TIBCO API Management 2 — Questions and Answers
Question 1: In TIBCO Mashery, what is the purpose of an API Package?
- A container grouping one or more API Plans for developer subscription (Correct answer)
- A ZIP archive of API source code
- A Docker container for deploying APIs
- A SOAP-based API definition file
Correct answer: A container grouping one or more API Plans for developer subscription
In TIBCO Mashery an API Package bundles one or more Plans together so developers can subscribe to a set of API capabilities under defined terms.
TIBCO Mashery organises APIs into Packages and Plans. A Package acts as the top-level container that groups related Plans. Each Plan specifies rate limits, allowed endpoints, and access policies. Developers browse Packages in the developer portal and subscribe to a Plan within the Package, receiving API keys. This two-tier hierarchy lets API product managers offer different tiers (free, paid, enterprise) from the same underlying API service.
Question 2: Which TIBCO product provides a cloud-native API gateway with policy-based traffic management?
- TIBCO Cloud API Management (Correct answer)
- TIBCO ActiveMatrix BusinessWorks
- TIBCO EBX
- TIBCO Spotfire
Correct answer: TIBCO Cloud API Management
TIBCO Cloud API Management (formerly Mashery) is the cloud-native gateway offering traffic management, security policies, and developer portal capabilities.
TIBCO Cloud API Management is the SaaS evolution of TIBCO Mashery. It provides a policy engine for rate limiting, OAuth 2.0, key validation, threat protection, and transformation. Traffic management policies such as quota enforcement and spike arrest are applied inline at the gateway. The product also ships a developer portal so external consumers can discover, try, and subscribe to APIs without contacting the API team directly.
Question 3: What does the Interactive Docs feature in TIBCO Mashery enable?
- Live API testing from the browser using the subscriber's API key (Correct answer)
- Automatic API code generation in Java
- Real-time log streaming from backend services
- Visual drag-and-drop API composition
Correct answer: Live API testing from the browser using the subscriber's API key
Interactive Docs (I/O Docs) lets developers make live REST calls from the portal browser UI using their provisioned API key to see real responses.
Mashery's I/O Docs feature renders an interactive API console inside the developer portal. When a developer has an active API key, they can fill in endpoint parameters directly in the browser and execute live HTTP calls. The actual response, headers, and status codes are displayed in-line. This reduces the friction of getting started because developers can validate integration before writing any code.
Question 4: In TIBCO API Management, what is a Service definition used for?
- Describing the backend endpoint and HTTP settings the gateway forwards requests to (Correct answer)
- Defining a database schema for API data
- Creating a BPMN workflow for API orchestration
- Generating client SDKs automatically
Correct answer: Describing the backend endpoint and HTTP settings the gateway forwards requests to
A Service in Mashery defines the backend target — base URL, HTTP method rules, and transformation settings — to which the gateway proxies incoming calls.
In TIBCO Mashery, a Service represents a logical grouping of API endpoints that share a common backend origin. Each Service holds configuration such as the outbound host, port, connection timeout, and SSL settings. When the gateway receives a request matching an endpoint's inbound path, it proxies the call to the backend URL specified in the Service definition. Services are then associated with Plans within Packages so the gateway knows which policies apply.
Question 5: Which OAuth 2.0 grant type is most appropriate for a server-side web application using TIBCO API Management?
- Authorization Code (Correct answer)
- Implicit
- Resource Owner Password
- Client Credentials
Correct answer: Authorization Code
The Authorization Code grant type is designed for server-side applications because the access token is exchanged server-to-server, never exposed in the browser.
In the Authorization Code flow, the user authenticates at the authorization server and receives a short-lived authorization code via redirect. The server-side application then exchanges this code for an access token through a back-channel call, keeping the token off the browser. TIBCO API Management supports this flow natively. For purely machine-to-machine scenarios Client Credentials would be used, while Implicit (now deprecated) was used for single-page apps before PKCE became standard.
Question 6: What is the role of a Key Manager in TIBCO Mashery's architecture?
- Validating API keys and managing their lifecycle including creation, suspension, and deletion (Correct answer)
- Encrypting data at rest in the backend database
- Managing SSL certificates for HTTPS endpoints
- Generating JSON Web Tokens for all service calls
Correct answer: Validating API keys and managing their lifecycle including creation, suspension, and deletion
The Key Manager component handles the full lifecycle of API keys — provisioning them for developer applications, validating inbound keys on each request, and enforcing suspension or deletion.
TIBCO Mashery's Key Manager is a core runtime component that sits in the gateway request path. When a developer registers an application, the Key Manager generates an API key and optionally a secret. On every inbound API call the gateway invokes the Key Manager to verify the key's validity, check whether it is active or suspended, and confirm the allowed endpoint. It also records usage metrics against each key for quota and rate-limit enforcement.
TIBCO API Management 2
In TIBCO Mashery, what is the purpose of an API Package?