A regional transit agency sells partner access to a real-time arrival API on OCI API Gateway. Product wants per-second rates, monthly quotas, and a list of which deployments each subscriber may call, using a client token only for metering. What does a usage plan provide in this model?
Select an answer to reveal the explanation.
Short Explanation
A usage plan is like a library card that tracks how many books you may borrow per day—it meters and tiers access, but it is not your government ID. Entitlements set per-second rate, quota over a window, and which deployments a subscriber may call. Official guidance: those client tokens are for metering; you still need a separate authentication policy.
Full Explanation
A usage plan on OCI API Gateway packages how partners may call the API for product metering. Entitlements define per-second rate, quota over a time window, and which deployments each subscriber may access. Subscribers present a client token that the gateway uses for metering against those entitlements. For a regional transit agency selling partner access to real-time arrivals, that model separates commercial ceilings from identity: the plan tracks how much and where a partner may call, while authentication remains a distinct policy.
Treating a usage plan as a replacement for IAM policies and dynamic groups fails because metering is not authentication or tenancy authorization. An authorizer function that implements the entire business API confuses edge auth with the arrival back end. Oracle-managed Kafka bootstrap settings belong to Streaming stream pools, not to API Gateway usage plans for partner API access.
Exam caveat: official guidance is that usage-plan client tokens are for metering—not authentication or authorization. Always pair usage plans with a separate authentication policy on the deployment.
Operational check: create a subscriber with a tight entitlement rate and allowed deployment list, call with the client token under and over the rate, confirm metering enforcement, and verify that removing authentication still leaves the API improperly open even if the token is present.