---
schema_version: "1"
id: 40800b9e98c709c5ffe749380b134bd29265d79be898ef30cae3f2f904983799
title: Gateway Policies in API Manager
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-manager/latest/manage-policies-overview.md
canonical_url: https://docs.mulesoft.com/api-manager/latest/manage-policies-overview
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 6ebeaf19b1e4abac884d3d096aafc5961a64d675d1aeebf3912809f9b9386a8f
description: MuleSoft Documentation Site
release: 2.x
latest: true
---
---
product: API Manager
version: 2.x
is-latest-version: true
---

# Gateway Policies in API Manager

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

From API Manager, you can apply policies to APIs in Omni Gateway Connected Mode or Mule Gateway.

Policies enable you to enforce regulations to help manage security, control traffic, and improve
adaptability of your APIs. For example, a policy can control authentication, access, allotted
consumption, and service level access (SLA). You can implement these regulations with no
modification to the code implementation.

Policies are available based on the API type and the gateway where the API instance is deployed.

To find the policies available for your gateway, see
[Policy Availability by Gateway](https://docs.mulesoft.com/gateway-home/#policy-availability-by-gateway).

For more information about specific policies and how to apply them, see:

- [Securing Omni Gateway Instances with Policies](https://docs.mulesoft.com/gateway/latest/gateway-secure-apis)

- [Mule Gateway Policies Overview](https://docs.mulesoft.com/mule-gateway/policies-policy-overview)

## Use Stored Secrets for Sensitive Policy Fields

When you apply a policy to an Omni Gateway API instance, sensitive fields (such as passwords and
keys) offer two options:

- **Enter value**: Type the value directly in the field.

- **Use a stored secret**: Reference a blob secret stored in Anypoint Security Secrets Manager
  (CSM).

To use a stored secret, the secret must:

- Be of type **Blob**.

- Belong to a **Downloadable Secret Group**.

Select the secret group from the first dropdown, then select the specific secret from the second
dropdown.

> [!NOTE] If you update the secret value in an external vault, the runtime picks up the change
> automatically. If you update the secret value directly in Secrets Manager (not in an external
> vault), you must redeploy the API instance manually for the change to take effect.

For information about creating secret groups and blob secrets, see
[Create a Secret Group](https://docs.mulesoft.com/anypoint-security/asm-secret-group-creation-task).