Refining the scope of a global policy

Scope refers to the set of properties that determine a selected set of APIs for the enforcement of the policy. For a global policy, scope is determined by the policy's property API Type in the Policy Details tab. You can also refine the scope of a global policy when you want to restrict the set of APIs to which you want to apply the global policy.

1. Open the menu options and select Manage > Policies.
2. Click the Global Policies tab. A list of all available global policies appears. Use the Show from the list to set the maximum number of policies you want to display in a page.
3. Select the policy. The Global Policy details page appears.
4. Click Edit. If you do not see the Edit button, it is probably because you do not have the webMethods API Gateway administrator role to modify the scope of a global policy in webMethods API Gateway.
5. Click Filters.
6. If you want to further restrict the set of APIs to which the global policy is applied, you can specify more selection criteria in the Filter section of the API details page. Use the Filter section to filter APIs by Name, Description, Version, HTTP Methods (REST only), API tag, Resource or Operation tag (REST and SOAP), and Method tag (REST only). For details about the API types and their components, see API tagging. If you specify no filter criteria, webMethods API Gateway applies the global policy to all the selected APIs.

   You can filter APIs based on their Name, Description, Version, API tag, Resource or Operation tag, and Method attributes by using any of the following comparison operators:

   Comparison Operators	Description
   Equals	Selects APIs whose Name, Description, Version, or Tag value matches a string of characters. For example, use this operator to apply a policy only to REST APIs with the Name or Description value 4G Mobile Store.
   Not Equals	Selects APIs whose Name, Description, Version, or Tag value does not match a string of characters. For example, use this operator to apply a policy only to all REST APIs except with the Name or Description value Mobile.
   Contains	Selects APIs whose Name, Description, or Tag value includes a string of characters anywhere within the attribute's value. For example, use this operator to apply a policy to REST APIs that had the word Mobile anywhere in their Name or Description attribute.
   Starts with	Selects APIs whose Name, Description, or Tag value begins with a string. For example, use this operator to apply a policy only to REST APIs whose Name or Description begins with the characters 4G.
   Ends with	Selects APIs whose Name, Description, or Tag value ends with a string. For example, use this operator to apply a policy only to REST APIs whose Name or Description ends with the characters Store.

   When you specify match strings for the comparison operators described, keep the following points in mind.

   • Match strings are not case-sensitive. If you define a filter for names that start with ABC it selects name starting abc and Abc.
   • Wildcard characters are not supported. That is, you cannot use characters such as * or % to represent any sequence of characters. These characters, if present in the match string, are treated as literal characters that are to be matched.

   Filtering by HTTP Methods (Applicable only for REST APIs)

   • You can restrict a policy to specific HTTP methods of the REST APIs by specifying the following options, GET, POST, PUT, DELETE, PATCH, and HEAD.

     HTTP Methods	Description
     GET	The policy applies only to HTTP GET requests for any resource in the API. For example, use this option to apply a policy to resources of a REST API during an incoming GET request.
     POST	The policy applies only to HTTP POST requests for any resource in the API. For example, use this option to apply a policy to resources of a REST API during an incoming POST request.
     PUT	The policy applies only to HTTP PUT requests for any resource in the API. For example, use this option to apply a policy to resources of a REST API during an incoming PUT request.
     DELETE	The policy applies only to HTTP DELETE requests for any resource in the API. For example, use this option to apply a policy to resources of a REST API during an incoming DELETE request.
     PATCH	The policy applies only to HTTP PATCH requests for any resource in the API. For example, use this option to apply a policy to resources of a REST API during an incoming PATCH request.
     HEAD	The policy applies only to HTTP HEAD requests for any resource in the API. For example, use this option to apply a policy to resources of a REST API during an incoming HEAD request.

   To refine the scope of a global policy, perform the following steps.

   1. To filter by API types, select the API types by which you want to filter APIs.
   2. Applicable only for REST APIs. To filter by HTTP methods, in the Filter by using HTTP methods section, select the HTTP methods by which you want to filter APIs with appropriate incoming requests.
   3. To filter by Name, Description, Version, or Tags, do the following steps in the Filter by using attributes section:
      1. Select an attribute to filter the APIs to which you want to apply the global policy. Available attributes are API name, API description, API version, API tag, Resource or Operation tag, Method tag.
      2. Select the comparison operator.
      3. Specify the match string in the third field.
      4. To specify more criteria, click Add and repeat the above steps.
      5. Select the logical conjunction AND or disjunction OR operation to apply when multiple criteria are specified for the global policy. The default value is AND.
   4. You can add multiple attribute filter groups by clicking the +Add button.
   5. You can also specify the logical conjunction AND or disjunction OR operation to apply between filter groups.
   6. Click Save to save the updated policy.