Now that you have the security schemes for client_id and client_secret, it is time to use them in your API’s Security. You will remember from our earlier discussion that Security Scheme creation and security enforcement are separate steps. Security scheme creation is followed by the security enforcement step. In the previous step, you created the security scheme. Now you will apply that scheme to your API’s security.
- Go to the Design tab | General | Security | clientID. On the Security Requirements screen, select the clientSecret scheme. Click the Submit button.
- Go to Paths in the navigation pane. Designer has a default Path (/) definition created. You will be modifying this default definition.
- Click on / under Paths. Click on the Update button. Change Path to /Patient and click Save. Refer to Figure 4.12. This path will be appended to the Base path defined in the earlier step (refer to Table 4.2), for example, the URL for invoking this API will be https://localhost:9444/localtest/sandbox/fhir/Patient.
Figure 4.12 – Setting Path
4. Delete all Operations except GET.
5. Click the Save button.
6. Locate and choose the Gateway tab. You will notice an invoke policy as shown in Figure 4.13:
Figure 4.13 – An Invoke policy in the Gateway Policies
The invoke policy instructs APIC to proxy the API to the endpoint you provided earlier (https://stu3.test.pyrohealth.net/fhir/Patient/d75f81b6-66bc-4fc8-b2b4-0d193a1a92e0).
Congratulations! You have just created an API Proxy that has been deployed for testing.
Now that you have created your first API Proxy on APIC, it is time to run some tests and see this API Proxy in action.
Testing APIs
There are multiple methods to test an API Proxy. You can either use external tools such as Postman, cURL, or SoapUI, or you can use the test capability provided by the APIC platform. You will learn how to use the test facility in APIC so that you can understand the test suite capabilities of the APIC platform.
Testing Note
A more comprehensive testing facility will be introduced in Chapter 13, Using Test and Monitor for Unit Tests, where you can build unit tests that can be executed in your DevOps pipelines.
Before you can test your API, it needs to be put online. To put your API online, simply click on the Test tab as shown in Figure 4.14:
Figure 4.14 – Using the built-in test feature
You will notice in Figure 4.14 that the GET operation you created is already displayed. Some other interesting points in the URI are as follows:
- localtest in the URI is the organization name.
- sandbox in the URI is the catalog environment where the API was deployed.
- The base path you defined earlier is also in the URI followed by the REST target.
Other features you will see are the headers that are already available. The generated client id and client secret that were provided when you started the LTE are automatically inserted. The APIm-Debug header is set to provide you with detailed debugging information.