---
schema_version: "1"
id: fdefce408063626317e3767154ea6a15e0238a7635a00ea3fd364b9a0da64fd7
title: Allow Addresses for API Platform Proxies
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/3.2/config-add-proxy-allowlist.md
canonical_url: https://docs.mulesoft.com/private-cloud/3.2/config-add-proxy-allowlist
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 21fbb4bc0cb2f102ff85d7deb5ddb7a26ddb5f18fc8ea1d17979fb845ac67752
description: MuleSoft Documentation Site
release: "3.2"
latest: false
---
---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Allow Addresses for API Platform Proxies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

By default, proxy requests are enabled for the domain name where the platform runs.

> [!NOTE] For versions 3.2.2 and later, refer to Trusted Domains.

To allow addresses in versions 3.2.0 and 3.2.1:

1.  Log in to Ops Center and select **Kubernetes** on the left side-bar.

2.  Select the `api-manager` namespace from the drop-down menu on the top, and then select
    **Configmaps**. Find the `api-platform-web-env` configmap and then click on `Edit Config Map`.

3.  Select the **APW\_FEATURES\_PROXYWHITELIST** tab and ensure that value is set to `true`. (You’ll
    have to hover your mouse over the tabs to get a tooltip with the full name to find the right
    tab)

    If not, set it to `true` and then select `Apply`.

4.  Select the **APW\_PROXYWHITELIST\_RULES** tab.

5.  Write your rules separated by commas.

    The following example defines regular expressions that allow requests to be made to the
    `**.somewhere.com/**` and `**.somewhereelse.com/**` domains, where `*` is any part of a DNS name
    or URL:

.\*\\.somewhere\\.com,.\*\\.somewhereelse\\.com

1.  Select **Apply** to save changes to the `api-platform-web-env` config map.

2.  Re-create the pods to ensure that each node in the cluster uses the most recent configuration:

    kubectl delete pod -n api-manager -l component=api-platform-web

## Trusted Domains

Every HTTP request you make to an external resource goes through the API Console Proxy. For security
reasons, you must register the domain as an allowed domain in Anypoint Platform.

By default, proxy requests are blocked for external domains on authenticated requests.

To add a new domain:

1.  Log in to Anypoint Platform using an account that has the Organization Administrator permission.

2.  In the navigation bar, click **Access Management**.

3.  Click **Trusted domains**.

4.  Click **Add domain**.

    The domain must not match an existing domain, must not be a domain or subdomain of MuleSoft or
    Anypoint Platform, and must be written in the format `exampledomain.com`. NOTE: Regular
    expressions are not supported.

5.  Type the domain name and click **Add domain**.

    The domain is added to your list of trusted domains. You are redirected to the trusted domains
    page, where you can edit or delete your domains. If you register a domain on a parent
    organization, the domain is allowlisted for all of your business groups.

## Authentication

When using the proxy, there are two authentication modes:

- Strict Authentication:

  (Default) All requests that reach the proxy must be authenticated, which means that user token
  credentials must be included in the `ms-authorization` header of the request.

  > [!WARNING] If requests to external domains from the Exchange Public Portals go through the API
  > Console Proxy, they fail because no Anypoint user is involved in the call.

- Non-Strict Authentication:

  API Console Proxy continues to be unauthenticated but it allows unauthenticated requests. The
  incoming request must provide either the user’s token or a reference to the Organization ID that
  the request belongs to. The Organization ID must be sent on the `ms-organization-id` header.

To change the authentication method from strict to non-strict, follow these steps:

1.  Log in to Ops Center and select **Kubernetes** on the left side-bar.

2.  Select the `api-console-proxy` namespace from the drop-down menu on the top, and select
    **Configmaps**.

3.  Locate the `service-env` configmap and then click on **Edit Config Map**.

4.  Select the **STRICT\_AUTHENTICATION\_FF** tab and ensure that the value is set to `false`. (To
    find the right tab, hover your mouse over the tabs to get a tooltip with the full name.)

5.  Click **Apply** to save changes to the `service-env` config map.

6.  Recreate the pods to ensure that each node in the cluster uses the most recent configuration:

    kubectl delete pod -n api-console-proxy -l component=service