MuleSoft Flex Gateway is a self-managed API gateway that organizations deploy in their own infrastructure while using Anypoint Platform for centralized management and monitoring. In connected mode, Flex Gateway maintains a persistent connection to Anypoint Platform, which synchronizes API configurations, policies, and runtime settings automatically.

The Cequence Unified API Protection (UAP) platform's passive integration for MuleSoft Flex Gateway captures API traffic from Flex Gateway without modifying request or response payloads. A WebAssembly (WASM) policy, deployed to Flex Gateway through Anypoint Exchange, intercepts each request-response pair and forwards the transaction data to the Cequence proxy application. The proxy application authenticates with the Cequence UAP platform using OAuth2 and delivers the transaction to the UAP platform for analysis.

Traffic flow

The following sequence describes how traffic moves through the integration.

1. A client sends a request to an upstream service. Flex Gateway receives the request.
2. Flex Gateway forwards the request to the upstream service.
3. The upstream service returns a response. The WASM policy captures both the request and the response synchronously.
4. The downstream client receives the response from the upstream service.
5. The Cequence proxy application receives the captured payload, authenticates with the Cequence UAP platform using OAuth2, and forwards the transaction through Edge or Bridge.
6. Cequence Edge or Bridge processes the transaction data and makes the data available in the Cequence UAP platform dashboards.

Known limitations

Before you begin, note the following limitations of the Cequence UAP platform's passive integration with MuleSoft Flex Gateway.

• Request and response bodies that exceed 32 KB are truncated to 32 KB. The header cq-body-truncated: true is added to truncated transactions.
• Responses with HTTP status codes 500 and above are not captured. Only status codes 100 through 499 are forwarded to the Cequence UAP platform.
• Cequence passive policies compile into the WASM binary at deployment time. To change a policy configuration, you must rebuild and republish the policy to Anypoint Exchange.
• The Cequence proxy application must be deployed and running before you apply the WASM policy. The policy begins forwarding traffic immediately after the policy is applied.
• The gateway log level must be equal to or higher than the WASM policy log level. For example, when the WASM policy log level is set to INFO, set the gateway log level to INFO as well.
• When a payload uses content-encoding, Flex Gateway cannot log the payload. The Cequence proxy application receives a blank body when processing that transaction.

Before you start

Verify that your environment meets the following requirements before you begin the installation.

Generating a Cequence client ID and client secret

Several Cequence components must authenticate to the Cequence UAP platform to transmit and receive data. The following procedure creates the authentication credentials those components require.

1. Log in to the Cequence UAP management portal. The URL has the form https://ui.your-tenant-name.domain.
2. Navigate to General Settings > User Management. The User Management pane appears.
3. Select the Clients tab.
4. Select Add New Client. The new client dialog box appears.
5. In the Client Name field, enter a name for the client. This value becomes the client ID. Record the client ID for later use.
6. Enable the Traffic Management toggle.
7. Optional: To change the token lifespan from the default 1800 seconds, enter a value in the Token Lifespan field.
8. Select Save. A dialog box displays the client secret.
9. Select the copy icon to copy the secret to the clipboard, then select Close. The client list appears.

Record the client secret. For security reasons, the Cequence UAP platform does not display this value again.

Generating Anypoint credentials

The Cequence proxy application requires a Connected App with API Manager Environment Administrator scope to retrieve logs from Anypoint Monitoring. The following procedure creates a Connected App with the required permissions and produces the anypoint_client_id and anypoint_client_secret values used later in the proxy application configuration.

1. Log in to Anypoint Platform.
2. From the top-right menu, select Access Management.
3. In the left sidebar, select Connected Apps.
4. In the Owned Apps list, select the name of your Connected App.
5. On the Update App page, select App acts on its own behalf (client credentials).
6. Scroll to the Scopes section and select Add Scopes.
7. In the dialog, expand API Manager and select API Manager Environment Administrator.
8. Select Next.
9. Select your business group and the environment where your APIs are configured, then select Next.
10. Review the summary, then select Add Scopes to apply.
11. On the Update App page, select Save changes.

