Restrict API access to Postman or any other sender

[Eswark1]

Hi,

We developed API using Integration Suite, gave Production OAuth credentials to Calling system. 

They used the details and configured it in their Dev, QA, Mock and Production systems.

How do I restrict accessing the API based on the sender?, even Postman.

Otherwise, anyone with Credentials can access business data.

Thank you for your help.

[robertot4s]

Hi @Eswark1 ,

Yo can publish the API with API Management service and apply policies. For example, you can use different APIkeys for each sender and with the policy "Access Control" you can selectively allow or block an IP or group of IP.

Regards,

Roberto