Access Control
Access Control lets you manage consumers' access permissions to API Proxies and API Proxy Groups — along with the associated expiration date, environment access, and disallowed method/proxy settings — from a single screen. This page lists the Access Control related pages under Identity Management together.
Views and Kinds
The top of the Access Control screen has two views. Both views edit the same access rows:
- APIs: Start from an API to see who can call it. The list on the left has API Proxy, LLM Gateway and Proxy Group tabs. When an item is selected, the Identities tab on the right manages the consumers and applications granted access, and the Endpoints tab (Member Proxies for a Proxy Group) manages endpoint/member-based access restrictions.
- Identities: Start from an identity to see what it can call. The list on the left has Consumer and Application tabs. When an identity is selected, the API Proxies, LLM Gateways and Proxy Groups tabs on the right show and manage the items this identity has access to.
For the selected consumer/API Proxy/Proxy Group relationship, you can configure the expiration date, the access in each environment, and disallowed method/proxy definitions. Quota and throttling are not set here; define them in Limit Plans. Changes are applied with Save & Deploy.
For detailed descriptions of the API Proxy access fields, see the API Proxy ACL page; for the Proxy Group access fields, see the Proxy Group Access Settings section below.
Consumer access permission alone is not sufficient for API proxy access. For the settings in the consumer and access permission to be valid, one of the authentication policies must be added on the API Proxy and the Security Manager option must be selected as the authentication method in this policy.
Proxy Group Access Settings
When an identity is selected in Proxy Group mode, the Access Settings panel on the right contains the following fields:
| Field | Description |
|---|---|
| Expiration | If this date value is entered, the consumer will no longer be able to access the API Proxy Group from the time this date arrives (valid from midnight 00:00). If no date is entered, Never expires is shown and the consumer continues to access the API Proxy Group as long as it does not become inactive. The arrival of this date only restricts access to this API Proxy Group; it does not change access to other API Proxy Groups. |
| Environments | Turns the consumer's access to the API Proxy Group on or off separately for each environment where the API Proxy Group is deployed, with the Access in this environment switch. |
| Blocked API Proxies | If the consumer should not access some member API Proxies of the group regardless of the roles it has, the API Proxies to be closed to access are selected here. The consumer can call every member API Proxy of the group except the blocked ones. |
A consumer's access permission for a given API Proxy Group is held in a single record; pressing Save & Deploy several times does not create a new record for the same permission. Permissions that arrive through an API Product subscription in the portal are the exception and may be listed as separate records per product. For the details and for the automatic consolidation that runs during the upgrade, see the API Proxy ACL page.
Large Identity Lists
In API Proxy and Proxy Group mode, the Identities tab shows the assigned identities page by page. The default page size is 50. You can select 25, 50 or 100. A list with 50 or fewer identities appears on a single page.
- Use the All, Consumers and Applications filters to narrow the list. The counts on the filters and the "shown / total" text cover all assigned identities, not only the current page.
- Use the Search identities... box to find an identity by name, username or organization name. The search is case-insensitive and matches any part of the text.
- Identities you add with Add Identity appear at the top of the first page until you click Save & Deploy.
- Your edits stay in place while you move between pages. An edit you make while a save is running is kept as an unsaved change and is not lost when the save finishes.
- Save & Deploy saves only the changed and added rows. The gateway still receives the complete access list of the API Proxy or Proxy Group.
- On the Endpoints tab, the allowed and blocked counts of each endpoint cover all identities. The drawer that opens when you click an endpoint is also paged.
Removing All Identities
Click Delete all in the identities toolbar to remove the access of every identity to the selected API Proxy or Proxy Group at once. The change is also removed from the gateways. A confirmation dialog shows the identity count and the API name. This action cannot be undone.
Removing all identities runs as one operation. During it, the dialog shows "Removing the access of N identities. Do not close this window." and cannot be closed. Each removed access is still written to the audit log.
Delete all is disabled while there are unsaved changes. Save or discard the changes first. Only users who can manage identities can use this button.
Save Errors
Someone else may remove an access rule after you load the page. In this case, Save & Deploy refuses the request, so the removed access is not granted again. Reload the page and try again.
- "An access rule in the request was removed in the meantime. Reload the page and try again."
- "An access rule in the request belongs to another API. Reload the page and try again."
Related Pages
API Proxy-based access permission and consumer configuration parameters.
Access control list reports based on API Proxy or organization/consumer.
IP group definitions used in Allowed/Blocked IP List policies.
Defining identity-based rate limits and overuse protection.
Creating and managing the consumers that will be granted access.