Built-in policies

IBM® API Connect includes a number of built-in policies that you can use to apply preconfigured policy statements to an operation to control an aspect of processing in the Gateway server when an API is invoked.

Note: Although some built-in policies can be used with both the DataPower® Gateway and the Micro Gateway, some policies are restricted to a particular Gateway. The following icons indicate which Gateway each policy can be used with:

Indicates that the policy can be run on the DataPower Gateway.
Indicates that the policy can be run on the Micro Gateway.

Important: IBM API Connect Micro Gateway is deprecated in IBM API Connect Version 5.0.8 in favor of DataPower Gateway. From 1 April 2020, Micro Gateway, and associated toolkit CLI commands, will no longer be supported. Existing users can migrate their API definitions to IBM DataPower Gateways. For information on supported API policies, see Built-in policies.

Important: If you are using IBM API Connect for IBM Cloud, you must apply only policies that can be run on the DataPower Gateway.

Built-in policies are configured in the context of an API. You can use the API Designer assembly editor to add a built-in policy to an API and to configure the properties for that policy.

You can also add built-in policies to an API by creating an OpenAPI (Swagger 2.0) definition file. For more information, see Creating an OpenAPI (Swagger 2.0) definition file.

The following table shows the list of built-in policies that are available, and whether they are restricted to a particular Gateway or are available on both. The table contains links to configuration information for both the built-in policy definitions, and the OpenAPI (Swagger 2.0) policy definitions. The policies are the same, but they are created in different ways.

Table 1. Built-in policies
Built-in policy	OpenAPI (Swagger 2.0) policy	Description
Activity Log ¹	activity-log	Use the Activity Log policy to configure your logging preferences for the API activity that is stored in analytics. The preferences that you specify will override the default settings for collecting and storing details of the API activity.
GatewayScript	gatewayscript	Use the gatewayscript policy to execute a specified DataPower GatewayScript program.
Generate LTPA Token	ltpa-generate	Use the Generate LTPA Token security policy in IBM API Connect to generate a Lightweight Third Party Authentication (LTPA) token.
Invoke	invoke	Apply the Invoke policy to call another service from within your assembly. The response from the backend is stored either in the variable `message.body` or in the response object variable if it is defined. The policy can be used with JSON or XML data, and can be applied multiple times within your assembly.
JavaScript	javascript	Use the JavaScript policy to execute a specified JavaScript program.
JSON to XML	json-to-xml	Use the JSON to XML policy to convert the context payload of your API from the JavaScript Object Notation (JSON) format to the extensible markup language (XML) format.
Generate JWT	jwt-generate	Use the Generate JWT security policy in IBM API Connect to generate a JSON Web Token (JWT).
Validate JWT	jwt-validate	Use the Validate JWT security policy to enable the validation of a JSON Web Token (JWT) in a request before allowing access to the APIs.
Map	map	Use the Map policy to apply transformations to your assembly flow and specify relationships between variables.
Proxy	proxy	Apply the Proxy policy to invoke another API within your assembly, particularly if the separate API contains a large payload. The response from the backend is stored in the `message.body` and in the response object variable if it is defined. Only one policy is permitted to be run per unique assembly flow.
Redaction	redact	Use the Redaction policy to completely remove or to redact specified fields from the Request body, the Response body, and the activity logs. You might find this policy useful for removing or blocking out sensitive data (for example, credit card details) for legal, security, or other reasons.
Set Variable	set-variable	Use the Set Variable policy to set a runtime variable to a string value, or to clear a runtime variable, or to add a header variable.
Validate	validate	Use the Validate policy to validate the payload in an assembly flow against a JSON or an XML schema.
Validate		Use the Validate policy to validate the payload in an assembly flow against a JSON or an XML schema. You can now also use the validate policy with the Micro Gateway to validate the payload in an assembly flow against a JSON schema.
Validate Username Token	validate-usernametoken	Use the Validate Username Token policy to validate a Web Services Security (WS-Security) UsernameToken in a SOAP payload before allowing access to the protected resource.
XML to JSON	xml-to-json	Use the XML to JSON policy to convert the context payload of your API from the extensible markup language (XML) format to JavaScript Object Notation (JSON).
XSLT	xslt	Use the XSLT policy to apply an XSLT transform to the payload of the API definition.

Note: The Micro Gateway does not support the Activity Log policy. However, the Micro Gateway does collect the basic analytic statistics. The statistics that the Micro Gateway gathers are equivalent to what an Activity Log policy in the DataPower Gateway with Content:activity settings gathers with some exceptions:

For the following fields, the Micro Gateway does not collect the information and sends empty payload: requestHttpHeaders, responseHttpHeaders, and debug.
When the Micro Gateway starts with an APIMANAGER environment variable that specifies a valid Management server, the Micro Gateway automatically collects the basic analytic statistics. There is no mechanism to turn the collection function on or off at runtime.