The client ID and client secret for this Connected App are the anypoint_client_id and anypoint_client_secret values used in the proxy application configuration.

Finding your Anypoint organization ID and environment ID

The proxy application configuration requires your Anypoint organization ID and environment ID. The following procedure retrieves both values from the Anypoint Platform URL.

1. Log in to Anypoint Platform.
2. From the top-right corner, select the gear icon, then select Access Management.
3. In the right panel, select Business group, then select your organization.
4. Select the Environments tab, then select your configured environment (for example, Sandbox, Prod, or Dev).
5. Examine the URL in your browser's address bar. The URL has the following form:
   https://anypoint.mulesoft.com/accounts/businessGroups/<organization-id>/environments/<environment-id>/edit
   Record the organization ID and environment ID segments from the URL.

Integration installation

Installing the Cequence passive integration for MuleSoft Flex Gateway involves three steps: deploying the Cequence proxy application to Anypoint CloudHub, publishing the Cequence passive WASM policy to Anypoint Exchange, and applying the policy to your APIs.

Deploying the Cequence proxy application

The Cequence proxy application receives transaction data from the WASM policy, authenticates with the Cequence UAP platform, and forwards the data for analysis. Deploy the proxy application to Anypoint CloudHub before applying the WASM policy.

1. Download the Cequence bundle as described in Before you start.
2. Extract the bundle:
   tar xvzf cequence-self-connected-flexgateway-passive.tar.gz
   The extracted directory contains the proxy application JAR file (cequence-api-proxy-1.0.4-mule-application.jar), a scripts folder, and a readme.md file.
3. Log in to MuleSoft Anypoint Platform.
4. From the menu bar, select Runtimes, then select Runtime Manager.
5. Select Applications > Deploy Application > Deployment Target (CloudHub 2.0).
6. Enter a name for the application, such as cequence-api-proxy, and select the Cequence API Proxy JAR file to upload.

7. In the Properties section, switch to Text View and enter the following properties, replacing the placeholder values with your own.

   cequence_transactions_endpoint_url=https://<edge-or-bridge-fqdn>/api-transactions
   cequence_client_id=<your-cequence-client-id>
   cequence_client_secret=<your-cequence-client-secret>
   cequence_auth_endpoint_url=https://<auth-fqdn>/auth/realms/example/protocol/openid-connect/token
   cequence_enable_auth=true
   cequence_log_level=WARN
   send_to_uap=true
   apis_to_include=all
   anypoint_client_id=<your-anypoint-client-id>
   anypoint_client_secret=<your-anypoint-client-secret>
   environment=<your-environment-id>
   organization=<your-organization-id>
   

   The following table describes each property.

   Property	Description
   cequence_transactions_endpoint_url	Fully qualified URL of the Cequence Edge or Bridge transaction endpoint.
   cequence_client_id	Cequence client ID generated in Generating a Cequence client ID and client secret.
   cequence_client_secret	Cequence client secret generated in Generating a Cequence client ID and client secret.
   cequence_auth_endpoint_url	Fully qualified domain name of the authentication endpoint in your Cequence UAP deployment.
   cequence_enable_auth	Enables authentication with the Cequence UAP platform. Set to true in all standard deployments.
   cequence_log_level	Log verbosity for the proxy application. Valid values: DEBUG, INFO, WARN. Recommended value for production: WARN.
   send_to_uap	When true, forwards transactions to the Cequence UAP platform. When false, processes transactions locally only, which is useful for debugging.
   apis_to_include	When set to all, the proxy application captures traffic from all APIs. To capture specific APIs, enter a comma-separated list of API instance IDs.
   anypoint_client_id	Anypoint Connected App client ID generated in Generating Anypoint credentials.
   anypoint_client_secret	Anypoint Connected App client secret generated in Generating Anypoint credentials.
   environment	Anypoint environment ID from Finding your Anypoint organization ID and environment ID.
   organization	Anypoint organization ID from Finding your Anypoint organization ID and environment ID.

8. Select Deploy Application. The JAR file uploads and the application deploys to the MuleSoft Runtime.
9. On the application page, verify that the Application Status field shows Running.

