You may encounter the following errors related to IAM authentication information:
Incorrect IAM authentication information: verify aksk signature fail
{
- "error_msg": "Incorrect IAM authentication information: verify aksk signature fail, ......
+You may encounter the following errors related to IAM authentication information:
+
+
Incorrect IAM authentication information: AK access failed to reach the limit,forbidden
{
+ "error_msg": "Incorrect IAM authentication information: AK access failed to reach the limit,forbidden." ......
"error_code": "APIG.0301",
"request_id": "******"
}
-
Possible Cause
-
The signature algorithm is incorrect, and the signature calculated by the client is different from that calculated by APIG.
-
Solution
-
- Obtain the canonicalRequest calculated by APIG.
Obtain
request_id from the body of the error message, search for
error.log (you can view this file on CLS) of the shubao node based on
request_id, and obtain
canonicalRequest from
error.log.
2019/01/26 11:34:27 [error] 1211#0: *76 [lua] responses.lua:170: rewrite(): 473a4370fbaf69e42f9da243eb8f8c52;app-1;Incorrect IAM authentication information: verify signature fail;SDK-HMAC-SHA256 Access=071fe245-9cf6-4d75-822d-c29945a1e06a, SignedHeaders=host;x-sdk-date, Signature=b2ef2cddcef89cbfe22974c988909c1a94b1ac54114c30b8fe083d34a259e0f5;canonicalRequest:GET
-/app1/
-
-host:test.com
-x-sdk-date:20190126T033427Z
-
-host;x-sdk-date
-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, client: 192.168.0.1, server: shubao, request: "GET /app1 HTTP/1.1", host: "test.com"
-
- Obtain the canonicalRequest calculated by the client by printing logs or using debug interrupts. The following table describes the functions used to calculate the canonicalRequest in the SDKs of different languages.
-
Table 1 Functions for calculating canonicalRequest in the SDKs of common languagesLanguage
- |
-Function
- |
-
|---|
-
-Java
- |
-Sign function in com.cloud.sdk.auth.signer.DefaultSigner.class of libs/java-sdk-core-*.jar
- |
-
-C
- |
-sig_sign function in signer.c
- |
-
-C++
- |
-Signer::createSignature function in signer.cpp.
- |
-
-C#
- |
-Sign function in signer.cs
- |
-
-Go
- |
-Sign function in signer.go
- |
-
-JavaScript
- |
-Signer.prototype.Sign function in signer.js
- |
-
-Python
- |
-Sign function in signer.py
- |
-
-PHP
- |
-Sign function in signer.php
- |
-
-
-
-
Example: cannonicalRequest obtained at a debug interrupt
-POST
-/app1/
-
-host:test.com
-x-sdk-date:20190126T033950Z
-
-host;x-sdk-date
-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- - Check whether the cannonicalRequest in 1 is the same as that in 2.
- Yes: Check whether the AK and SK are correct, for example, without spaces.
- No:
- Different in line 1: The request method must be the same.
- Different in line 2: The request path must be the same.
- Different in line 3: The request parameters must be the same.
- Different in lines 4 to 5: The request header must be the same in each line.
- Different in line 7: The number of request header parameters must be the same as the number of request header lines.
- Different in line 8: The request body must be the same.
-
-
-Table 2 canonicalRequest of APIG and a clientLine No.
- |
-Parameter
- |
-APIG
- |
-Client
- |
-
|---|
-
-1
- |
-Request method
- |
-GET
- |
-POST
- |
-
-2
- |
-Request path
- |
-/app1/
- |
-/app1/
- |
-
-3
- |
-Request parameters
- |
-None
- |
-None
- |
-
-4
- |
-Request header
- |
-host:test.com
- |
-host:test.com
- |
-
-5
- |
-Request header
- |
-x-sdk-date:20190126T033427Z
- |
-x-sdk-date:20190126T033950Z
- |
-
-6
- |
-Blank line
- |
--
- |
--
- |
-
-7
- |
-Request header parameters
- |
-host;x-sdk-date
- |
-host;x-sdk-date
- |
-
-8
- |
-Request body hash value
- |
-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- |
-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- |
-
-
-
-
-
Incorrect IAM authentication information: AK access failed to reach the limit,forbidden
{
- "error_msg": "Incorrect IAM authentication information: AK access failed to reach the limit,forbidden." ......
