For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Use VisibilityPolicy resources to control which users can see which API products in the portal, based on JWT claims from your identity provider.

About API product visibility

By default, all API products in a portal are visible to all users. With VisibilityPolicy resources, you can restrict which API products a user sees based on claims in their JWT token. This way, you can surface different API products to different groups of users, such as showing internal APIs only to admin users, or keeping certain API products hidden from regular users.

How visibility matching works:

• A VisibilityPolicy defines one or more claim groups (claimGroup). Each claimGroup is a list of key/value claim requirements.
• A user satisfies a claimGroup if all claims in the group match their JWT token (AND logic within a group).
• A user can view an API product if their JWT satisfies any claimGroup in any attached VisibilityPolicy (OR logic across groups and policies).

You can attach VisibilityPolicy resources at two levels:

• Portal-wide: applies to all API products in the portal.
• Per API product: applies to a specific API product only.

If both levels apply, the user can view the API product if they satisfy either.

Before you begin

1. Set up a portal web server.

2. Secure the login to the portal frontend. Visibility controls rely on JWT claims from authenticated users. If you follow the guide, you set up the following Keycloak users:

   • user1: Non-admin user with the "tier": "basic" JWT claim
   • admin1: Admin user with the "tier": "premium" JWT claim

   This guide uses the tier claim to demonstrate visibility controls. You can apply the same approach to any custom claim you configure in your IdP.

Step 1: Create a VisibilityPolicy

Create the VisibilityPolicy resources that define the JWT claims that a user needs to be granted access to an API product.

The following example creates two policies based on the tier claim that you configured in the Secure login guide.

• premium-only: Grants access to users with a "tier": "premium" claim (admin1).
• all-tiers: Grants access to users with a "tier": "premium" or "tier": "basic" claim (admin1 and user1).

kubectl apply -f- <<EOF
apiVersion: portal.solo.io/v1alpha1
kind: VisibilityPolicy
metadata:
  name: premium-only
  namespace: default
spec:
  membership:
    - claimGroup:
        - key: tier
          value: premium
---
apiVersion: portal.solo.io/v1alpha1
kind: VisibilityPolicy
metadata:
  name: all-tiers
  namespace: default
spec:
  membership:
    - claimGroup:
        - key: tier
          value: premium
    - claimGroup:
        - key: tier
          value: basic
EOF

Step 2: Attach the VisibilityPolicy to a Portal

Attach the premium-only VisibilityPolicy to the portal. This policy allows only the admin1 user to see the httpbin API product. The user1 user does not have access to that product.

You can attach the VisibilityPolicy resource at the portal level, the API product level, or both. When a VisibilityPolicy is attached, it takes precedence over the visibility.public setting for the covered API products.

kubectl apply -f- <<EOF
apiVersion: portal.solo.io/v1alpha1
kind: Portal
metadata:
  name: my-portal
  namespace: default
spec:
  parametersRef:
    name: portal-params
  visibility:
    visibilityPolicyRefs:
      - name: premium-only
  apiProductRefs:
  - name: httpbin-api
EOF

kubectl apply -f- <<EOF
apiVersion: portal.solo.io/v1alpha1
kind: Portal
metadata:
  name: my-portal
  namespace: default
spec:
  parametersRef:
    name: portal-params
  visibility:
    public: true
  apiProductRefs:
  - name: httpbin-api
    visibilityPolicyRefs:
      - name: premium-only
EOF

kubectl apply -f- <<EOF
apiVersion: portal.solo.io/v1alpha1
kind: Portal
metadata:
  name: my-portal
  namespace: default
spec:
  parametersRef:
    name: portal-params
  visibility:
    visibilityPolicyRefs:
      - name: all-tiers
  apiProductRefs:
  - name: httpbin-api
    visibilityPolicyRefs:
      - name: premium-only
EOF

Step 3: Verify access

1. Open the portal frontend in your browser.

2. Click Login. You are redirected to the Keycloak login page. Log in with the user1 test user and password password.

3. Verify that you cannot see the httpbin API product.

4. Update your Portal and attach the all-tiers VisibilityPolicy that allows users with the tier: premium or tier: basic JWT claim to see the httpbin API product. The following example shows a Portal-wide policy setting. If you chose a different setup earlier, update the resource accordingly.

   kubectl apply -f- <<EOF
   apiVersion: portal.solo.io/v1alpha1
   kind: Portal
   metadata:
     name: my-portal
     namespace: default
   spec:
     parametersRef:
       name: portal-params
     visibility:
       visibilityPolicyRefs:
         - name: all-tiers
     apiProductRefs:
     - name: httpbin-api
   EOF

5. Refresh the portal frontend page and verify that you can now see the httpbin API product.

Next