An organization requires several APIs to be secured with OAuth 2.0, and PingFederate has been identified as the identity provider for API client…

When using an external identity provider (IdP) like PingFederate as a client provider in Anypoint Platform, the management of client applications (creation, credentials) is handled by the IdP. However, the process of granting a specific client application access to a specific API is managed within Anypoint Platform through contracts.

The standard self-service workflow requires the API consumer to first create their client application in PingFederate. They then navigate to Anypoint Exchange, find the desired API, and request access for their client application. This request is routed to the API administrator, who approves it in API Manager, creating a contract that links the external client application to the API instance.

A: Configuring the client discovery URL is a one-time administrative setup of the client provider, not a recurring step for each consumer's access request.

B: While an administrator can manually create contracts, this bypasses the standard and scalable self-service workflow where the consumer initiates the request.

D: Access to specific MuleSoft APIs is governed by contracts within Anypoint API Manager. The external IdP (PingFederate) manages client identity but does not manage access grants to individual MuleSoft APIs.

1. MuleSoft Documentation - Request Access to an API in Exchange: This document outlines the standard procedure for consumers. "From an API asset version details page, you can request access to an API... When you request access, you must select a client application to use to consume the API. After you submit the request, the API owner must approve it." This confirms the request/approval flow happens within Anypoint Platform (Exchange and API Manager).

Source: MuleSoft Docs, "Request Access to an API in Exchange", Section: "Request Access".

2. MuleSoft Documentation - External Client Providers: This documentation explains how client management is delegated. "When you configure an external client provider, you delegate client application registration and management to an external identity provider (IdP)... Developers can create client applications in the provider and then register them in Anypoint Platform." This clarifies that while the client is created externally, it must be known to Anypoint Platform to request access.

Source: MuleSoft Docs, "Client Management", Section: "External Client Providers".

3. MuleSoft Documentation - Contracts: The concept of contracts is central to API access control. "API Manager uses contracts to control which client applications can consume an API... A contract exists between a client application and an API." The approval process described in the correct answer is what creates this essential contract.

Source: MuleSoft Docs, "API Contracts", Section: "About Contracts".