Organizational access policies are rules that the organization creates to enforce security and access rules on all managed APIs and custom APIs. The organization can enforce IP filtering access policies and determine the rate at which API requests can be made.

The IP filtering policy designates the range of computer IP addresses that are allowed to invoke or are denied permission to invoke APIs. The rate limiting policy controls the number of times any API can be invoked during a designated time period. Rate limit tiers determine the number of times that users can invoke the API during the designated time period.

The organizational rate limit policy controls the number of times API consumers in the organization can invoke an API during a designated time period. An organizational rate limit policy is assigned by default to all the APIs in the organization that are managed by

API Manager

. You can edit the default organizational rate limit policy.

In the

Access

tab of the

Policies

page, you can change the default rate limit policy settings, and add, edit, or delete an IP filtering policy. IP filtering policies are applied according to the order of the policies. The order of the policy determines its precedence.

You can also create rate limit policies and IP filtering policies for specific APIs and for API groups. API-specific rate limit and IP filtering policies override both the organizational and the group policies. API group rate policies override the organizational policies. For more information about API-specific policies, see API-specific policies. For information about group policies, see Group rate limit policy.

When an API consumer attempts to access an API and access is denied due to an IP filtering policy, the HTTP response includes a

403 Forbidden

status code and the description

Invocation is prohibited due to organization policies

.

When an API consumer is denied access due to a rate limit policy, the HTTP response includes a

429 Too Many Requests

status code and the description

API rate limit reached

.

When an API consumer attempts to access an API and is denied due to a rate limit policy or an IP filtering policy, API Manager logs an event in the event log. For more information about the event log, see Event log.