What is true about where an API policy is defined in Anypoint Platform and how it is then applied to API instances?

API policies are defined and applied within Anypoint API Manager to govern specific API instances. An API instance represents a managed version of an API, often tied to a specific environment. This per-instance application allows architects to enforce different rules (e.g., stricter rate limiting in production versus development) for different deployments of the same API. The policy is configured in API Manager, and the corresponding Mule runtime, linked via API Autodiscovery to that specific API instance, downloads and enforces it. Policies are not defined in Runtime Manager, nor are they automatically applied to all instances across an organization or environment.

A. Policies are defined and applied in API Manager. Runtime Manager is used for deploying and managing the Mule application, not for defining API governance policies.

C. Policies are not automatically applied to all API instances. They must be explicitly configured for each specific API instance that requires governance.

D. Policies are applied on a per-API-instance basis, not automatically to all instances within a given environment, allowing for granular control over each API.

---

1. MuleSoft Documentation, "Apply Policies": This document explicitly states, "After you create an API in API Manager, you can apply policies to it." The procedural steps and screenshots clearly show the user selecting a specific API instance (API version) and then applying a policy directly to that single instance.

Reference Location: Anypoint Platform > API Manager > Policies > Apply Policies.

2. MuleSoft Documentation, "Policies Overview": This guide explains that policies are enforced at the API gateway level and are managed through API Manager. It describes the process as configuring policies for managed APIs.

Reference Location: Anypoint Platform > API Manager > Policies > Policies Overview.

3. MuleSoft Documentation, "API Autodiscovery": This document details how a deployed Mule application links to a specific API instance in API Manager using an autodiscovery element. This linkage is what enables the runtime to retrieve and enforce the policies applied to that specific instance.

Reference Location: Anypoint Platform > API Manager > API Autodiscovery.