Policies API

Documentation Index

Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt

Use this file to discover all available pages before exploring further.

​

Endpoints

• List Policies - Get all policies for an API proxy
• Add Policy - Add a new policy to an API proxy
• Update Policy - Update an existing policy
• Delete Policy - Delete a policy from an API proxy

​

Policy Types

Policies are organized by type. Each policy type has its own documentation page with complete examples:

​

Authentication Policies

• Basic Authentication
• Clear Text Authentication
• Digest Authentication
• JWT Authentication
• OAuth2 Authentication
• OIDC Authentication
• mTLS Authentication
• API Authentication
• SAML Validation

​

Security Policies

• WS-Security Encrypt
• WS-Security Decrypt
• WS-Security Sign
• WS-Security Sign Validation
• WS-Security Username Token
• WS-Security Timestamp
• WS-Security From Target
• WS-Security To Target
• JOSE Validation
• JOSE Implementation
• Digital Sign
• Digital Sign Verification
• Encryption
• Decryption

​

Rate Limiting & Quota Policies

• API Based Throttling
• API Based Quota
• Client Ban

​

IP Filtering Policies

• Blocked IP List
• Allowed IP List

​

Transformation Policies

• JSON Transformation
• XML Transformation
• Request Protocol Transformation
• Response Protocol Transformation

​

Validation Policies

• JSON Schema Validation
• XML Schema Validation
• Max Message Size
• Min Message Size

​

Content Policies

• Content Filter
• Redaction

​

Scripting Policies

• Script

​

Integration Policies

• API Call

​

Advanced Policies

• Time Restriction
• Business Rule
• Policy Group

​

Authentication

All endpoints require authentication using a Personal API Access Token.

​

Permissions

​

GET Operations (List Policies)

• User must have API_MANAGEMENT + VIEW permission in the project
• If the asset category does not exist, user must have at least one permission in the project

​

POST/PUT/DELETE Operations (Add/Update/Delete Policy)

• User must have API_MANAGEMENT + MANAGE permission in the project
• If deploy: true is set in the request, user must also have API_MANAGEMENT + DEPLOY_UNDEPLOY permission

​

Permission Requirements

​

Related Documentation

• Authentication Guide - How to obtain and use API tokens
• Error Handling - Error response formats