---
schema_version: "1"
id: 3d40a8e3c5b07d3415a04e3814cd3a0ee700b9c1aded1ff945f5b18445d612da
title: Resource-Level Policies
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-gateway/policies-resource-level-overview.md
canonical_url: https://docs.mulesoft.com/mule-gateway/policies-resource-level-overview
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 54ffe4b64fd7b4a7c6271798209d19436ff2136e565e0a2c4b501547d60aaebe
description: MuleSoft Documentation Site
latest: true
---
---
product: Mule Gateway
keywords: policy, custom, ootb, offline, resource level
---

# Resource-Level Policies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Unless otherwise configured, policies are by default applied to the entire API. However, you can
implement an additional level of policy granularity, one in which access is controlled based on a
criteria. Policies with this granularity are called _resource-level policies_.

At the resource level of granularity, policies are applied to only those requests that match the
criteria. All policies, except the Cross-Origin Resource Sharing (CORS) policy, are resource-level.

In Mule 4, resource-level policies support HTTP-based APIs in addition to RAML APIs. You can apply
multiple conditions to filter your resources and HTTP methods using the
[URI template regex](https://docs.mulesoft.com/mule-gateway/policies-resource-level-config-uri-regex) to any number of methods in your API.

## Usage Scenarios for Implementing Resource-Level Policies

You can use resource-level policies in many ways. Here are just a few:

- Apply policies to specific resources.

- Secure a subset of an API.

- Set different limits on resources.

If you have a RAML or OAS specification attached to your API, you can use the **Preview Resource
Matching** option to determine which resources are affected by your filters:

![API requests related to user permissions and the corresponding HTTP methods allowed for each](/mulesoft/current/en-us/mule-gateway/_images/users-api-cropped.png)

A resource-level policy supports Java regular expressions. For example, you can use a wildcard to
apply a policy to multiple resources. When you apply the policy to the API, specify the resources to
which it applies.

## Guidelines for Implementing Resource-Level Policies

When implementing resource-level policies:

- Do not use a placeholder, such as {userid}, in the regular expression.

  Using a placeholder in an expression fails because the placeholder does not match the actual node.
  In the example placeholder {userid}, the node looks something like this:

  `/api/users/671962fc-f076-4b19-bc38-45ba3a4e4095/permissions/1234`

  671962fc-f076-4b19-bc38-45ba3a4e4095 is the user ID.

  1234 is the ID of a permission.

To apply a policy to resource `/api/users/{userid}` that represents a single user and all resource
nodes, use the following expression:

The `userid` represents a single user and all resource nodes: `/api/users/.*`

To apply a policy to only the permissions resources `/api/users/{userId/permissions}` and
`/api/users/{userid}/permissions/{permissionId}`, use the following expression:

`/api/users/.**/permissions.**`

## See Also

- [Configure URI Template Regex](https://docs.mulesoft.com/mule-gateway/policies-resource-level-config-uri-regex)

- [Disable Outbound Policies](https://docs.mulesoft.com/mule-gateway/policies-resource-level-disable-outbound)