Boomi API Management flashcards
Boomi API Management · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- API Component
- A Boomi component that defines the endpoint, operations, authentication, and policies for an API. It is versioned and deployed to an API gateway as an API Service.
- API Service
- The deployed runtime instance of an API component on a specific gateway environment. It holds the live configuration that the gateway enforces for incoming requests.
- API Operation
- A single method-and-path combination within an API component, such as GET /orders/{id}. Each operation maps to a process or sub-process that handles the request.
- API Gateway
- The runtime layer that receives consumer requests, applies authentication and policies, and forwards allowed traffic to the backing process. Boomi offers cloud and customer-hosted gateways.
- Policy Chain Order
- Policies execute in a defined sequence: request policies run before the operation, response policies run after it, and fault policies run when an error occurs.
- Rate Limit Policy
- A gateway policy that caps the number of requests allowed in a time window, keyed on consumer, API key, or IP. Excess requests are rejected before reaching the backend.
- Developer Portal
- A consumer-facing site that publishes API documentation, lets developers register applications, request credentials, and subscribe to product plans for a given environment.
- API Versioning
- Publishing a new version of an API component so consumers can migrate on their own schedule. Consumers bind to a specific version unless an alias is used.
- Environment Promotion
- Deploying the same API component version from one gateway environment to the next, such as Test to Stage to Prod, so configuration is validated before production release.
- Breaking Change Rule
- Removing an operation, adding a required parameter, or changing the authentication type breaks existing consumers, so it requires a new major API version.
- Additive Change
- Adding an optional parameter, a new operation, or a new response field does not break existing consumers and may ship as a minor version without a new major version.
- API Lifecycle States
- The stages an API passes through: design, develop, test, publish, deprecate, and retire. Deprecation should precede retirement by a communicated notice period.
- Governance Roles
- API managers design and publish APIs, environment administrators control deployment rights, and custom roles can restrict who may publish to production environments.
- Audit Logging
- Account audit logs record deployment and configuration changes, while API call logs record consumer identity, path, status code, and latency for each request.
- API Style Guide
- A documented standard for naming, metadata, error formats, and versioning that reviewers apply to API designs. The platform does not enforce these conventions automatically.
- Consumer Onboarding
- The governed process of registering a consumer application, issuing credentials, assigning scopes, and scheduling periodic credential rotation and review.
- API Key Authentication
- A credential passed in a header or query parameter that identifies the calling application. It is not a user identity and must be combined with TLS.
- OAuth Client Credentials
- An OAuth 2.0 grant where an application obtains a token without a user present. It suits service-to-service calls and requires a client ID and secret.
- Authorization Code Grant
- An OAuth 2.0 grant that issues a token on behalf of a user after redirecting to a login page. It requires a registered redirect URI.
- OAuth Scopes
- Named permissions attached to an access token. The gateway compares the token's scopes with the operation's required scopes before invoking the backend process.
- JWT Validation
- A policy that checks a token's signature, issuer, audience, and expiry. Invalid or expired tokens are rejected with 401 before any backend call occurs.
- Quota Policy
- A gateway policy that limits total requests over a longer period, such as per day or month, complementing the shorter time windows used by rate limits.
- Mutual TLS
- A transport security mode where both client and server present certificates. It is used for partner or internal service-to-service APIs requiring strong identity proof.
- Secure Credential Store
- A platform facility for holding secrets such as API keys and passwords. Secrets should never be stored as plain-text process properties or in source control.
- Least Privilege Runtime
- The principle that the gateway's runtime service account holds only the permissions required to deploy and run APIs in its assigned environment, nothing broader.
- API Product
- A bundle of one or more API components packaged with a shared plan for a target audience, such as internal teams or external partners.
- Product Plan
- A subscription tier for an API product that defines rate limits, quotas, and which operations are exposed. One product can offer several plans.
- Product Subscription
- A consumer application's enrollment in a product plan, made through the Developer Portal. Approval may be automatic or require manual review by an API manager.
- Product Visibility
- A setting that controls whether a product appears publicly in the Developer Portal or is restricted to selected consumer groups and invited partners.
- Credential Issuance Scope
- API keys and OAuth client credentials are issued per consumer application, not per product, so one application can subscribe to multiple products with one identity.
- Product Retirement
- Ending a product after notifying subscribers, offering a migration path to a successor product, and revoking credentials once the notice period expires.
- Subscription Metrics
- Call counts and error rates tracked per consumer and per plan. They drive plan tuning, such as raising quotas or isolating high-volume consumers into dedicated plans.