WSO2 API manager data migration to 1.4.0 from 1.3.1

WSO2 API Manager is a complete solution for publishing APIs, creating and managing a developer community and for scalably routing API traffic. It leverages proven, production-ready, integration, security and governance components from the WSO2 Enterprise Service Bus, WSO2 Identity Server, and WSO2 Governance Registry. In addition, as it is also powered by the WSO2 Business Activity Monitor, the WSO2 API Manager is ready for massively scalable deployment immediately.

The Migration basically involves with the following steps.

1) First, run the APIM- 1.3.1 server and run the migration db scripts against to its DB. Depending on the DB that you have been using in APIM1.3.1 you have to choose the migration script. As I assume that you are using the mysql DB, you have run the mysql.sql migration script.

2) Once you have run the migration script without any error, you have to run the migration client as well (Its available at /dbscripts/migration-1.3.0_to_1.4.0/api_comments_ratings_migration_client folder). Go to that folder and follow instructions.

3) copy the synapse config folder from APIM 1.3.1 to 1.4.0. Copy content of /repository/deployment/server/synapse-configs to /repository/deployment/server/synapse-configs

4) Now you have successfully done the migration from APIM-1.3.1 to 1.4.0. Shut down the APIM 1.3.1 if running and start the APIM 1.4.0. 

You are done :)

What happen when token generation and token validation in WSO2 API manager

WSO2 API Manager is a complete solution for publishing APIs, creating and managing a developer community and for scalably routing API traffic. It leverages proven, production-ready, integration, security and governance components from the WSO2 Enterprise Service Bus, WSO2 Identity Server, and WSO2 Governance Registry. In addition, as it is also powered by the WSO2 Business Activity Monitor, the WSO2 API Manager is ready for massively scalable deployment immediately.

Token generation 

Token generation happens through token API. In older versions of API manager use /login for this. Now you can use /authorize or /token to do the same. 
When we generate user access token to access APIs we need to pass consumer key/secret pair and user credential (user-name and password).
As a part of user token generation process we can retrieve user claims associated with user(like email, address and etc). 
We can use this feature to get whatever additional information need. 
We can modify configurations and define claim name we need so we will get those claim values as headers of token generation response message.
Here i have described it in detail manner.
Please note that we are not generating JWT as part of token generation process. If you need to do it as a part of token generation then you need to add additional handler and implement JWT generation logic inside that handler. 


Token validation process while API invocation 

This happens when user calls API with access token(it could be user access token or application access token). 
In this call we will generate JWT as a part of validation process. 
Fields available inside JWT are hard coded at this moment and cannot add new fields by configuration. 
If you need to add new value to JWT then you can use API extension handler to do that. There also we need to write custom code in new handler to add new parameters to JWT.