- "error_code": "APIG.0301",
- "request_id": "******"
-}
-
-
Possible Causes
-
- The AK/SK signature calculation is incorrect. Resolve the problem by referring to Incorrect IAM authentication information: verify aksk signature fail.
- The AK and SK do not match.
- AK/SK authentication fails for more than five consecutive times, and the AK/SK pair is locked for five minutes. (Authentication requests are rejected within this period).
- An expired token is used for token authentication.
-
Incorrect IAM authentication information: decrypt token fail
{
- "error_msg": "Incorrect IAM authentication information: decrypt token fail",
+Possible Causes
+- The AK/SK signature calculation is incorrect.
- The AK and SK do not match.
- AK/SK authentication fails for more than five consecutive times, and the AK/SK pair is locked for five minutes. (Authentication requests are rejected within this period).
- An expired token is used for token authentication.
+
Incorrect IAM authentication information: decrypt token fail
{
+ "error_msg": "Incorrect IAM authentication information: decrypt token fail",
"error_code": "APIG.0301",
"request_id": "******"
}
-
Possible Cause
-
The token cannot be parsed for IAM authentication of the API.
-
Solution
-
- Check whether the token is correct.
- Check whether the token has been obtained in the environment where the API is called.
+
Possible Cause
+
The token cannot be parsed for IAM authentication of the API.
+
Solution
+
- Check whether the obtained token is the token of the corresponding IAM account.
- Check whether the token is correct.
- Check whether the token has been obtained in the environment where the API is called.
-
Incorrect IAM authentication information: Get secretKey failed
{
-"error_msg": "Incorrect IAM authentication information: Get secretKey failed,ak:******,err:ak not exist",
+Incorrect IAM authentication information: Get secretKey failed
{
+"error_msg": "Incorrect IAM authentication information: Get secretKey failed,ak:******,err:ak not exist",
"error_code": "APIG.0301",
"request_id": "******"
}
-
Possible Cause
-
The AK used for IAM authentication of the API does not exist.
-
Solution
-
Check whether the AK is correct.
+
Possible Cause
+
The AK used for IAM authentication of the API does not exist.
+
Solution
+
Check whether the AK is correct.
diff --git a/docs/apig/umn/apig-faq-0004.html b/docs/apig/umn/apig-faq-0004.html
index bcd3b8ee..1640bdb8 100644
--- a/docs/apig/umn/apig-faq-0004.html
+++ b/docs/apig/umn/apig-faq-0004.html
@@ -1,27 +1,19 @@
Why Am I Seeing the Message "Backend domain name resolution failed" When a Backend Service Is Called?
-
An error message indicating a domain name resolution failure is displayed when the backend service is called, although private domain name resolution is completed for the VPC where the API gateway is located.
-
Possible Cause
-
The VPC of the API gateway is isolated from that of the backend service. Private domain names can be resolved only for the VPC of the backend service.
-
Solution
-
- Method 1: When creating an API, set Backend Address to a public network domain name.
- Method 2: When creating an API, do not use a VPC channel. Instead, set Backend Address to the backend service IP address, and add a constant parameter to specify the Host field in the header.
- - Method 3: When creating an API, specify a VPC channel.
- Create a VPC channel.
- - Add the backend service address.
- - When creating an API, select the VPC channel and configure a custom header.
-
+An error message indicating a domain name resolution failure is displayed when the backend service is called, although private domain name resolution is completed for the VPC where the API gateway is located.
+
Possible Cause
+
The VPC of the API gateway is isolated from that of the backend service. Private domain names can be resolved only for the VPC of the backend service.
+
Solution
+
- Method 1: When creating an API, set Backend Address to a public network domain name.
- Method 2: When creating an API, do not use a VPC channel (load balance channel). Instead, set Backend Address to the backend service IP address, and add a constant parameter to specify the Host field in the header.
+
- Method 3: When creating an API, specify a VPC channel (load balance channel).
- Create a VPC channel (load balance channel).
+ - Add the backend service address.
