WSO2 APIM Denial Policies

WSO2 API Manager (APIM) provides several mechanisms to block or restrict API access based on specific conditions. These blocking conditions can be used to control access to APIs, protect resources, and enforce security policies. Here are the main blocking conditions available in WSO2 APIM and we can enforce the same by creating the denial policies via admin portal (https://localhost:9443/admin)

1. IP Address Blocking

• Description: Blocks or allows API access based on the client's IP address or range of IP addresses.
• Use Cases:
  • Preventing access from known malicious IP addresses.
  • Restricting access to specific APIs from certain regions or networks.
  • Allowing access only from trusted IP addresses or networks.
  • We can also INVERT the condition to whitelist the IPs

Example:

• Block access from a specific IP: 192.168.1.1
• Block access from an IP range: 192.168.1.0/24 

2. Application Blocking

• Description: Blocks access to APIs from specific applications. This can be useful for controlling which applications can invoke certain APIs.
• Use Cases:
  • Disabling API access for deprecated or unauthorized applications.
  • Controlling access based on the application's subscription tier.
  • Temporarily blocking access for troubleshooting or maintenance purposes.

Example:

• Block an application with a specific application key or name.

3. User Blocking

• Description: Blocks API access for specific users or user roles. This is useful for enforcing user-level access control.
• Use Cases:
  • Revoking API access for users who no longer need it.
  • Preventing certain roles from accessing sensitive APIs.
  • Blocking access for users who have violated terms of service.

Example:

• Block a user with a specific username or role.

4. Blocking by API Context or Resource

• Description: Blocks access based on the API context or specific resources (e.g., paths or endpoints) within an API.
• Use Cases:
  • Restricting access to sensitive resources within an API.
  • Blocking access to specific API paths or operations for certain users or applications.
  • Implementing granular access control at the resource level.

Example:

• Block access to the /admin path within an API.

Summary

These blocking conditions in WSO2 API Manager allow for fine-grained control over who can access APIs and under what conditions. They help ensure that APIs are used securely and appropriately, protecting both the API provider and the consumers from unauthorized access or misuse.