API Security
Security Mechanisms
API Security in Boomi involves protecting APIs from unauthorized access and attacks. Key concepts include authentication (verifying identity) and authorization (granting permissions). Boomi supports multiple authentication methods: API keys, OAuth 2.0, JWT, and basic authentication. Candidates must know when to use each: API keys for simple identification, OAuth 2.0 for delegated access, JWT for stateless verification.
Threat Protection
Boomi API Gateway provides threat protection features such as rate limiting, spike arrest, and JSON/XML threat protection to prevent injection attacks. A common trap is confusing rate limiting (limits requests per time window) with spike arrest (smooths traffic spikes by limiting requests per second). Another trap: SSL/TLS termination is handled at the gateway, so backend services may not need to implement SSL.
OAuth 2.0 Flows
Boomi supports OAuth 2.0 flows: client credentials, authorization code, and implicit. For machine-to-machine, use client credentials; for user-facing apps, use authorization code. Candidates should understand scopes and how they map to API permissions.
Worked Example
To secure an API with OAuth 2.0 client credentials: create an OAuth provider in Boomi, define scopes (e.g., read:customers), and attach a security policy to the API plan requiring OAuth 2.0 with the read:customers scope. Clients must obtain a token from the token endpoint and include it in the Authorization header.
Rule of Thumb
Use OAuth 2.0 for delegated authorization; use API keys only for low-risk, internal APIs.