Gateway extensions for IBM API Connect are packaged as .zip files for uploading. This archive must contain the extension manifest file, gateway-extension.yml, at its root level. All other required files, such as DataPower configuration objects or OpenAPI definitions referenced in the manifest, must also be included in the .zip file, maintaining their relative path structure. The gateway service in the API Manager UI specifically requires this .zip format for the upload process.

1. IBM Documentation for API Connect v10.0.5.x: "Creating a gateway extension". This document states

"Package the extension into a .zip file. The .zip file must contain the extension manifest file

gateway-extension.yml

at the root level."

2. IBM Documentation for API Connect v10.0.5.x: "Configuring a gateway service". In the section on managing gateway extensions

the procedure specifies

"To upload a gateway extension

click Upload. Browse to the extension .zip file and click Open."

In IBM API Connect, rate limits are configured at two primary levels to govern API consumption. First, they are defined within a Plan, which is part of a Product. This allows for creating different service tiers (e.g., Basic, Premium) with distinct rate limits that application developers can subscribe to. Second, a default rate limit can be set at the Catalog level. This Catalog-level limit is automatically applied to any Plan within that Catalog that does not have its own specific rate limit defined, ensuring a baseline level of governance and protection for all published APIs.

1. IBM API Connect v10.0.x Documentation

"Editing a Product draft": This document details the configuration of Plans within a Product. In the "Plans" section

it states

"In the Rate limits section

you can add new rate limits for the plan... Each rate limit has a name

is specified as a value per time interval...". This confirms that rate limits are defined at the Plan level.

2. IBM API Connect v10.0.x Documentation

"Creating and configuring Catalogs": This source describes the settings available for a Catalog. Under the "Catalog settings" tab details

it specifies the "Default plan rate limit" option and explains

"Apply a default rate limit to all plans in this Catalog. The default rate limit is not enforced for a plan if that plan has its own rate limit." This confirms that a default rate limit can be defined at the Catalog level.

The API Gateway is the dedicated runtime component in the IBM API Connect architecture responsible for processing and controlling API traffic. It acts as a proxy, intercepting all incoming API requests. At this point, it enforces the policies that have been defined in the API Manager, such as security checks (e.g., OAuth, API key validation), rate limiting, and traffic logging. After successful policy enforcement, the Gateway routes the request to the appropriate backend service. It is the data plane component where policies are actively applied to live traffic.

1. IBM API Connect v10.x Documentation: In the "API Connect components" section

the role of the Gateway is explicitly defined: "The Gateway is the component that enforces runtime policies to secure and control API traffic. The Gateway proxies and processes the API requests and responses."

Source: IBM. (2023). API Connect components. IBM API Connect 10.0.x Documentation. Retrieved from the IBM Knowledge Center. (Section: "API Connect components" > "Gateway").

2. IBM Redbooks: This publication details the architecture

stating

"The API gateway is the policy enforcement point that secures and controls API traffic. It is the component that handles the API traffic at run time."

Source: IBM Redbooks. (2018). IBM API Connect 2018.x Essentials. (SG24-8353-00). Page 10

Section 1.3.1 "API Connect components".

3. IBM API Connect v10.x Documentation: The overview section further clarifies the separation of duties: "You use the API Manager user interface to manage APIs for your provider organizations... The API Gateway is responsible for routing the API traffic and for the enforcement of the API security policies."

Source: IBM. (2023). API Connect overview. IBM API Connect 10.0.x Documentation. Retrieved from the IBM Knowledge Center. (Section: "API Connect overview").

The Developer Portal in IBM API Connect serves as the interface for API consumers. A member of a "Consumer organization," often called an Application Developer, is the user who registers on the portal. Their primary task is to create a client application entity within the portal. This registered application is then used to subscribe to available API Products, which in turn grants the application the necessary credentials (e.g., Client ID and Secret) to invoke the APIs. The Provider organization creates and publishes the APIs, while the Consumer organization builds applications that use them.

