--- schema_version: "1" id: 91b451de1cae942501df6050a1724d32906cd55080a029b2a2f8ce9a5a1277af title: Enhancing Security with Gatekeeper collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-gateway/mule-gateway-gatekeeper.md canonical_url: https://docs.mulesoft.com/mule-gateway/mule-gateway-gatekeeper source_site: docs.mulesoft.com content_type: documentation content_hash: 8d5a39866eca27b4031454cd0305e7da07ca8b5aa94b37f3ccbb8c5d048cb119 description: MuleSoft Documentation Site latest: true --- --- product: Mule Gateway keywords: runtime, gateway, gatekeeper, security, policy, policies --- # Enhancing Security with Gatekeeper > For the full documentation index, see: https://docs.mulesoft.com/llms.txt When you deploy an application, the tracked resources exposed by the application might become accessible for a short amount of time due to a lapse in security. Because the policies for those resources are not yet applied, the API might receive unwanted traffic. GateKeeper prevents this situation by blocking the tracked resource until all policies are retrieved and applied without errors. Starting with CloudHub 4.2.2, Mule runtime engine (Mule) keep APIs blocked until the contracts of the API are successfully downloaded from the Management plane in case the policy requires contracts and if Gatekeeper is enabled. Gatekeeper waits until contracts are available to unblock the API. In earlier versions of Mule, APIs were unblocked after the runtime successfully applied all the policies. For example, if the API had the Client ID Enforcement policy applied, a request with valid credentials was rejected. This CloudHub update behaves the same way with `strict` and `flexible` Gatekeeper modes. Contracts are considered available if they are downloaded from the Contracts Service before or after Mule is restarted. Out of the box policies that might require contracts include: - [Client ID Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-client-id-enforcement) - [Rate Limiting SLA Policy](https://docs.mulesoft.com/mule-gateway/policies-included-rate-limiting-sla) - [JWT Validation Policy](https://docs.mulesoft.com/mule-gateway/policies-included-jwt-validation) - [PingFederate OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-pingfederate-oauth-token-enforcement) - [OpenID Connect OAuth 2.0 Token Enforcement Policy](https://docs.mulesoft.com/mule-gateway/policies-included-openid-token-enforcement) - [Mule OAuth 2.0 Access Token Enforcement](https://docs.mulesoft.com/mule-gateway/policies-included-oauth-access-token-enforcement) ## How Gatekeeper Works The Gatekeeper mechanism is engaged only when you restart the runtime or redeploy a tracked resource that is linked with an API instance when automatically discovered. When Gatekeeper is engaged, each tracked resource is blocked, resulting in a `503 - Service Unavailable` HTTP status code, until all API instance policies are applied in API Manager without errors. Resources not linked to an API instance when automatically discovered are ignored by Gatekeeper. Additionally, you cannot apply any policies to these resources, and no analytics information is generated. If you lose connectivity after the Mule instance is restarted or the tracked Mule application is redeployed, you use cached policies, configuration, and contracts, even if Gatekeeper is not enabled. When Gatekeeper is engaged, if a tracked resource has a malformed or incorrectly defined policy applied, the tracked resource is blocked, resulting in a `503 - Service Unavailable` HTTP status code\`. The resource reamains blocked until the offending policy is removed from API Manager. Mule runtime caches all policies and active contracts locally. ## Security Levels To enable or disable Gatekeeper functionality, you can configure the following property with a specific security level: anypoint.platform.gatekeeper For example, to configure the `flexible` security level, you must specify the following property: anypoint.platform.gatekeeper=flexible - Valid Values for Mule 4 Security Levels - `strict` - `flexible` - `disabled` For Mule runtime versions 4.8.0 or later. Gatekeeper blocks requests when editing the policy configurations. The Gatekeeper does not block requests when editing policy order. To disable Gatekeeper during editing, set the `anypoint.platform.gatekeeper` property to `false`: anypoint.platform.gatekeeper.block\_edit=false ### Security Level Definitions You can apply `false`, `disabled`, `true`, `strict`, or `flexible` security levels to Gatekeeper, as explained in the following table:

Security level

Description

disabled

Gatekeeper does not apply any security. With this setting, the API might receive unwanted traffic during the period while the policies are being applied.

strict

Gatekeeper security is set to its maximum level. When the Mule instance is restarted, the API is blocked with a 503 error until policies for each tracked resource are correctly applied. If connectivity to Anypoint Platform is lost when Gatekeeper is engaged, the tracked resource is blocked until the connection is reestablished.

flexible

Gatekeeper security is set to intermediate level. When the Mule instance is restarted, the API is blocked with a 503 error. If the connectivity to Anypoint Platform is lost when Gatekeeper is engaged, local cache is used to apply the policies during the outage. If cache is unavailable, the tracked resource is blocked at least until the connection is reestablished. Available in Mule 4.1.0 or later.

### Default Gatekeeper Configuration The following table illustrates a Gatekeeper configuration with default values:

Runtime version

Default security level

4.0.0

Strict

4.1.0 and later

Flexible