API Management: Gateways, Components, and Policies
What to Know
API Management in Boomi centers on the API gateway and the components used to publish and secure APIs. Candidates must know the API component (defines the API, its resources, operations, and the backing process or service), the API Service component (exposes a process as a service), and the API gateway (runtime that enforces policies, authentication, and routing). Understand the difference between API Service (a single operation exposed from a process) and API (a multi-resource REST contract).
Know the policy categories: authentication (Basic, OAuth 2.0, API key, JWT), rate limiting / throttling, caching, CORS, IP filtering, and transformation/mapping policies. Understand that policies are applied at the gateway and evaluated in order; authentication typically precedes authorization and rate limiting. Know the API portal concept for developer-facing documentation and the API consumer model for granting access.
Traps
A common trap is confusing where a policy executes - policies run at the gateway, not inside the backing process. Another trap: assuming an API Service automatically enforces authentication; authentication must be configured as a policy. Questions may claim that rate limiting is per-API-consumer when it can be configured per consumer or globally depending on setup. Watch for confusion between API and API Service components, and for claims that a process can be published as an API without an API component.
Rule of Thumb
If the requirement is "expose one process operation with minimal configuration," use an API Service. If the requirement is "define a REST contract with multiple resources and methods," use an API component backed by a process or service.
Worked Example
A team needs a /orders endpoint with GET and POST, OAuth 2.0 authentication, and a 100-requests-per-minute limit. Create an API component with two resources (GET and POST), attach an OAuth 2.0 authentication policy, and add a rate-limiting policy at 100 requests per minute. The backing processes handle the business logic; the gateway enforces auth and throttling.