Lesson 3 of 5
Policies
9 min
Listen to this lesson
Policies are where API Management earns its place. SAP's learning material describes more than 40 out-of-the-box policies, grouped broadly into security, traffic management and mediation. Each policy is a small, configurable rule attached at a specific point in the request or response flow. Getting the attachment point and the order right matters as much as the policy itself.
Where policies attach
- Proxy endpoint, request PreFlowFirst contact with the consumer: verify the API key or token, spike arrest, quota, threat protection.
- Conditional flowsRules for one operation or path, such as a preflight OPTIONS request or a write operation.
- Target endpoint, requestPrepare the backend call: add backend credentials, remove the consumer's key, transform the request.
- BackendS/4HANA processes the call.
- Response flowsShape the payload, set CORS headers, map backend errors to the agreed error body, cache.
Put checks that reject bad calls as early as possible. SAP's tutorial attaches Verify API Key to the proxy endpoint's PreFlow on the incoming request, so a call without a valid key is rejected before anything else runs. There is no point spending backend capacity or quota on a call you will refuse.
The policies you will use most
| Group | Policy | What it does | Contoso use |
|---|---|---|---|
| Security | Verify API Key | Checks that the call carries a valid key for a registered application | Every call from Great Lakes Fleet Services' portal |
| Security | OAuth v2.0 | Issues or verifies access tokens | Contoso's own mobile app acting for a signed-in user |
| Security | Threat protection (JSON, XML, regular expression) | Rejects oversized, deeply nested or malicious payloads | Write operations that accept a request body |
| Traffic | Spike Arrest | Smooths sudden bursts to a maximum rate | Protect CMP from a portal bug that loops |
| Traffic | Quota | Caps calls per application over a period, such as an hour or a day | Contractual limit per fleet customer |
| Traffic | Response Cache | Serves repeated identical reads from cache for a set time | Static reference data such as product lists |
| Mediation | Assign Message | Sets or removes headers, variables and payload parts | Strip the API key before calling S/4HANA; add CORS headers |
| Mediation | Raise Fault | Returns a defined error response under a condition | Agreed error body for an unknown order |
| Mediation | Key Value Map Operations, Basic Authentication | Reads stored values and builds an authorization header | Backend credentials kept out of the proxy definition |
Commonly used API Management policies. Names follow SAP's documentation; your tenant lists the full set.
Order and protection
Spike Arrest and Quota solve different problems. Spike Arrest protects the backend from bursts in seconds; Quota enforces an agreed volume per consumer over hours or days. When you need both, SAP guidance applies Spike Arrest first. Backend credentials belong in an encrypted key value map or the provider configuration, never written as text in a policy, because policies are visible to everyone who can edit the proxy.
What would you do?
After a policy change, Great Lakes Fleet Services' calls fail with an authentication error from S/4HANA, not from the proxy. The proxy's key check passes. What is the most likely cause Theo should check?
- Policies attach to request and response flows on the proxy and target endpoints.
- Reject bad calls early: key or token check first in the proxy request PreFlow.
- Spike Arrest protects against bursts; Quota enforces agreed volume per consumer.
- Keep backend credentials in encrypted storage, and shape errors before they leave the proxy.
Check your understanding · not graded
Lesson check
1. Where should Verify API Key normally be attached?
2. Which policy enforces an agreed number of calls per application per day?
3. Why remove the consumer's API key with Assign Message before calling S/4HANA?
4. Which policy returns a defined error response when a condition is met?