BTP & Integrationintermediate

BTP API Management Part 3: Designing Policy Chains

Key takeaway

Combine policies into a sensible chain: authentication first, then spike arrest and quota, then threat protection and mediation, caching where useful, and error handling — with reasons for the order and how to test the chain.

Explanation

📌 KEY POINTS
✅ Authenticate first — unauthenticated calls should be rejected cheaply.
✅ Spike arrest smooths bursts; quota limits volume per app/product over time.
✅ Threat protection validates payload structure before it reaches the back end.
✅ Mediation (AssignMessage, transformations) and caching come after protection.
⚠️ Putting expensive policies (transformations, callouts) before authentication wastes resources on invalid calls.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 2 covered flows. Now chain design.

━━━━━━━━━━━━━━━━━━━━
▶ 1. ORDER PRINCIPLES

Cheap rejections first.

━━━━━━━━━━━━━━━━━━━━
▶ 2. TRAFFIC POLICIES

Spike arrest vs quota.

━━━━━━━━━━━━━━━━━━━━
▶ 3. PROTECTION

JSON/XML threat protection, regex.

━━━━━━━━━━━━━━━━━━━━
▶ 4. MEDIATION & CACHE

AssignMessage, ResponseCache.

━━━━━━━━━━━━━━━━━━━━
▶ 5. ERRORS

RaiseFault, consistent responses.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Design a chain for a public read API.
Add caching for reference data only.
Test rejections and limits.

✅ CHECKPOINT: invalid key → 401 before any other policy runs.

Code example

ABAP Code

===== STANDARD CHAIN (request) =====1 VerifyAPIKey / VerifyAccessToken → 2 SpikeArrest (e.g. 30ps) → 3 Quota (per app, e.g. 10,000/day) → 4 JSONThreatProtection → 5 AssignMessage (headers) → 6 ResponseCache (lookup, reference data only) ===== RESPONSE =====ResponseCache (populate) → AssignMessage (remove internal headers) → FaultRules → RaiseFault standard error JSON

Real project scenario

A team placed an XSLT transformation before authentication; attackers flooding the API consumed CPU on transformations. Reordering to authenticate first reduced load drastically.

Common mistakes

Expensive steps first.
Caching user data.
Missing threat protection.
Inconsistent errors.
Undocumented chains.

Best practices

Auth first.
Cache only shared data.
Threat protection.
Standard errors.
Documented standard.

Interview angle

Questions: "In what order do you place policies?", "Spike arrest vs quota?", "When use response caching?"
Strong answer: order principles, traffic, protection, mediation/cache, errors.

Practice this lesson

Quick check

1. Which statement best describes the difference between the Spike Arrest and Quota policies in SAP API Management?

2. An XSLT transformation runs before authentication and attackers consume CPU. What should change?

3. What is the purpose of combining the PopulateCache and LookupCache policies in an API proxy?

Interview questions

1. What are the most important design decisions, trade-offs, and best practices in API Management?

Answer it in your own words first, then compare.

2. Design a standard policy chain for public and partner APIs.