+ - When creating an API, select the VPC channel (load balance channel) and configure a custom header.
How Can I Access Backend Services over Public Networks Through APIG?
-Enable public access for the relevant gateway to allow external services to call APIs.
-
If you encounter a network problem when calling APIs, see What Are the Possible Causes for an API Calling Failure?
+
Enable public access for the relevant gateway to allow external services to call APIs.
+
If you encounter a network problem when calling APIs, see What Are the Possible Causes for an API Calling Failure?
diff --git a/docs/apig/umn/apig-faq-0008.html b/docs/apig/umn/apig-faq-0008.html
new file mode 100644
index 00000000..811c0e5c
--- /dev/null
+++ b/docs/apig/umn/apig-faq-0008.html
@@ -0,0 +1,12 @@
+
+
+
Are Client IP Addresses Verified for Access Control?
+
Not necessarily.
+
In APIG, access control is based on the value of $remote_addr. $remote_addr indicates a client IP address and is determined by the access mode. If a client accesses APIG without using any proxy, remote_addr is the client's IP address. If a client accesses APIG using a proxy, the client first accesses the proxy, and the proxy then forwards the request to APIG. In this case, remote_addr is the proxy's IP address.
+
+
+
diff --git a/docs/apig/umn/apig-faq-0009.html b/docs/apig/umn/apig-faq-0009.html
new file mode 100644
index 00000000..b2cd8d0f
--- /dev/null
+++ b/docs/apig/umn/apig-faq-0009.html
@@ -0,0 +1,33 @@
+
+
+
What Should I Do If the App Authentication Information Is Incorrect?
+
You may encounter the following errors related to app authentication information:
+
+
Incorrect app authentication information: app not found, appkey xxx
{
+ "error_msg": "Incorrect app authentication information: app not found, appkey 01177c425f71487ea362ba84dc4abe5e1",
+ "error_code": "APIG.0303",
+ "request_id": "a5322eb89048eb41d705491a76a05aca"
+}
+
+
Possible Causes
+
The AppKey is incorrect.
+
Solution
+
- In the navigation pane of the APIG console, choose API Management > Credentials.
- Click the corresponding credential name to go to the details page.
- Check the Key and reconfigure the AppKey.
+
Incorrect app authentication information: signature expired
{
+ "error_msg": "Incorrect app authentication information: signature expired, signature time:20230527T000431Z,server time:20230527T020608Z",
+ "error_code": "APIG.0303",
+ "request_id": "fd6530a01c09807640189e65e837b8ad"
+
+}
+
Possible Causes
+
The difference between the client's signature timestamp x-sdk-date and the APIG server's time exceeds 15 minutes.
+
Solution
+
Check whether the time on the client is correct.
+
+
+
+
diff --git a/docs/apig/umn/apig-faq-180307001.html b/docs/apig/umn/apig-faq-180307001.html
new file mode 100644
index 00000000..97a69452
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180307001.html
@@ -0,0 +1,17 @@
+
+
+
What Are the Error Messages Returned by APIG Like?
+
When receiving an API request, APIG returns a response. A similar response body is as follows:
+
{
+ "error_code": "APIG.0101",
+ "error_msg": "API does not exist or is not published in the environment.",
+ "request_id": "acbc548ac6f2a0dbdb9e3518a7c0ff84"
+}
+
- "error_code": error code
- "error_msg": description of the error
+
+
+
diff --git a/docs/apig/umn/apig-faq-180307002.html b/docs/apig/umn/apig-faq-180307002.html
new file mode 100644
index 00000000..62c2f564
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180307002.html
@@ -0,0 +1,13 @@
+
+
+
Do I Need to Publish an API Again After Modification?
+
Yes.
+
After you modify the parameters of a published API, you must publish the API again to synchronize the modifications to the environment.
+
For details, see section "Publishing an API" in the API Gateway User Guide.
+
+
+
diff --git a/docs/apig/umn/apig-faq-180307003.html b/docs/apig/umn/apig-faq-180307003.html
new file mode 100644
index 00000000..d8107d59
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180307003.html
@@ -0,0 +1,14 @@
+
+
+
How Can I Protect My APIs?
