The json-to-xml policy in the IBM DataPower API Gateway operates on an in-memory representation of JSON data, not on a raw JSON string or stream. The official IBM documentation explicitly states that the input for this policy must be parsed JSON. If the preceding policy in the assembly (such as an invoke policy) does not provide a parsed JSON object in the specified context variable (by default, message.body), a parse policy must be used beforehand to convert the raw JSON payload into the required parsed format. This ensures the json-to-xml policy can correctly traverse the JSON structure to perform the conversion to XML (specifically, JSONx).

1. IBM Documentation for API Connect Version 10.0.x: In the documentation for the json-to-xml assembly policy

the "Description" section states: "The input to the policy is read from the variable that is specified in the input-variable field

or from message.body if an input variable is not specified. The input must be parsed JSON."

Source: IBM. (2023). API Connect Version 10.0.x Documentation. Section: "API-defining and processing policies" -> "json-to-xml". (Direct link varies

but this path is consistent in the IBM Knowledge Center/Documentation).

In a multi-node Kubernetes cluster, IBM API Connect's management subsystem handles stateful operations, including OAuth token management. To ensure high availability (HA) and data consistency for these operations, the underlying distributed database (e.g., PostgreSQL) relies on a consensus algorithm. The core principle of these algorithms is quorum, which is the minimum number of server nodes that must be active and agree on an operation for it to be committed. This prevents data inconsistencies ("split-brain") and ensures that critical OAuth operations are reliably processed even if some nodes fail. The requirement for a minimum of three management nodes in an HA API Connect deployment directly reflects this principle.

1. Official Vendor Documentation: IBM API Connect v10.0.x Knowledge Center

"Management subsystem requirements". The documentation specifies

"For a production installation

a 3-node cluster is recommended for high availability." This three-node minimum is a standard architecture for establishing a quorum-based consensus system for the underlying data store that manages OAuth and other configuration data.

Source: IBM. (2023). Management subsystem requirements. IBM API Connect 10.0.x Documentation. Retrieved from www.ibm.com/docs/en/api-connect/10.0.x?topic=kubernetes-management-subsystem-requirements.

2. University Courseware/Academic Publication: The concept of quorum is fundamental to consensus algorithms like Raft

which are used in modern distributed systems. A leader can only append a new entry to the log once a majority of servers (a quorum) have responded

ensuring consistency.

Source: Ongaro

D.

& Ousterhout

J. (2014). In Search of an Understandable Consensus Algorithm. Proceedings of the 2014 USENIX Annual Technical Conference (USENIX ATC '14). Stanford University. (Section 3.2

"Leader election

" and Section 3.3

"Log replication

" describe the necessity of a majority/quorum for operations).

3. Official Vendor Documentation (Kubernetes): The official Kubernetes documentation on running stateful applications explains the challenges of managing distributed data stores. These systems

which would manage OAuth state

inherently rely on consensus and quorum to maintain a consistent state across replicas.

Source: Kubernetes Authors. (2023). Running Stateful Applications. Kubernetes Documentation. Retrieved from kubernetes.io/docs/tutorials/stateful-application/running-stateful-application/. (This document discusses the principles of stateful sets and persistent storage

which are prerequisites for building HA data services that use quorum).

In IBM API Connect, the @hide directive is the designated method for modifying a GraphQL schema to prevent specific fields or types from being exposed to the client. Applying this directive to a field in the schema definition ensures that it is omitted from the schema served by the API gateway. Consequently, the field will not appear in introspection queries and will be rejected by the validator if a client attempts to include it in a query, effectively hiding it.

1. IBM. (2023). Creating a GraphQL API proxy. IBM Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=apis-creating-graphql-proxy-api. In the section "Editing a GraphQL schema

" the documentation states: "You can use the @hide directive to remove types or fields from the schema."

2. IBM. (2023). GraphQL policies. IBM Documentation. Retrieved from https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=reference-graphql-policies. This page details the Redaction policy

explaining its function is to "Redact specified fields in the GraphQL response object

" which confirms it acts on the response data

not the schema definition for introspection.

Disabling the administrator login on the Developer Portal login page is a user interface configuration that removes the visible link for administrative access. This is often done to present a cleaner interface for API consumers. However, the underlying administrative login functionality is not removed. Administrators can still access the login page by navigating directly to a specific URL. The correct URL for this purpose is https:///user/login?registryurl=/admin, which bypasses the standard login page and presents the administrator-specific login prompt.

1. IBM API Connect v10.x Documentation

"Logging in as an administrator". This official documentation explicitly states: "If the administrator login link has been disabled on the Developer Portal login page

you can still log in as an administrator by navigating to the administrator login page... The URL for the administrator login page is https:///user/login?registryurl=/admin". (URL: https://www.ibm.com/docs/en/api-connect/10.0.5.x?topic=portal-logging-in-as-administrator)

The correct sequence follows the standard API lifecycle management process in IBM API Connect. First, an API must be created or defined. This API is then bundled into a Product, which acts as a container for one or more APIs intended for a specific use case. To make the Product available for consumption, it must be published to a Catalog. A consumer then registers an Application in the Developer Portal, which generates client credentials. Finally, this Application is subscribed to a plan within the published Product to gain access to the API.

1. IBM API Connect v10.x Documentation

"Tutorial: Importing and publishing your first API": This official tutorial outlines the initial steps of the provider workflow. It explicitly guides the user to first import an API definition

then add the API to a new Product

and finally publish that Product to a catalog. This confirms the first three steps in the sequence.

2. IBM API Connect v10.x Documentation

"Tutorial: Registering an application and subscribing to an API": This tutorial details the consumer workflow

which follows the provider actions. It instructs the user to first create an Application in the Developer Portal and then subscribe that application to the previously published Product to consume the API. This confirms the final two steps.

3. IBM API Connect v10.x Documentation

"Products": This section clarifies the relationship between APIs and Products

stating

"A Product is a group of APIs that is packaged together... You use Products to control which APIs are available to application developers." This supports the logic that an API must exist before it can be packaged into a Product.