1. IBM API Connect v10.x Knowledge Center

"API Connect overview": This document outlines the key user roles. It states

"Application developers use the APIs that are created by API developers. Application developers work for an organization that wants to gain access to your APIs... They register their applications

then subscribe to the APIs... in the Developer Portal." This clearly defines the consumer's role in creating applications.

Reference: IBM API Connect v10.x Knowledge Center > API Connect overview > API Connect user roles.

2. IBM API Connect v10.x Knowledge Center

"Using the Developer Portal": This section details the workflow for an application developer. The first steps involve signing into the Developer Portal and then creating an application. It specifies

"To use an API

you register the client application that will access the API."

Reference: IBM API Connect v10.x Knowledge Center > Developing and managing APIs and Products > Using the Developer Portal > Registering an application.

3. IBM API Connect v10.x Knowledge Center

"Managing consumer organizations": This page explains that Provider organizations manage the consumer organizations that will use their APIs. It states

"In the API Manager UI

you can create and manage the consumer organizations that will sign up to your Developer Portal to use your APIs." This reinforces the distinction between the provider and the consumer who creates the application.

Reference: IBM API Connect v10.x Knowledge Center > Administering your environment > Managing consumer organizations.

In any API Connect policy YAML—custom or global—the identifier line (policy:, global-policy:, assembly-flow:, and so on) carries a version string that must exactly match the version declared later in info.version. If the two values differ, the Gateway rejects the policy at load time. Therefore, when you create a global-policy YAML to alter default rate-limit behaviour, you must ensure that the version number at the start of the file is identical to the version inside the info section.

1. IBM API Connect 10.0.x Documentation

“Creating a global policy” – Note on matching version numbers (https://www.ibm.com/docs/api-connect/10.0.x

Section: Creating a global policy

para. 3).

2. IBM API Connect 10.0.x Gateway Extension Dev Guide

“YAML file structure for policies”

Table “Required fields”

note 2 — version in header must equal info.version.

3. IBM API Connect 10.0.x

Custom Policy Reference

“full-custom flag”

states it is only valid for custom (non-global) policies

not global policies.

In the IBM API Connect Developer Portal, there are two distinct methods for establishing a new Consumer organization. The first method is a direct administrative action where a user with appropriate permissions creates the organization, specifying both its title and assigning an existing user as the owner. The second method is an invitation-based workflow, where an administrator invites a new user via email. Upon accepting the invitation and completing the registration process, this new user is prompted to create their own organization and provide its title, thereby becoming its owner.

1. IBM API Connect v10.x Documentation

Administering consumer organizations: This page explicitly outlines the two methods. It states

"You can create a consumer organization in the following ways: You can create the consumer organization yourself

and assign an owner... You can invite a user to become an organization owner. The user then creates the consumer organization when they accept the invitation."

2. IBM API Connect v10.x Documentation

Creating a consumer organization: This section details the direct creation method

showing that the administrator must complete the "Organization title" and "Organization owner" fields. This directly supports option D.

3. IBM API Connect v10.x Documentation

Inviting a new consumer organization owner: This page describes the invitation process. It clarifies the user's role: "The user must complete the Organization field to specify the title of their new consumer organization." This directly supports option E.

Enabling Spaces in an IBM API Connect Catalog creates distinct partitions for managing the API lifecycle. This partitioning extends to all consumer-related entities and their management. Consequently, consumer organizations, the applications they register, the subscriptions those applications make to Products, the associated approval workflows, and the resulting analytics data are all scoped to and managed within a specific Space. This allows different teams to manage their own APIs and consumer communities independently within a single Catalog, providing a multi-tenant-like experience.

1. IBM API Connect v10.x Documentation

"Using Spaces in Catalogs": "When Spaces are enabled in a Catalog

API provider teams can manage their APIs and Products in a dedicated Space... allowing each team to manage its own API consumers... When an application developer signs in to the Developer Portal

they select which Space to work in. The application developer can register applications only in the Spaces that they have access to

and can subscribe only to the Products that are available in those Spaces." This confirms that consumers

applications

and subscriptions are space-specific.

