Throttling Support at API Resource Level and http verb level in WSO2 API manager

We will add Throttling Support at API Resource Level in API manager 1.5.0 and onwards. Here is a brief description on what we have done here.In WSO2 API manager we have API level throttling support and application level throttling support. API level throttling can be defined when API creator creates the API and subscribers can select one of throttling tiers when they subscribe API under an Application. Application level throttling tier can be defined when you create applications. So all the APIs available in given application will be allowed up to application level throttling limit. With this new feature, Throttling Tier can be engaged to each resource at HTTP verb level. When adding an API, you can configure the Throttle Tier for each HTTP verb under each API resource. By default every HTTP verb will be assigned to Unlimited Tier.

Current functionality:

Now we do have throttling support at API level and application level. Consumer can select throttling tier for API when they subscribe to API, also they can define throttling tier when they create application(application is bundle of APIs). 

New Addition:

Support for providing throttling tier support for resource level and HTTP verb level.

Throttling tiers per resource and http verb level can be define when we create API like we add throttling tiers per API. So when subscribers going to subscribe to API they will notify throttling limits at resource level. see following sample.

API - testAPI (allow subscribers to select gold and unlimited).

/testAPI/1.0.0/. Subscribers can select this when they subscribe to API

    |---Resource - student/ 

         |--get - Bronze (define when we create api and subscribers cannot change this. But they will notify limits). 

         |--put -Silver (define when we create api and subscribers cannot change this.But they will notify limits). 

         |--delete - Bronze(define when we create api and subscribers cannot change this.But they will notify limits).

         

         

Our plan is to add this resource section of API create UI. 

So API publishers can select throttling tier when they create API and add resource level permissions to API.

Implementation:

Throttling key for this scenario will contain access_token + api +resource + http_verb combination. Throttling values once loaded will be cached for performance.

 

 

Below you can see the default Throttle tier selection. Using the drop down menu, Tiers can be changed.

 

 

 

 

 

 View Tiers from the Store
The Resource level throttling Tiers can be viewed by the API subscribers through the new available Tab
'Throttle Tiers'. It displays the throttle information for each HTTP verb, under each resource.

 

 

 

 

When an API is invoked, first it checks whether request is allowed by API level throttling limit. If it has
exceeded request will be terminated.
If it is allowed then it checks whether request is allowed by Application level throttling limit. If it has
exceeded request will be terminated.
If it is also allowed it checks whether request is allowed by Resource level throttling limit.
So if the request was allowed by API and Application level throttling limits, API can be invoked up to
the resource level throttling limit.