MuleSoft SLA Tiers and Rate Limiting

SLA (Service Level Agreement) Tiers let you define different usage plans for different categories of API consumers. A free tier might allow 10 requests per minute. A paid professional tier might allow 1,000 per minute. A premium enterprise tier might allow unlimited calls. SLA Tiers give you business control over API access while Rate Limiting enforces the technical limits.

What Are SLA Tiers

An SLA Tier is a named usage plan with defined limits. When a consumer registers an application in Exchange, they select a tier. API Manager enforces the limits of that tier automatically. You can create as many tiers as your business model requires.

SLA Tier Example: API Marketplace Model

API: Orders API v1

SLA Tiers:
┌──────────────┬────────────┬──────────────┬──────────────┐
│ Tier Name    │ Req/Minute │ Req/Day      │ Auto-Approve │
├──────────────┼────────────┼──────────────┼──────────────┤
│ Free         │     10     │    1,000     │    YES       │
│ Standard     │    100     │   50,000     │    YES       │
│ Professional │    500     │  200,000     │    NO        │
│ Enterprise   │  Unlimited │  Unlimited   │    NO        │
└──────────────┴────────────┴──────────────┴──────────────┘

Auto-Approve = YES: Consumer gets access immediately on registration.
Auto-Approve = NO:  API owner must manually approve the request.

Creating SLA Tiers in API Manager

Open API Manager and select your API instance
Click SLA Tiers in the left navigation
Click Add SLA Tier
Enter the tier name: Standard
Set limits:
- Maximum Requests: 100
- Time Period: 1
- Time Unit: Minute
Set Auto-Approve: Yes for free tiers, No for paid tiers
Click Add
Repeat for each tier

Linking SLA Tiers to Rate Limiting Policy

SLA Tiers only enforce limits when the Rate Limiting - SLA based policy is applied. Add this policy to connect the tier definitions to actual enforcement.

SLA-Based Rate Limiting Policy Config

Policy: Rate Limiting - SLA Based
  Client ID Expression:     #[attributes.headers.'client_id']
  Client Secret Expression: #[attributes.headers.'client_secret']

Behavior:
  When a client registers using the "Standard" SLA tier:
    → Policy allows 100 requests per minute for that client_id
  When a client registers using the "Free" SLA tier:
    → Policy allows 10 requests per minute for that client_id
  When the limit is exceeded:
    → HTTP 429 Too Many Requests
    → Response header: X-RateLimit-Remaining: 0

How Consumers Select an SLA Tier

When a developer registers their application through Anypoint Exchange, they see the available SLA tiers with their limits. The consumer selects the tier that fits their needs. For tiers with Auto-Approve disabled, the API owner receives a notification and manually approves or rejects the request from API Manager.

Consumer Registration with Tier Selection

Exchange Registration Screen:
  Application Name: "Partner Dashboard"
  Description:      "Partner-facing order tracking dashboard"
  
  Select SLA Tier:
    ○ Free         (10 req/min)    Auto-approved
    ○ Standard     (100 req/min)   Auto-approved
    ● Professional (500 req/min)   Requires approval  ← selected
    ○ Enterprise   (Unlimited)     Requires approval

  [Request Access] button
  
  → Email sent to API owner for approval
  → Consumer notified when approved/rejected

Upgrading and Downgrading Tiers

Consumers can request a tier change from the Exchange portal. An upgrade (Free to Standard) may auto-approve depending on the target tier's setting. A downgrade always applies immediately. API Manager updates the rate limit enforcement for that client ID without any redeployment.

Rate Limiting Headers in Responses

When rate limiting is active, the API Gateway adds informational headers to every response so consumers can track their usage programmatically.

Rate Limit Response Headers

Response from API when within limit:
  HTTP/1.1 200 OK
  X-RateLimit-Limit:     100
  X-RateLimit-Remaining: 73
  X-RateLimit-Reset:     1705315260  (Unix timestamp when counter resets)

Response when limit exceeded:
  HTTP/1.1 429 Too Many Requests
  X-RateLimit-Limit:     100
  X-RateLimit-Remaining: 0
  X-RateLimit-Reset:     1705315260
  Retry-After:           23  (seconds until the window resets)
  Body: {"error": "Rate limit exceeded. Try again after 23 seconds."}

Monitoring SLA Usage in API Manager

The Analytics section of API Manager shows consumption by SLA tier. You can see how many clients are on each tier, how close each tier's average consumer is to its limit, and which clients are consistently hitting their limits (a signal they need a higher tier).

SLA Analytics Dashboard

SLA Tier Usage Report:
  Tier: Free (10 req/min)
    Registered Clients: 45
    Avg Usage: 3 req/min (30% of limit)
    Clients Near Limit: 2
  
  Tier: Standard (100 req/min)
    Registered Clients: 18
    Avg Usage: 62 req/min (62% of limit)
    Clients Near Limit: 4

  Tier: Professional (500 req/min)
    Registered Clients: 3
    Avg Usage: 210 req/min (42% of limit)
    Clients Near Limit: 0

SLA Tiers and Business Model

SLA Tiers enable API monetization. Your development team defines the technical limits. Your business team sets prices per tier. Free tiers attract developers who want to experiment. Paid tiers generate revenue from serious consumers. Enterprise tiers with dedicated SLAs and custom limits serve your largest customers. This model — popularized by companies like Stripe and Twilio — is called API-as-a-Product.

Combining SLA Tiers with Other Controls

SLA Tiers control the rate limit. Layer other policies on top for complete access control. A Professional tier client still fails if they send an invalid payload (JSON Threat Protection rejects it) or call an endpoint they are not authorized for (OAuth scope enforcement rejects it). Rate limiting and SLA Tiers control quantity. Other policies control quality and authorization.

Previous lesson

Back to course

Next lesson