2. IBM API Connect v10.x Documentation

"Viewing the analytics for a Space": "Analytics data is specific to a Catalog

and is partitioned by Space. You can view the analytics data for a specific Space." This confirms that analytics are also partitioned by Space.

3. IBM API Connect v10.x Documentation

"Managing consumer access to Spaces": "When Spaces are enabled

the Developer Portal is partitioned by Space. Application developers who are members of a consumer organization can be granted access to one or more Spaces." This directly links consumer management to the Space level.

When configuring a user registry for the Developer Portal in the IBM API Connect Cloud Manager or API Manager, you can use OpenID Connect (OIDC) for authentication. The system provides several "out of the box" templates for common OIDC providers to simplify the configuration process. These templates pre-populate certain required fields, such as endpoint URLs. Among the available options in the management user interface for creating an OIDC user registry are specific types for Azure and IBM Cloud, in addition to Google and a Generic option for all other providers.

1. IBM API Connect v10.0.5.x Documentation

"Creating an OIDC user registry": This official documentation page details the steps for creating an OIDC user registry in the Cloud Manager. In Step 5

it explicitly lists the available OIDC Provider Types.

Reference: In the section "About this task

" the documentation states: "When you create an OIDC user registry

you can select from the following OIDC provider types: Generic

Google

Azure

IBM Cloud." This directly supports the selection of Azure and IBM Cloud as out-of-the-box types.

Source: IBM. (2023). Creating an OIDC user registry. IBM API Connect 10.0.5.x Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=registries-creating-oidc-user-registry

2. IBM API Connect v10.0.x Documentation

"User registries for authenticating": This document provides an overview of user registries and mentions the types of third-party identity providers that can be integrated.

Reference: The section on OIDC user registries confirms that specific configurations exist for providers like Azure and IBM Cloud to streamline the setup process for authenticating and authorizing users for both the Developer Portal and API consumption.

Source: IBM. (2023). User registries for authenticating. IBM API Connect 10.0.x Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.1.x?topic=security-user-registries-authenticating

The Consumer APIs are designed specifically for application developers (API consumers) to programmatically interact with the Developer Portal. This API set exposes the core self-service functionalities that a developer would typically perform through the portal's user interface. These functions explicitly include registering new developer accounts, creating and managing client applications (which receive API keys), and creating subscriptions to associate those applications with specific API Products and Plans. The Developer Portal's front-end is a primary user of these backend Consumer APIs.

1. IBM API Connect v10.0.x Documentation

"Using the Consumer API": "The Consumer API allows application developers to complete tasks such as registering a new application

or subscribing to a Plan. The Consumer API provides programmatic access to the functions that are available in the Developer Portal." This source directly confirms that the Consumer API is used for application registration and subscription.

2. IBM API Connect v10.0.x Documentation

"Tutorial: Using the consumer API": This tutorial guides a user through the steps of using the Consumer API

which include: "Register a user in the Developer Portal

" "Create an application

" and "Create a subscription." This explicitly covers all three activities mentioned in the question.

3. IBM API Connect v10.0.x Documentation

"API Connect REST APIs": This section provides an overview of the different API sets. It distinguishes the Consumer API

which "provides programmatic access to the functions that are available in the Developer Portal

" from the Management API

which is used for "automating tasks that you can perform by using the API Manager user interface." This clarifies the distinct roles of each API set.

The IBM API Connect Developer Portal allows administrators to configure which file types can be uploaded. By default, the list of permitted file extensions for images includes several common formats. Among the options provided, both JPG (Joint Photographic Experts Group) and GIF (Graphics Interchange Format) are included in this default configuration, making them supported formats for use in portal content, theming, and branding.

1. IBM Documentation for API Connect v10.0.x: Configuring the file settings for the Developer Portal. This document specifies the default permitted file extensions. In the section describing the "Permitted file extensions" field

the default list is provided as: jpg jpeg gif png txt doc xls pdf ppt pps odt ods odp. This explicitly includes jpg and gif.

Source: IBM Documentation

API Connect Version 10.0.x

Administering the Developer Portal > Configuring the file settings for the Developer Portal.