A municipal 311 API needs new custom authentication that inspects several request headers and a query parameter. The team is wiring an OCI Functions authorizer to API Gateway. Which authorizer shape should they choose for a new implementation?
Select an answer to reveal the explanation.
Short Explanation
Picture a night watchman who can check badge, clipboard, and guest list at once instead of only one badge. Oracle’s recommended custom path is a multi-argument authorizer that can read several request elements. Single-argument authorizers still work but are the older form headed for deprecation—new custom auth should be multi-argument.
Full Explanation
For new custom authentication on OCI API Gateway that must inspect several request headers plus a query parameter, implement a multi-argument authorizer function. Multi-argument authorizers can accept multiple request elements—headers, query parameters, host, and related attributes—in one authentication call. That shape matches a municipal 311 API that combines several pieces of request evidence before allowing access. Oracle’s guidance for new work is the multi-argument form; a multi-argument authorizer can still accept a single header token when that is all a route needs, so you do not lose simpler cases by choosing the modern shape.
Designing new work around a single-argument authorizer fails because that older form is limited to one token-style input and is on a deprecation path—acceptable for legacy, wrong as the preferred new implementation. Treating a usage-plan entitlement as the authentication authorizer confuses metering and subscriber ceilings with authentication; entitlements do not replace an authorizer. Wiring a Kafka consumer group on OCI Streaming to validate tokens before Functions is an unrelated messaging pattern and does not implement API Gateway’s authorizer contract.
Exam caveat: single-argument authorizers may still appear in existing deployments, but exam and greenfield answers should favor multi-argument authorizers for custom auth.
Operational check: deploy a multi-argument authorizer that reads the documented headers and query parameter, call the route with complete and partial inputs, and confirm authentication results and scopes change only when the full municipal combination succeeds.