Requirement Analysis: The security team requires any external API call to be restricted by an IP include list. This ensures that only specified IP addresses can access the third-party API.

Design Plan: To fulfill this requirement, implementing a proxy for the third-party API is the best approach. This proxy can enforce the IP include list policy.

Implementation Steps:

Create a Proxy API: Set up a new API proxy in Anypoint Platform to act as an intermediary for the third-party API.

Configure IP Include List Policy: Within the Anypoint API Manager, apply the IP whitelist policy to the proxy API. This policy will ensure that only requests from specified IP addresses are allowed to reach the third-party API.

Modify Main API Flow: Update the flow of your main API to call the newly created proxy API instead of directly calling the third-party API.

Testing: Conduct thorough testing to ensure that the proxy API correctly forwards requests to the third-party API only if the requests originate from IPs in the include list.

Advantages:

Security: This method ensures that only approved IPs can access the third-party API, adhering to the security team's requirements.

Manageability: Centralizes the IP restriction management within the API Manager, simplifying maintenance and updates.

References

MuleSoft Documentation on API Proxies

MuleSoft Documentation on IP Whitelist Policy