You can associate a rate limit policy with any operation in an API group.

On the
API Groups
page, select the
API Groups
tab.
Click the
Actions
menu on the row of the API group and select
Edit API Group
.
On the
Policies
tab, click
Rate Limit
.
Select a rate limit for the managed API group. The organization level rate limit policy is applied to the managed API group by default.
Optionally, add user-level rate limit.
Click
Save
.

Create an IP filtering policy at the managed API group level.

On the
API Groups
page, select the
API Groups
tab.
Click the
Actions
menu on the row of the API group and select
Edit API Group
.
On the
Policies
tab, click
IP Filtering Rules
Add IP Filtering Rule.
.
Select to allow or deny a range of addresses, and then fill in the IP range.
Optionally, enter a description of the rule. Add additional rules as required to define the policy.
Click
Save
.

Enabling the API-level JSON web token authentication while creating an API group overrides all the operation-level authentications. You can't change the authentication type while creating a managed API group. After you activate the managed API with API-level JSON web token authentication, you can't remove the JSON web token authentication from that particular API group.

When you create or edit an API group or managed API group, you can enable OAuth 2.0 authentication at the API group level. You can then invoke the APIs in the managed API group with OAuth 2.0 or third-party authorization access tokens. When you enable API-level authentication for an API group, all the operation-level authentications are overridden. However, this behavior doesn't apply to custom API operations.