When an API specification is published to Anypoint Exchange and secured (e.g., using a Client ID Enforcement policy), consumers cannot use it directly. The standard, platform-driven process to gain access is to find the API asset in Exchange and use the "Request access" button. This initiates a workflow where the consumer associates the request with a client application, and the API owner can then approve or reject the request. Once approved, the client application receives the necessary credentials to invoke the API.

B. Emailing owners is an out-of-band, informal process and not the standard, auditable procedure within Anypoint Platform for gaining API access.

C. Creating a client application is part of the access request process, but the primary action taken on the API's Exchange page is "Request access".

D. This is incorrect because the API requires client credentials, meaning access is restricted and requires explicit approval before it can be used.

1. MuleSoft Documentation, "Request Access to an API in Exchange". This guide explicitly states, "You can request access to an API version from its API portal in Anypoint Exchange." It details the process starting with the "Request access" button. (Anypoint Platform > Exchange > Consume Assets > Request Access to an API in Exchange).

2. MuleSoft Documentation, "Client Management". This document explains that "To call a protected API, you must first register your app... When you register your app, you get a client ID and client secret, which you must pass with every call to the API." This registration happens via the access request process. (Anypoint Platform > API Manager > Client Management).