sap-api-policylisted
Install: claude install-skill williamcorrea23/sap-router-skill
# SAP API Policy — API Management & Governance
## 1. Architecture
```
Client → API Gateway (SAP API Management)
├─ Security: OAuth2, API Key, Basic Auth
├─ Traffic: Rate Limit, Spike Arrest, Caching
├─ Mediation: JSON↔XML, XSLT, URL Rewrite
└─ Monitoring: Analytics, Alerts
```
## 2. Security Policies
```xml
<!-- OAuth2: validate XSUAA token -->
<OAuthV2 async="false" continueOnError="false" enabled="true">
<ExternalAuthorization>false</ExternalAuthorization>
<Operation>VerifyAccessToken</Operation>
<SupportedGrantTypes>
<GrantType>client_credentials</GrantType>
</SupportedGrantTypes>
</OAuthV2>
<!-- JSON Threat Protection -->
<JSONThreatProtection>
<ArrayElementCount>100</ArrayElementCount>
<ContainerDepth>10</ContainerDepth>
<StringValueLength>50000</StringValueLength>
</JSONThreatProtection>
```
## 3. Traffic Management
```xml
<!-- Spike Arrest: 100 req/s -->
<SpikeArrest><Rate>100ps</Rate>
<Identifier ref="request.header.X-Forwarded-For"/></SpikeArrest>
<!-- Monthly Quota: 10K requests -->
<Quota type="calendar"><Allow count="10000"/>
<Interval>1</Interval><TimeUnit>month</TimeUnit>
<Distributed>true</Distributed></Quota>
```
## 4. Mediation & URL Rewrite
```xml
<!-- Rewrite OData path + inject client -->
<AssignMessage>
<Set><Path>/sap/opu/odata/sap/ZMATERIAL_SRV/</Path>
<QueryParams><QueryParam name="sap-client">100</QueryParam></QueryParams>
</Set>
</AssignMessa