API Management
What you must understand
API management covers API components, API proxies, gateways, and authentication. Know how an API component exposes a process, how an API proxy fronts an existing service, and where policies apply. Understand OAuth 2.0, API keys, basic auth, and JWT validation as distinct mechanisms. Be fluent in rate limiting, quota, CORS, and response caching policies. Know the difference between API gateway enforcement and process-level enforcement. Also understand API versions, environments, and how deployment promotes an API from test to production.
Traps that appear
Questions often test where a policy executes (gateway versus process) and whether a policy applies before or after authentication. Another trap is confusing rate limiting (requests per interval) with quota (total requests over a longer window). Watch for questions about OAuth scopes and whether a token is validated at the gateway or the backend. Also expect traps around CORS preflight requests and API key placement in headers versus query strings.
Worked example
You must protect an API with OAuth and cap usage. The rule of thumb: authenticate at the gateway, authorize with scopes, then throttle. Configure JWT validation as a gateway policy, map scopes to allowed operations, and add a rate-limit policy per client. Keep business logic in the process; keep cross-cutting concerns in policies so they apply uniformly.
Rule of thumb
Push security and traffic policies to the gateway; keep the process focused on business logic.