IBM API Connect Governance turns security policy into machine-checkable rules. This walkthrough creates a custom OAuth2 ruleset, selects those rules in a validation scan, and runs them against an API so non-compliant definitions fail before publish.

If you opened API Connect v12 looking for Designer and the Assembly canvas, you are not alone. API Designer is deprecated and replaced by IBM API Studio — but assembly did not disappear. It became a named, versioned, reusable policy sequence.

Not every API call should cost the same against your quota. A lightweight create is different from a heavy update or a destructive delete — yet many teams apply a single flat rate limit at the gateway and wonder why burst traffic still overwhelms backends.

In IBM API Connect, you can define named assembly rate limits on an API plan and then consume the right limit at runtime based on a value from the request — in my case, the opname header. Here is the pattern I use.