+
- Identity authentication
Configure IAM or App authentication for APIs to prevent malicious calling.
+ - Access control policies
Configure a whitelist or blacklist of IP addresses/IP address ranges or accounts for APIs to secure access.
+ - Request throttling policies
By default, an API can be called up to 200 times per second. If your backend service does not support this access rate, decrease the quota accordingly.
+
+
+
+
diff --git a/docs/apig/umn/apig-faq-180307004.html b/docs/apig/umn/apig-faq-180307004.html
new file mode 100644
index 00000000..85221304
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180307004.html
@@ -0,0 +1,12 @@
+
+
+
Can Mobile Apps Call APIs?
+
Yes, mobile apps can call APIs.
+
In app authentication mode, the AppKey and AppSecret of a mobile app are replaced with those in the relevant SDK to sign the app.
+
+
+
diff --git a/docs/apig/umn/apig-faq-180307006.html b/docs/apig/umn/apig-faq-180307006.html
new file mode 100644
index 00000000..375035de
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180307006.html
@@ -0,0 +1,14 @@
+
+
+
Can I Upload Files Using the POST Method?
+
Yes.
+
If you are using dedicated gateways, configure the maximum request body size allowed by setting the request_body_size parameter. The value ranges from 1 MB to 9536 MB.
+
Currently, only the request body can be transparently transmitted.
+
+
+
+
diff --git a/docs/apig/umn/apig-faq-180307008.html b/docs/apig/umn/apig-faq-180307008.html
new file mode 100644
index 00000000..78d922de
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180307008.html
@@ -0,0 +1,31 @@
+
+
+
Can Applications Deployed in a VPC Call APIs?
+
Yes, applications deployed in a VPC can call APIs by default. If domain name resolution fails, configure a DNS server on the current endpoint by following the instructions in Configuring an Intranet DNS Server. After the configuration, applications deployed in the VPC can call APIs.
+
Configuring an Intranet DNS Server
To configure a DNS server, specify its IP address in the /etc/resolv.conf file.
+
The IP address of the intranet DNS server depends on which region you are located in. Find the IP address of the intranet DNS server in your region from the private DNS server addresses mentioned in "FAQs" of the Domain Name Service User Guide.
+
Add an intranet DNS server with either of the following two methods:
+
- Method 1: Modify the subnet information of the VPC.
- Method 2: Edit the /etc/resolv.conf file.
The intranet DNS server configurations become invalid after the ECS restarts, and the intranet DNS server must be configured again. Therefore, method 1 is recommended.
+
+
+
+
Method 1
Perform the following procedure to add a DNS server IP address to the subnet configurations of the ECS in the VPC.
+
- Log in to the management console.
- Click
in the upper left corner to select a region. - In the service list, choose Compute > Elastic Cloud Server.
- Click the name of the ECS you want to use.
- On the Network Interfaces tab page, click
to view the subnet name. - On the Summary tab page, view the VPC name.
- Click the VPC name to visit the VPC console.
- Choose Subnets in the left navigation pane.
- Locate the subnet mentioned in 5 and click the subnet name.
- Change the DNS server address of the subnet and click OK.
For example, change the address to 100.125.1.250.
+ - Restart the ECS. Check that the /etc/resolv.conf file contains the IP address of the DNS server to be configured, and the IP address is less than those of all other DNS servers.
The following figure shows the IP address 100.125.1.250 of the DNS server to be configured.
+
+ Modifying the subnet information of a VPC will affect all ECSs created using the subnet.
+
+
+
+
Method 2
Add the IP address of the intranet DNS server to the /etc/resolv.conf file.
+
For example, if you are located in region01, add an intranet DNS server of IP address 100.125.1.250 to the /etc/resolv.conf file.
+
- The IP address of the new DNS server must be less than those of all other DNS servers.
- The DNS configurations take effect immediately after the /etc/resolv.conf file is saved.
+
+
+
+
+
diff --git a/docs/apig/umn/apig-faq-180307009.html b/docs/apig/umn/apig-faq-180307009.html
new file mode 100644
index 00000000..27c91762
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180307009.html
@@ -0,0 +1,15 @@
+
+
+
How Do I Ensure the Security of Backend Services Invoked by APIG?
