Secure integrations and APIs
The exam tests security across transport, identity, authorization, secrets, and data protection, including which controls belong in API Manager and which belong in the application.
Controls
Use TLS 1.2 or later; use mutual TLS for high-assurance B2B links. For system-to-system access use OAuth 2.0 client credentials; for user delegation use authorization code with OpenID Connect. Validate JWTs for signature, issuer, audience, and expiry. Apply scopes or SLA tiers for authorization, and IP allowlists where network location is meaningful. Store secrets in secure properties with an encryption key or a secrets manager, never in Git. Mask or exclude PII in logs, and enable JSON or XML threat protection and schema validation at the edge.
Placement
API Manager policies enforce centrally on the API instance. Application-level security still matters for direct calls, internal endpoints, and outbound credentials. Least privilege applies to connected apps and service accounts.
Worked example
A partner order API requires OAuth client credentials, a 100 request-per-minute tier, an IP allowlist, and JSON threat protection, with payload logging off. Reasoning: identity, quota, network restriction, and payload safety are independent layers; TLS alone protects transit but not authorization.
Traps
Secrets in plain property files; client secrets embedded in mobile apps; skipping JWT audience checks; logging full payloads; treating authentication as authorization; assuming a policy protects an app that lacks autodiscovery.