and governance components from the WSO2 Enterprise Service Bus, WSO2 Identity Server, and WSO2 Governance Registry. In addition, as it is powered by the WSO2 Business Activity Monitor (BAM), the WSO2 API Manager is ready for massively scalable deployments immediately.
This guide walks you thorough the basic usecases of the API Manager:
Introduction to basic concepts
Let's take a look at the basic concepts that you need to know before using the API Manager.
The API Manager comprises of the following components:
- API Gateway: Secures, protects, manages, and scales API calls. It is a simple API proxy that intercepts API requests and applies policies such as throttling and security checks. It is also instrumental in gathering API usage statistics. The Web interface can be accessed via
- Key Manager: Handles all security and key-related operations. API gateway connects with the Key Manager to check the validity of OAuth tokens when the APIs are invoked. The Key Manager also provides a token API to generate OAuth tokens that can be accessed via the Gateway.
- API Publisher: Enables API providers to publish APIs, share documentation, provision API keys, and gather feedback on features, quality and usage. You access the Web interface via
- API Store: Enables API consumers to self register, discover and subscribe to APIs, evaluate them and interact with API publishers. You access the Web interface via
- Additionally, statistics are provided by the monitoring component, which integrates with WSO2 BAM.
Users and roles
The API manager offers three distinct community roles that are applicable to most enterprises:
- Creator: A creator is a person in a technical role who understands the technical aspects of the API (interfaces, documentation, versions, how it is exposed by the Gateway etc.) and uses the API publisher to provision APIs into the API Store. The creator uses the API Store to consult ratings and feedback provided by API users. Creators can add APIs to the store but cannot manage their life cycle (i.e., make them visible to the outside world).
- Publisher: A publisher manages a set of APIs across the enterprise or business unit and controls the API life cycle and monetization aspects. The publisher is also interested in usage patterns for APIs and has access to all API statistics.
- Consumer: A consumer uses the API store to discover APIs, see the documentation and forums and rate/comment on the APIs. S/he subscribes to APIs to obtain API keys.
API life cycle
An API is the published interface, while the service is the implementation running in the backend. APIs have their own life cycles that are independent of the backend services they rely on. This life cycle is exposed in the API Publisher Web interface and is managed by the publisher role.
The following stages are available in the default API life cycle:
- CREATED: API metadata is added to the API Store, but it is not visible to subscribers yet, nor deployed to the API Gateway
- PROTOTYPED: The API is deployed and published in the API Store as a prototype. A prototyped API is usually a mock implementation made public in order to get feedback about its usability. Users can try out a prototyped API without subscribing to it.
- PUBLISHED: The API is visible in the API Store and available for subscription.
- DEPRECATED: The API is still deployed in the API Gateway (i.e., available at runtime to existing users) but not visible to subscribers. You can deprecate an API automatically when a new version of it is published.
- RETIRED: The API is unpublished from the API Gateway and deleted from the Store.
- BLOCKED: Access to the API is temporarily blocked. Runtime calls are blocked and the API is not shown in the API Store anymore.
You can manage the API and service life cycles in the same governance registry/repository and automatically link them. This feature is available in WSO2 Governance Registry (version 4.5 onwards).
An application is primarily used to decouple the consumer from the APIs. It allows you to do the following:
- Generate and use a single key for multiple APIs
- Subscribe multiple times to a single API with different SLA levels
You create an application to subscribe to an API. The API Manager comes with a default application and you can also create as many applications as you like.
Throttling tiers are associated to an API at subscription time. They define the throttling limits enforced by the API Gateway. E.g., 10 TPS (transactions per second). You define the list of tiers that are available for a given API at the publisher level. The API Manager comes with three predefined tiers (
Gold/Silver/Bronze) and a special tier called
Unlimited, which you can disable by editing the
<TierManagement> element of
The API Manager supports two scenarios for authentication:
- An access token is used to identify and authenticate a whole application
- An access token is used to identify the final user of an application (for example, the final user of a mobile application deployed on many different devices)
Application access tokens
Application access tokens are generated by the API consumer and must be passed in the incoming API requests. The API Manager uses the OAuth2 standard to provide key management. An API key is a simple string that you pass with an HTTP header (e.g., "
Authorization: Bearer NtBQkXoKElu0H1a1fQ0DWfo6IX4a") and it works equally well for SOAP and REST calls.
