WSO2 APIM Gateway Flow & Rate Limiting Flow

So, what happens when an API is called to WSO2 API Gateway? And how does that different levels of throttling polices are applied? These are the most common questions with respect to API Gateway & API Security. Let's see the details step by step-

When An Api is called with Token

Image Credits: WSO2

1. Gateway Checks if --> API Proxy exists
2. API Proxy Checks for --> Resource exists or not
3. Token validation by KM and acknowledge to --> Gateway (Gateway itself validates in case of JWT)
4. Gateway Calls --> TM(traffic manager) to publish invocation data asynchronously.
5. Traffic Manager --> Enforces throttling policies
6. Gateway to execute--> any custom mediation extensions
7. Gateway publishes--> events to analytics server
8. Gateway calls --> to backend

The API Rate Limiting Sequence

There are different level of rate limiting policies as supported by WSO2 API Manager. Below are the list of policies we can configure for respective APIs- 

• Application level
• Subscription level
• Advance Throttling
• Custom Throttling
• Blocking conditions

Following is the order of precedence of applying the throttling policies for. Request initiated by client-

1. Client --> Gateway
2. Request --> Gateway [ Checks blocking condition ]
3. Next --> API Level Policies --> Resource Level Policies
4. Next --> Gateway checks for Subscription level throttling
5. Next --> Application Level Policies 
6. Next --> Custom Policies 
7. Next --> Hard Level Policies [backend supported]

[ API Level ] >> 

         [ Resource Level ] >> 

                            [ Subscription Level ] >> 

                                                    [ Application Level ] >> 

                                                                           [ Custom Policies ] >>

                                                                                            [ Hard Level ] 

Image Credits: WSO2