Apply the Proxy policy to invoke another API within your assembly, particularly if the separate API contains a large payload. The response from the backend is stored in the message.body and in the response object variable if it is defined. Only one policy is permitted to be run per unique assembly flow.

Gateway support

Table 1. Table showing which gateways support this policy, and the corresponding policy version
Gateway Policy version
DataPower® Gateway (v5 compatible) 1.0.0
DataPower API Gateway, functionality provided by Invoke  

This topic describes how to configure the policy in the assembly user interface; for details on how to configure the policy in your OpenAPI source, see proxy.


Only one Proxy policy is permitted to be run per unique flow of your assembly. More than one Proxy policy can be applied, if they are contained in mutually exclusive branches of the assembly.

You can use the Proxy policy to return multipart form data, that is, when the response is set to Content-Type: multipart/related. However, Proxy must be the last policy in the assembly, otherwise the response that is received can be manipulated during subsequent steps, thereby causing the multipart form data to be lost.

The proxy policy, if inside a conditional policy, must be the final policy to be executed in the API. If you need further processing afterward, use the invoke policy rather than the proxy policy.


The following table lists the policy properties, indicates whether a property is required, specifies the valid and default values for input, and specifies the data type of the values.

Table 2. Proxy policy properties
Property label Required Description Data type
Title Yes The title of the policy.

The default value is proxy.

Description No A description of the policy. string
Invoke URL Yes Specifies a URL for the target service.

For a SOAP API, a URL is added by default. Where possible, the Proxy URL value is pre-supplied from information that is defined in the imported WSDL.

TLS profile No Specifies a TLS profile to use for the secure transmission of data. string
Timeout Yes The time to wait before a reply back from the endpoint (in seconds).

The default value is 60.

Username No The username to use for HTTP Basic authentication. string
Password No The password to use for HTTP Basic authentication. string
HTTP Method Yes The HTTP method to use for the proxy. Valid values are:
  • Keep
  • GET
  • POST
  • PUT
  • HEAD
The default value is Keep. By using Keep, or removing the property from the source, the HTTP method from the incoming request is used.
Compression No Select this check box to enable Content-Encoding compression on upload.

The check box is cleared by default.


Cache Type

No The cache type determines whether to cache documents, honoring or overriding the HTTP Cache Control directives received in the response from the target URL. This property takes effect only when a response is received, otherwise the policy always returns the non-expired response that was previously saved in cache.
Valid values are:
The cache behavior is determined by the Cache-Control headers on the response, in accordance with RFC 7234.

To optimize performance, if the gateway receives more than one request for a resource that is not in the cache but could be cached when the response from the target URL is received, the gateway sends only one request to the target URL; the remaining requests are not processed until the response from the first request has been received and the cache behavior has been determined from this response. If the response indicates that caching is possible, the gateway responds to all waiting requests with the cached resource. If the response indicates that caching is not possible, the gateway sends all waiting requests to the target URL.

Use this option only if you expect that responses from the target URL can be cached, in which case it should improve performance and limit the demand on the target URL. If, however, the target URL never indicates that the gateway should cache its response, performance might be impaired when compared to the No Cache option.

No Cache
Responses from the target URL are not cached on the gateway regardless of any caching headers returned. In this case, every request from the client is sent to the target URL.

Use this option if you do not want to cache any of the backend responses on the gateway, or if it is unlikely that a response from the target URL will allow caching through the Cache-Control header settings.

Time to Live
This option is similar to the Protocol option except it allows you to specify the amount of time that you want the successful response from the invoke or proxy to remain in the cache. Use this option only if you expect that responses from the target URL can be cached.

The default value is Protocol.


Time to Live

No Specifies the amount of time in seconds that the response stays in the cache. Applies only if the property Cache type is set to Time to Live. Enter a value in the range 5 - 31708800.

The default value is 900.


Cache key

No Specifies the unique identifier of the document cache entry. If omitted, the entire URL string is used as the key. string
Stop on error No Select the errors that, if thrown during the policy execution, cause the assembly flow to stop. If there is a catch flow configured for the error, it is triggered to handle the error thrown. If an error is thrown and there are no errors selected for the Stop on error setting, or if the error thrown is not one of the selected errors, the policy execution is allowed to complete, and the assembly flow continues. string

Response object variable

No The name of a variable that will be used to store the response data from the request. This variable can then be referenced in other actions, such as 'Map'. string
X-Forwarded header No
This header can be provided by
  1. If
    exists, processing continues. If it does not exist prior to calling the proxy policy, it is set with the value of the Host header.
  2. The
    header is always set, in all cases. This header maintains breadcrumbs, showing a comma-separated list of IPs, from the client through any preceding proxy.
  3. If all three of
    , and
    headers are missing at the time of calling the proxy policy, they are set automatically. To prevent this, set
    header to some value before calling the proxy policy.