Application access tokens are generated at the application level and valid for all APIs that you associate to the application. These tokens have a fixed expiration time, which is set to 60 minutes by default. You can change this to a longer time, even for several weeks. Consumers can regenerate the access token directly from the API Store. To change the default expiration time, you open the
<APIM_HOME>/repository/conf/identity.xml file and change the value of the element
<ApplicationAccessTokenDefaultValidityPeriod>. If you set a negative value, the token never expires.
Application user access token
You generate access tokens on demand using the Token API. In case a token expires, you use the Token API to refresh it.
Application user access tokens have a fixed expiration time, which is 60 minutes by default. You can update it to a longer time by editing the
<ApplicationAccessTokenDefaultValidityPeriod> element in the
The token API takes the following parameters to generate the access token:
- Grant Type
To generate a new access token, you issue a Token API call with the above parameters where
grant_type=password. The Token API then returns two tokens- an access token and a refresh token. The access token is saved in a session on the client side (the application itself does not need to manage users and passwords). On the API Gateway side, the access token is validated for each API call. When the token expires, you refresh the token by issuing a token API call with the above parameters where
grant_type=refresh_token and passing the refresh token as a parameter.
An API is made up of one or more resources. Each resource handles a particular type of request and is analogous to a method (function) in a larger API. API resources accept the following optional attributes:
- verbs: Specifies the HTTP verbs a particular resource accepts. Allowed values are GET, POST, PUT, OPTIONS, DELETE. You can give multiple values at once.
- uri-template: A URI template as defined in http://tools.ietf.org/html/rfc6570 (e.g., /phoneverify/<phoneNumber>)
- url-mapping: A URL mapping defined as per the servlet specification (extension mappings, path mappings and exact mappings)
- Throttling tiers: Limits the number of hits to a resource during a given period of time.
- Auth-Type: Specifies the Resource level authentication along the HTTP verbs. Auth-type can be None, Application or Application User.
- None : Can access the particular API resource without any access tokens
- Application: An application access token is required to access the API resource
- Application User: A user access token is required to access the API resource
Starting the API Manager
- Download WSO2 API Manager from http://wso2.com/api-management/try-it.
- Install Oracle Java SE Development Kit (JDK) version 1.6.24 or later or 1.7.*.
- Set the
- Using the command line, go to
wso2server.bat(for Windows) or
- Wait until you see the message "WSO2 Carbon started in 'n' seconds" where 'n' can be any number of seconds.
Creating users and roles
Inwe introduced a set of users that are commonly found in many enterprises. Let's see how you can log in to the Management Console as an admin and create these roles.
Log in to the Management Console (
https://<hostname>:9443/carbon)of the API Manager using admin/admin credentials.
- Select the Users and Roles menu under the Configure menu.
- Click the Roles link and then click Add New Role.
- Give the role name as
creatorand click Next.
- A list of permissions opens. Select the following and click Finish.
- Configure > Governance and all underlying permissions.
- Manage > API > Create
- Manage > Resources > Govern and all underlying permissions
Similarly, create the
publisherrole with the following permissions.
- Manage > API > Publish
Note that the API Manager comes with the
subscriberrole available by default. It has the following permissions:
- Manage > API > Subscribe
- Note that you have the following roles added:
Let's create users for each of the roles.
- Click the Users and Roles menu under the Configure menu again.
- Click the Users link and then click Add New User.
- Give the username/password and click Next. For example, lets create a new user by the name
Select the role you want to assign to the user (e.g.,
publisher) and Finish. Given below is a list of usernames and the roles we assign to them in this guide.
Similarly, create a new user by the name
apicreatorand assign the creator role.
Creating an API
An API creator uses the API Publisher to create and publish APIs to the API Store. Let's create an API and add interactive Swagger-based documentation to it.
- Open the API Publisher (
https://<hostname>:9443/publisher)and log in as
Click the Add link and provide the information given in the table below. Click Implement once you are done.
Field Sample value NamePhoneVerificationContext/phoneverify Version 1.0.0 Visibility Public Resources URL pattern CheckPhoneNumber Request types GET, POST, OPTIONS
Give the following information in the Implement tab that opens and click Manage once you are done.
Field Sample value Implementation method Backend Endpoint type HTTP Production endpoint
In this guide, we work with a service exposed by the Cdyne services provider. We use their phone validation service, which has SOAP and REST interfaces. Endpoint is http://ws.cdyne.com/phoneverify/phoneverify.asmx.