Publishing the Cequence passive policy to Anypoint Exchange

The Cequence WASM Deploy Kit includes a configure-and-publish script that patches your configuration values into the WASM binary and publishes the policy to Anypoint Exchange. Complete this step after the Cequence proxy application is running.

Step 1: Configure the deploy kit

From the extracted bundle, navigate to the deploy kit directory and create the configuration file from the provided template.

1. From the extracted bundle directory, navigate to the deploy kit:
   cd mulesoft_flexgateway_connected_mode_cequence_plugin/deploy-kit/
2. Create the configuration file from the template:
   cp env.template .env

Step 2: Edit the .env file

Open the .env file in a text editor and set the following values.

Do not modify the POLICY_VERSION variable unless Cequence instructs you to do so.

Step 3: Run the configure-and-publish script

From the deploy-kit directory, run the following commands to make the script executable and publish the policy.

chmod +x configure-and-publish.sh
./configure-and-publish.sh

The script patches your configuration values into the WASM binary and publishes the policy to Anypoint Exchange in two steps: definition, then implementation. On success, the terminal displays output similar to the following:

=== Done ===
  cequence-passive-policy v1.0.0
  cequence-passive-policy-flex-impl v1.0.0

Step 4: Verify that the policy is on Exchange

From the deploy-kit directory, run the following command to verify that both policy artifacts are present on Anypoint Exchange.

./configure-and-publish.sh --check

On success, the terminal displays output similar to the following:

cequence-passive-policy v1.0.1-1               EXISTS
cequence-passive-policy-flex-impl v1.0.0-1     EXISTS

Testing the integration

After deploying the proxy application and publishing the WASM policy, send test traffic through Flex Gateway and verify that transactions appear in the Cequence UAP platform. Because the WASM policy captures transactions synchronously, there may be a brief pipeline delay before events appear in the UAP dashboards.

1. Send a request to Flex Gateway using the base path and port configured for your API. For example:
   curl http://localhost:8081/<basepath>/<uri>
2. In the MuleSoft Anypoint portal, navigate to Runtime Manager and select the cequence-api-proxy application. From the left menu, select Logs and verify that no errors appear.
3. In the Cequence UAP platform, open the API Discovery dashboard and verify that the endpoint appears.

Disabling the integration

To disable the Cequence passive integration, remove the WASM policy from all APIs. In the MuleSoft Anypoint portal, navigate to API Manager > Automated Policies. Locate the Cequence passive policy, select the three-dot menu, and select Remove Policy.

Removing the integration

To remove the Cequence proxy application entirely, navigate to Runtime Manager in the MuleSoft Anypoint portal. Select the cequence-api-proxy application, then select Delete from the drop-down menu at the top right of the page.

Log levels

Two separate log level settings are available in this integration: one for the WASM policy and one for the proxy application. Both settings use the same set of values.

After setting cequence_log_level in the proxy application properties, enable the corresponding log level in the Anypoint dashboard to view the logs.

Troubleshooting

To monitor proxy application logs, navigate to the Anypoint Monitoring CloudHub settings page at https://anypoint.mulesoft.com/monitoring/#/settings/cloudhub. To gather detailed diagnostic output, set cequence_log_level to DEBUG in the proxy application properties.

Policy publish fails with HTTP 403

The Connected App used to publish the policy does not have Exchange Contributor permissions. Assign the Exchange Contributor role to the Connected App in Anypoint Platform, then run the configure-and-publish script again.

Transactions are not reaching the Cequence UAP platform

The Cequence client secret set in the proxy application properties and the client secret embedded in the WASM binary must match. If the values differ, the proxy application logs the message "Transaction was not processed." Republish the WASM policy with the correct CEQUENCE_CLIENT_SECRET value, and verify that the proxy application properties use the same value.

A policy update is not applied

Anypoint Exchange caches policy versions. Remove the existing policy from the API, then add the updated version. If the issue persists, verify that you incremented the CLIENT_TAG value in the .env file before republishing, because Exchange versions are immutable.