+
You can ensure the security of backend services invoked by APIG by using the following methods:
+
- Bind signature keys to APIs
After a signature key is bound to an API, APIG adds signature information to each request sent to the backend service. The backend service calculates the signature information in each request and checks whether the signature information is consistent with that on APIG.
+ - Encrypt requests using HTTPS
Ensure that the required SSL certificate exists.
+ - Perform backend authentication
Enable security authentication for backend services of the desired APIs to process only API requests that carry correct authentication information.
+
+
+
+
diff --git a/docs/apig/umn/apig-faq-180606010.html b/docs/apig/umn/apig-faq-180606010.html
new file mode 100644
index 00000000..c67afee3
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180606010.html
@@ -0,0 +1,12 @@
+
+
+
What SDK Languages Does APIG Support?
+
APIG supports Java, Go, Python, C#, JavaScript, PHP, C++, C, and Android SDKs.
+
For details about SDKs, see the API Gateway Developer Guide.
+
+
+
diff --git a/docs/apig/umn/apig-faq-180606011.html b/docs/apig/umn/apig-faq-180606011.html
new file mode 100644
index 00000000..ecf73465
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180606011.html
@@ -0,0 +1,14 @@
+
+
+
Can I Access an API Published in a Non-RELEASE Environment?
+
Yes. To access an API published in a non-RELEASE environment, add the x-stage header to the API request.
+
Example:
+
r.Header.Add("x-stage", "RELEASE")
+
You can also refer to examples of section "Quickly Opening and Calling APIs" in the "Getting Started" chapter of the API Gateway User Guide.
+
+
+
diff --git a/docs/apig/umn/apig-faq-180606012.html b/docs/apig/umn/apig-faq-180606012.html
new file mode 100644
index 00000000..eb972513
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180606012.html
@@ -0,0 +1,13 @@
+
+
+
Does APIG Support Multiple Backend Endpoints?
+
Yes
+
APIG supports the configuration of multiple backend endpoints through a VPC channel (also called "load balance channel"). You can add multiple cloud servers to each VPC channel.
+
For details, see section "Creating a VPC Channel (Load Balance Channel)" in the API Gateway User Guide.
+
+
+
diff --git a/docs/apig/umn/apig-faq-180606013.html b/docs/apig/umn/apig-faq-180606013.html
new file mode 100644
index 00000000..738eb3e7
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180606013.html
@@ -0,0 +1,11 @@
+
+
+
What Is the Maximum Size of an API Request Package?
+
Dedicated gateway: APIG forwards only API requests whose body is no larger than 12 MB. If your gateway will receive requests with a body larger than 12 MB, modify the request_body_size parameter on the gateway details page. This parameter indicates the maximum request body size allowed. The value ranges from 1 MB to 9536 MB.
+
+
+
diff --git a/docs/apig/umn/apig-faq-180919014.html b/docs/apig/umn/apig-faq-180919014.html
new file mode 100644
index 00000000..bf26372f
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180919014.html
@@ -0,0 +1,26 @@
+
+
+
+
+
+
Other FAQs
+
+
+
diff --git a/docs/apig/umn/apig-faq-180919015.html b/docs/apig/umn/apig-faq-180919015.html
new file mode 100644
index 00000000..8a8b4648
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180919015.html
@@ -0,0 +1,19 @@
+
+
+
API Security
+
+
+
diff --git a/docs/apig/umn/apig-faq-180919016.html b/docs/apig/umn/apig-faq-180919016.html
new file mode 100644
index 00000000..613a9a0a
--- /dev/null
+++ b/docs/apig/umn/apig-faq-180919016.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+
API Publishing
+
+
+
diff --git a/docs/apig/umn/apig-en-faq-180919017.html b/docs/apig/umn/apig-faq-180919017.html
similarity index 70%
rename from docs/apig/umn/apig-en-faq-180919017.html
rename to docs/apig/umn/apig-faq-180919017.html
index f5509640..8c757da2 100644
--- a/docs/apig/umn/apig-en-faq-180919017.html
+++ b/docs/apig/umn/apig-faq-180919017.html
@@ -1,20 +1,23 @@
-
+
+
+
+
API Calling
-
+
diff --git a/docs/apig/umn/apig-faq-181016018.html b/docs/apig/umn/apig-faq-181016018.html
new file mode 100644
index 00000000..b62cfa4d
--- /dev/null
+++ b/docs/apig/umn/apig-faq-181016018.html
@@ -0,0 +1,12 @@
+
+
+
Why Am I Seeing the Message "No backend available"?