This sample service has two operations as
CheckPhoneNumbers. Let's use
Endpoint security scheme Non Secured (If secured, user is asked for credentials of the backend service)
Click Manage to go to the
Managetab and provide the following information.
Field Value Description Tier Availability Bronze/Gold/Silver/Unlimited The API can be available at different level of service; you can select multiple entries from the list. At subscription time, the consumer chooses which tier they are interested in.
Tip: For resources that have methods requiring authentication (i.e., Auth Type is not NONE), you set None as the Auth type of
OPTIONSto support CORS (Cross Origin Resource Sharing) between the API Store and Gateway.
Once you are done, click Save.
Adding API documentation
After saving the API, click on its thumbnail in the API Publisher to open it.
Click on the API's Docs tab and click the Add New Document link.
The document options appear. Note that you can create documentation inline, via a URL or as a file. For inline documentation, you can edit the content directly from the API publisher interface. You get several documents types:
- How To
- Samples and SDK
- Public forum / Support forum (external link only)
- API message formats
Create a 'How To,' using in-line content as the source. The document name is
SimpleClientand click the Add Document button.
Once the document is added, click Edit Content link associated with it to opens an embedded editor.
Enter your API's documentation.
Adding interactive documentation
The API Manager provides facility to add interactive documentation support through the integration of Swagger. Swagger is a specification and a complete framework implementation for describing, producing, consuming, and visualizing RESTful Web services. You describe APIs in simple, static JSON representation through the Swagger API definition in the API Store. When an API is created, the JSON representation of that API is automatically generated and saved in the registry. This definition reflects the information you provide at the API creation stage. You can customize it as follows:
- Open the API Publisher (
https://<hostname>:9443/publisher)and log in as
apicreatorif you haven't done so already.
- Click the
PhoneVerificationAPI to open it and then click the Edit link right next to the API's name. This opens the API in its edit mode.
- Click the Edit Swagger Definition button.
When the Swagger definition of the API opens, navigate to the GET method, add the following parameters to it and remove the existing body parameter. The code is given below:
- Click Save once the changes are done. In a later section, we will see how these parameters appear to subscribers in the API Console of the API Store.
Versioning the API
Let's create a new version of this API.
- Log in to the API Publisher as
apicreatorif you are not logged in already.
- Click on the
PhoneVerificationAPI and then the Copy button that appears in its Overview tab.
Give a new version number (e.g., 2.0.0) and click Done.
Tip: The Default Version option means that you make this version the default in a group of different versions of the API. A default API can be invoked without specifying the version number in the URL. For example, if you mark http://host:port/youtube/2.0 as the default version when the API has 1.0 and 3.0 versions as well, requests made to http://host:port/youtube/ get automatically routed to version 2.0.
If you mark any version of an API as the default, you get two API URLs in its Overview page in the API Store. One URL is with the version and the other is without. You can invoke a default version using both URLs.
If you mark an unpublished API as the default, the previous default, published API will still be used as the default until the new default API is published (or prototyped).
A new version of the API is created. It is a duplication of the original API, including its documentation. The
PhoneVerification 2.0.0 API is now ready to be published. This is typically done by a user in the
Publishing the API
- Log in to the API Publisher as
apipublisherthat you created earlier in this guide.
- Click on the
PhoneVerificationAPI version 2.0.0. Note that you now see a tab by the name Lifecycle in the API Publisher.
- Go to the Lifecycle tab and select the state as
PUBLISHEDfrom the drop-down list.
The three checkboxes mean the following:
- Propagate Changes to API Gateway: Used to define an API proxy in the API Gateway runtime component, allowing the API to be exposed to the consumers via the API Gateway. If this option is left unselected, the API metadata will not change and you will have to manually configure the API Gateway according to the information published in the API Store.
- Deprecate Old Versions: If selected, any prior versions of the API that are published will be set to the DEPRECATED state automatically.
- Require Re-Subscription: Invalidates current user subscriptions, forcing users to subscribe again.
- Go to the API Store (
https://<hostname>:9443/store)using your browser and note that the
PhoneVerification 2.0.0is visible under the APIs menu.
Subscribing to the API
You subscribe to APIs using the API Store.
- Open the API Store (
Self sign up to the API Store using the Sign-up link.
