API Policy Enforcement Patterns

Three deployment patterns showing how API Manager policies are enforced for a Mule API, an API proxy, and Flex Gateway connected mode.

Mule API with API Gateway

The API Manager instance attaches policies that are enforced by API Gateway embedded in the runtime of the Mule application.

Mule API with API GatewayThe API Manager instance attaches policies that are enforced by API Gateway embedded in the runtime of the Mule application.

Runtime Plane

Control Plane

Mule Runtime

API Gateway

API Manager
Environment: dev

example-sapi (API ID)

policy config

client request

forward approved traffic

Policies

client

Policies

Mule Application
example-sapi-app

RTF and CH2 Deployment Process

The initial deployment sequence for Runtime Fabric and CloudHub 2.0.

Deployment Initiation

The sequence from the user upload to the creation of the initial application pod.

Deployment InitiationThe sequence from the user upload to the creation of the initial application pod.Mule PodReplica SetIngressKubernetes APIRTF AgentRuntime ManagerExchangeMule PodReplica SetIngressKubernetes APIRTF AgentRuntime ManagerExchangeDeployer1. Publish archive via mvn deploy12. Deploy app via mvn mule:deploy23. Send deployment request3Applying status44. Create deployment55. Create ingress66. Create replica set77. Start Mule pod8Deployer

CloudHub 2.0 Connectivity Patterns

Four different architectural methods for connecting to applications within a CloudHub 2.0 Private Space.

1. Inbound External Clients

Routing for external clients connecting over the Internet, VPN, or Direct Connect (via Transit Gateway) to an application.

1. Inbound External ClientsRouting for external clients connecting over the Internet, VPN, or Direct Connect (via Transit Gateway) to an application.

CloudHub 2.0 Private Space

AWS Network

Corporate Network

Public Network

Ingress Controller

HTTPS

IPSec Tunnel

Direct Connect

HTTPS

Internet Client

VPN Client

Direct Connect Client

Transit Gateway

Public Endpoint
<app>.region.cloudhub.io

Private Endpoint
internal-<app>.region.cloudhub.io

hello-sapi Service

hello-sapi Pod

Mutual TLS Context Exchange

Client and server keystore and truststore relationships for mutual TLS in Mule applications.

Mutual TLS Context ExchangeClient and server keystore and truststore relationships for mutual TLS in Mule applications.

Mule Server App

Mule Client App

Server certificate chain

Client certificate chain

HTTP Request

TLS Context

Key Store - Client Cert

Trust Store - Server Certs

HTTP Listener

TLS Context

Key Store - Server Cert

Trust Store - Client Certs

Transport Handshake Evolution

A three-step comparison of TLS 1.2, TLS 1.3, and HTTP/3 over QUIC connection setup.

TLS 1.2 Handshake

TLS 1.2 exchange showing the full handshake before application data is sent.

TLS 1.2 HandshakeTLS 1.2 exchange showing the full handshake before application data is sent.ServerClientServerClientTCP SYN1TCP SYN-ACK2TCP ACK3TLS Client HELLO4TCP ACK5TLS Server HELLO - Server Certificate - Key Exchange6TCP ACK7TLS Client Certificate (optional) - Key Exchange - Change Cipher Spec8TCP ACK9TLS Change Cipher Spec FINISH10TCP ACK11DATA (for example HTTP GET)12

OAuth 2.0 / OIDC

A compact walkthrough of the most common OAuth 2.0 and OIDC flows used across APIs and web apps.

Authorization Code Flow

User login and consent flow for a web app exchanging an auth code for tokens.

Authorization Code FlowUser login and consent flow for a web app exchanging an auth code for tokens.APIWeb AppAuth ServerAPIWeb AppAuth ServerApp exchanges code, then calls API with new tokenValidate code, client ID, and secretUSERClick sign-in link1Send authorization request2Redirect to login and consent prompt3Authenticate and grant consent4Return authorization code5Exchange code for ID and access tokens6Issue tokens7Request resource with access token8Protected response9USER

AnyPoint Platform SAML SSO

Browser-based SAML sign-on sequence between AnyPoint Platform and an external identity provider.

AnyPoint Platform SAML SSOBrowser-based SAML sign-on sequence between AnyPoint Platform and an external identity provider.Identity ProviderAnyPoint Platform (SP)Identity ProviderAnyPoint Platform (SP)Could be Okta, Auth0, or another SAML IdPValidate user credentialsUSERNavigate to organization SSO URL1Redirect to IdP2Login to IdP3Return SAML assertion (XML)4POST assertion to the ACS URL5Redirect to target resource6Request target resource7Return requested resource8USER

Data 360 LWC DMO Access Architectures

Architectural comparison of querying a Data 360 DMO, with each access pattern separated into its own scenario slide.

Scenario A: Home Org Native Query

An LWC in the home org queries the local Data Space through Apex using the native Data Cloud query API.

Scenario A: Home Org Native QueryAn LWC in the home org queries the local Data Space through Apex using the native Data Cloud query API.

Scenario A: Home Org Native Access

1. Wire / Call

2. Native ANSI SQL

LWC (Contact Page)

Apex: ConnectApi.CdpQuery

Home Org Data Space
(Sales Order DMO)

Identity Resolution: Unification Types

An overview of the four Identity Resolution unification types in Salesforce Data Cloud — Individual, Account, Lead, and Household — showing source DMO relationships, unified link objects, and resulting unified profiles for each pattern.

Individual Unification

The Individual DMO is the foundation of B2C identity resolution. Source records (Contacts, Subscribers, Shoppers) are matched via Contact Points and Party Identification, producing a Unified Individual and unified Contact Point objects connected through Unified Link bridge objects.

Individual UnificationThe Individual DMO is the foundation of B2C identity resolution. Source records (Contacts, Subscribers, Shoppers) are matched via Contact Points and Party Identification, producing a Unified Individual and unified Contact Point objects connected through Unified Link bridge objects.

identifies

contact method for

contact method for

contact method for

unification link for

unified as

unification link for

unified as

unification link for

unified as

unification link for

unified as

contact method for

contact method for

contact method for

Party Identification

Individual

Contact Point Phone

Contact Point Email

Contact Point Address

Unified Link Individual

Unified Link Contact Point Phone

Unified Link Contact Point Email

Unified Link Contact Point Address

Unified Individual

Unified Indv Contact Point Phone

Unified Indv Contact Point Email

Unified Indv Contact Point Address

Zero Copy Integration: File vs. Query Federation

Comparison of File Federation and Live Query Federation in Salesforce Data 360, split into focused scenario slides.

File Federation

Data Cloud reads files directly from external table storage without routing queries through the warehouse compute layer.

File FederationData Cloud reads files directly from external table storage without routing queries through the warehouse compute layer.

Salesforce Data 360

AWS Redshift Environment

Manages metadata

File Federation: read Parquet / Iceberg directly

not on data path

Redshift Compute Engine

Amazon S3 and Iceberg Tables

Data Cloud Query Engine

Local Governance and Security

No matching diagrams

Try another term.

Diagram