+
- Check whether the backend service is accessible, and modify the backend service if it is inaccessible.
- Check the ECS security group configurations of the backend service and verify that the required port has been enabled.
- Check whether the backend service address is a public IP address. If yes, enable outbound access on the Gateways > Access Console > Gateway Information page.
- Check whether ACL configurations of the VPC restrict the communication between the API gateway and the subnet where the backend service is located.
- If you use a VPC channel, check whether the service port, health check port, and backend servers of the VPC channel have been correctly configured.
.
+
+
+
+
diff --git a/docs/apig/umn/apig-faq-181016019.html b/docs/apig/umn/apig-faq-181016019.html
new file mode 100644
index 00000000..f9f66604
--- /dev/null
+++ b/docs/apig/umn/apig-faq-181016019.html
@@ -0,0 +1,12 @@
+
+
+
Can I Invoke Different Backend Services by Publishing an API in Different Environments?
+
Yes, you can invoke different backend services by publishing an API in different environments while specifying environment variables and backend parameters.
+
For details about environment variables, see section "Creating an Environment Variable" in the API Gateway User Guide.
+
+
+
diff --git a/docs/apig/umn/apig-faq-190515025.html b/docs/apig/umn/apig-faq-190515025.html
index 475c56c6..63ce41af 100644
--- a/docs/apig/umn/apig-faq-190515025.html
+++ b/docs/apig/umn/apig-faq-190515025.html
@@ -1,11 +1,12 @@
How Do I Perform App Authentication in iOS System?
-
APIG provides SDKs and demos in multiple languages, such as Java, Python, C, PHP, and Go, for app authentication. To use Objective-C (for iOS) or other languages, see .
+
APIG provides SDKs and demos in multiple languages, such as Java, Python, C, PHP, and Go, for app authentication.
+
To use Objective-C (for iOS) or other languages, see .
diff --git a/docs/apig/umn/apig-faq-190627027.html b/docs/apig/umn/apig-faq-190627027.html
index 0c80c08d..78a80959 100644
--- a/docs/apig/umn/apig-faq-190627027.html
+++ b/docs/apig/umn/apig-faq-190627027.html
@@ -1,13 +1,16 @@
Why Does an API Failed to Be Called Across Domains?
-
- Ensure that CORS has been enabled for the API.
Go to the API details page, click Edit, and check whether CORS is enabled. If it is not, enable it.
- - Check whether an API with the OPTIONS method has been created. Only one such API is required for each API group.
- On the Set Basic Information page, set the basic information for the API that uses the OPTIONS method.
Go to the API details page and click Edit.
-API Group: The group to which the API with CORS enabled belongs.
-Security Authentication: None means all users will be granted access. It is not recommended.
- - On the Define API Request page, set the request information for the API.
- Protocol: The same protocol used by the API with CORS enabled.
- Path: Same as or prefixally matching the request path set for the API with CORS enabled.
- Matching: Select Prefix match.
- Method: Select OPTIONS.
- CORS: Enable this option.
-
-
+- Ensure that CORS has been enabled for the API.
Go to the API details page, click Edit, and check whether CORS is enabled. If it is not, enable it.
+ - Check whether an API with the OPTIONS method has been created. Only one such API is required for each API group.
Parameters are as follows:
+
API Group: The same group to which the API with CORS enabled belongs.
+
Method: Select OPTIONS.
+
Protocol: The same protocol used by the API with CORS enabled.
+
Path: Same as or prefixally matching the request path set for the API with CORS enabled.
+
Matching: Select Prefix match.
+
Authentication Mode: None means all users will be granted access. It is not recommended.
+
CORS: Enable this option.