After signing up, log in to the API Store and click the API that you published earlier (
Note that you can now see the subscription options on the right hand side of the UI. Select the default application and
Bronzetier, and click Subscribe.
- Once the subscription is successful, choose to go to the My Subscriptions page.
In the My Subscriptions page, click the Generate buttons to generate access tokens that you need to invoke the API.
Tip: You can set a token validity period in the given text box. By default, it is set to one hour. If you set a minus value (e.g., -1), the token will never expire.
Invoking the API
Let's invoke the API using the integrated Swagger-based API Console.
Click the APIs menu in the API Store and then click on the API that you want to invoke. When the API opens, go to its API Console tab.
Expand the GET method of the resource
CheckPhoneNumber. Note the parameters that you added in this step now appearing with their descriptions in the console.
Give sample values to the
LicenseKeyand click Try it Out to invoke the API.
Tip: If you cannot invoke the API's HTTPS endpoint (causes the SSLPeerUnverified exception), it could be because the security certificate issued by the server is not trusted by your browser. To resolve this issue, access the HTTPS endpoint directly from your browser and accept the security certificate.
Note the response for the API invocation. As we used a valid phone number in this example, the response is valid.
You have invoked an API using the API Console.
Monitoring APIs and viewing statistics
Both the API publisher and store provide several statistical dashboards. Some of them are as follows:
- Number of subscriptions per API (across all versions of an API)
- Number of API calls being made per API (across all versions of an API)
- The subscribers who did the last 10 API invocations and the APIs/versions they invoked
Usage of an API and from which resource path (per API version)
- Number of times a user has accessed an API
- The number of API invocations that failed to reach the endpoint per API per user
- API usage per application
- Users who make the most API invocations, per application
API usage from resource path, per application
If you are on Windows, note the following:
- If you install JDK in Program Files in the Windows environment, avoid the space by using PROGRA~1 when specifying environment variables for JAVA_HOME and PATH. Else, the server throws an exception.
C:/cygwin/binand restart BAM.BAM analytics framework depends on Apache Hadoop, which requires Cygwin in order to run on Windows. Install at least the basic net (OpenSSH,tcp_wrapper packages) and security related Cygwin packages. After Cygwin installation, update the PATH variable with
Steps below explain how to configure WSO2 BAM 2.5.0 with the API Manager. Let's do the configurations first.
Do the following changes in
- Enable API usage tracking by setting the
<APIUsageTracking>element to true
- Set the Thrift port to 7614
- Uncomments and set the data source used for getting BAM statistics in
- Set <BAMServerURL> to tcp://<BAM host IP>:7614/ where <BAM host IP> is the machine IP address. Do not use localhost unless you're in a disconnected mode.
- Enable API usage tracking by setting the
Specify the datasource definition in
<APIM_HOME>/repository/conf/datasources/master-datasources.xmlfile as follows.
Save the database driver JAR inside both
Next, prepare BAM to collect and analyze statistics from API manager.
- Download WSO2 BAM 2.5.0 or later from location: http://wso2.com/products/business-activity-monitor.
Change port offset of BAM to 3 by editing the file
<BAM_HOME>/repository/conf/carbon.xmlfile (search for the offset node).
This increments all ports used by the server by 3, which means the BAM server will run on port 9446. Port offset is used to increment the default port by a given value. It avoids possible port conflicts when multiple WSO2 products run in same host.
WSO2_AMSTATS_DBdefinition from API Manager's
master-datasources.xmlfile. You edited it in step 2.
<BAM_HOME>/repository/conf/data-bridge/data-bridge-config.xmlfile, give the host name as localhost. If you are running BAM on a different server than where the API Manager runs on, give the IP address instead.
<BAM_HOME>/repository/conf/etc/hector-config.xmlfile and change the port to localhost:9163 . This is because you incremented the BAM port by 3 in step 1.
Restart the BAM server by running
Let's see the statistics now.
- Connect to the API Publisher as a creator or publisher.
In the publisher role, you are able to see all stats and as creator, you see stats specific to the APIs you create.
- Click the Statistics menu. We show the sample statistics here, but you will see graphs specific to your instance.
- Similarly, API subscribers can also see statistics though the API Store. Click the Statistics menu as follows:
This concludes the API Manager quick start. You have set up the API Manager and gone through the basic usecases of the product. For more advanced usecases, please see the User Guide and the Admin Guide of the API Manager documentation.