These configurations can be found from the sidebar menu, under Administration > Security Governance: Keyset policy templates and Subscriptions Lifecycle.

Keyset Management – Policy Templates

This section describes the administrative settings regarding the Keyset Management feature (if enabled – see chapter Stakeholder profiling and features, area Keys). Specifically, it focuses on the definition of Policy Templates which allow to broadly control the secure management of API access by ensuring that authentication keys follow specific rules and apply in specific conditions.

Policy templates are therefore the blueprint for the policies that apply to the keysets generated when new API subscriptions are made.

NOTE: When modifying a policy template, changes are not applied retroactively to existing keysets made by previous subscriptions. The policy of a keyset is evaluated again, and applied, when the key is regenerated. If you want to change the policy of an already made subscription, you can regenerate its key, or revoke the related subscription and create it anew.

Managing the conditions

The conditions for controlling when an API Policy Template is applied to a new Keyset depend on the following two settings:

• Authentication Type: this is the expected authentication type (API Key, Client Credentials…) of the APIs to which this policy template should apply, in conjunction with the Ruleset.

• Ruleset: this section allows the administrator to create multiple conditions that better define the scope of application of this policy template.

  • Each condition that is added extends the field of action (OR logic).

  • For each condition, you can set if the condition is based on the API's Tags or its Categories.

  • You can then decide if you want the selected Tags or Categories to be (or not to be) present for the Policy Template to apply.

  • The available operators are: Contains All, Not Contains All, Contains Any, Not Contains Any.

  • If no rule is defined, the template applies to every keyset of the selected authentication type.

NOTE: If multiple policy templates share the conditions for being applied to a new keyset, the most recently created one will take precedence (the higher one on the list).

Managing the rules

The possible Rules enforced by a Policy Template to the Keysets on which they have been applied are the following:

• Expiration Period: determines for how long the keyset will be valid (minimum 1 day; one month counts as 30 days).

• Rotation Frequency: determines how often the keyset will rotate. It can be set only if an Expiration Period is set, and the Expiration Period must be greater than the Rotation Frequency.

• Grace Period: is the difference between expiration and rotation. This is the period in which the key is still valid but should be changed with the more recent one.

• Max Simultaneous Keys: is the number of keys that can be valid at the same time.

  • SECURITY NOTE: It is recommended to configure expiration and rotation settings to prevent more than two simultaneous active keys. The Platform blocks settings that would keep more than two keys active at the same time.

• Credential Display Duration: determines whether and for how long the keyset will be retrievable from the Platform front-end. After this period the Platform will no longer allow users to retrieve the keys for their subscription.

• Manual Regeneration: determines whether the key can be regenerated manually by the users, without waiting for the grace period: the current key is revoked and a new one is generated.

HINT: Users can receive a reminder before the expiration and rotation of their keysets (by default 7 days before the rotation). See chapter Notifications.

Step by step instructions

Creating a policy template

Steps:

1. Navigate to Administration > Security Governance > Keyset policy template.

2. Click Add.

3. Complete the following fields:

   • Name (required): a meaningful and unique name. Cannot start with blank space.

   • Authentication Type (required): choose from the dropdown.

   • Description: minimum two characters. Cannot start with blank space.

4. Configure the Expiration Period:

   • enable or disable the setting;

   • enter a duration (minimum 1 day);

   • select a time unit (Days, Weeks, Months).

5. Configure the Rotation Frequency:

   • enable or disable the setting;

   • enter a duration (minimum 1 day);

   • select a time unit (Days, Weeks, Months).

6. If both expiration and rotation are enabled:

   • the Grace Period is automatically calculated as: Expiration Period − Rotation Frequency;

   • the Max Simultaneous Keys is calculated as: Expiration Period / Rotation Frequency.

7. (Optional) Set the Credential Display Duration.

8. (Optional) Enable Manual Regeneration by checking the corresponding box.

9. Define the Ruleset, clicking Add new rule for each condition:

   • select a Field (API Tags or API Categories);

   • choose a Function (Contains All, Not Contains All, Contains Any, Not Contains Any);

   • select one or more Values.

   • All rule fields must be completed; otherwise, saving will be disabled. The same rule cannot be added twice. Use Delete rule to remove a rule.

10. Click Save.

Editing a policy template

Steps:

1. Navigate to Administration > Security Governance > Keyset policy template.

2. Select the policy template to edit.

3. Modify the desired fields.

4. Click Save.

NOTE: The updated template applies to the keysets generated from now on. Existing keysets are not affected.

Deleting a policy template

Steps:

1. Navigate to Administration > Security Governance > Keyset policy template.

2. Select the policy template to delete.

3. Click Delete and confirm.

Subscriptions Lifecycle

Here you can configure the approval lifecycle for all API subscriptions. These settings will apply to any API that does not have its own approval settings, and can later be managed from each API's specific settings page (the Subscriptions Lifecycle tab of the API).

You can enable or disable two approval steps: Business Approval and Technical Approval, each in its own tab. Disabling both will let all new subscriptions be auto-approved.

For each enabled step, subscriptions will require a specific approval to move forward. Enabling a step will nonetheless let you choose if some stakeholders can skip the approval step, and therefore have their subscriptions be automatically approved.

IMPACTS: This setting impacts the Operating Model! Make sure that if you are changing this setting you have also set the Roles and Permissions of users accordingly. For example, if you are enabling an approval step, make sure there are users who have in their Role the permission to approve subscriptions in that step (see chapter Organizations and users).

NOTE: Changing this setting does not retroactively impact any existing subscriptions.

NOTE2: Changing the labels of these steps is not possible to the tenant owner. Please contact support to have the labels modified to your preference.

NOTE3: If client IP addresses are enabled in subscriptions (see chapter Stakeholder profiling and features, area Subscriptions), each new IP address is reviewed separately from the subscription, in the Network section of the Workspace.

Steps:

1. Navigate to Administration > Security Governance > Subscriptions Lifecycle.

2. Select the Approval step among those available (Business Approval or Technical Approval).

3. Enable or disable it to your preference with the Enable step switch.

4. When enabled you may choose to Permit automatic approval for selected subscribers. In this case you will be able to select the types of users to consider by selecting their Organization Types, Organization Categories, or the specific Organizations they belong to.

NOTE: Each change is saved as soon as you use a switch or change a selection: there is no separate Save button. While a change is being saved, the switches and the tabs are temporarily locked.