+
diff --git a/docs/apig/umn/apig-faq-190627028.html b/docs/apig/umn/apig-faq-190627028.html
index d720c85f..268d6123 100644
--- a/docs/apig/umn/apig-faq-190627028.html
+++ b/docs/apig/umn/apig-faq-190627028.html
@@ -1,7 +1,8 @@
How Can I Configure the Backend Service Address?
-
Configure the backend service address as an ECS EIP, or the public IP address or domain name of your own server.
+
Configure the backend service address as an ECS EIP, or the public IP address or domain name of your own server.
+
For details about how to configure the API backend, see section "Creating an API" in the API Gateway User Guide.
diff --git a/docs/apig/umn/apig-faq-190627029.html b/docs/apig/umn/apig-faq-190627029.html
index 345cfd3b..f24e4584 100644
--- a/docs/apig/umn/apig-faq-190627029.html
+++ b/docs/apig/umn/apig-faq-190627029.html
@@ -1,11 +1,12 @@
Why Can't I Create a Header Parameter Named x-auth-token for an API Called Through IAM Authentication?
-
The header parameter x-auth-token has already been defined in APIG. To use this parameter to call an API, add the parameter and its value to the request header.
+
The header parameter x-auth-token has already been defined in APIG.
+
To use this parameter to call an API, add the parameter and its value to the request header.
diff --git a/docs/apig/umn/apig-faq-190627030.html b/docs/apig/umn/apig-faq-190627030.html
index b8ecc025..3e2932b7 100644
--- a/docs/apig/umn/apig-faq-190627030.html
+++ b/docs/apig/umn/apig-faq-190627030.html
@@ -1,20 +1,20 @@
-
App FAQs
-
How many apps can I create?
-
You can create a maximum of 50 apps.
-
How do I isolate the calling information among the third parties that call the same API through app authentication?
-
Create multiple apps for different third parties and bind the apps to the same API.
-
Are there any restrictions on the maximum number of third parties that can call the same app through app authentication?
-
No restrictions.
-
Do I need to create an app for an API so that it can be called through app authentication?
-
Yes, you need to create an app and bind it to the API. After the app is created, an AppKey and AppSecret are automatically created. Provide the AppKey and AppSecret for third parties to call the API.
-
How can an API be called by third parties through app authentication?
-
Provide third parties with the AppKey and AppSecret of the app you have created for accessing the API. The third parties then can use the AppKey and AppSecret to call the API through an SDK. For details about how to use an SDK, see .
+
App (Credential) FAQs
+
How many apps (credentials) can I create?
+
You can create a maximum of 50 apps (credentials).
+
How do I isolate the calling information among the third parties that call the same API through app authentication?
+
Create multiple apps (credentials) for different third parties and bind the apps (credentials) to the same API.
+
Are there any restrictions on the maximum number of third parties that can call the same app through app authentication?
+
No restrictions.
+
Do I need to create an app (credential) for an API so that it can be called through app authentication?
+
Yes, you need to create an app (credential) and bind it to the API. After the app (credential) is created, an AppKey and AppSecret are automatically created. Provide the AppKey and AppSecret for third parties to call the API.
+
How can an API be called by third parties through app authentication?
+
Provide third parties with the AppKey and AppSecret of the app you have created for accessing the API. The third parties then can use the AppKey and AppSecret to call the API through an SDK. For details about how to use an SDK, see .
diff --git a/docs/apig/umn/apig-faq-190627032.html b/docs/apig/umn/apig-faq-190627032.html
index 0f56bee3..107082ee 100644
--- a/docs/apig/umn/apig-faq-190627032.html
+++ b/docs/apig/umn/apig-faq-190627032.html
@@ -1,7 +1,8 @@
-
Is the Restriction of 1000 Requests to a Subdomain Name Applied to Enterprise Accounts?
-
Yes.
+
Is the Restriction of 1000 Requests per Day to a Subdomain Name (Debugging Domain Name) Applied to Enterprise Accounts?
+
Yes.
+
For details about subdomain names (debugging domain names), see section "Binding a Domain Name" in the API Gateway User Guide.
diff --git a/docs/apig/umn/apig-faq-190627033.html b/docs/apig/umn/apig-faq-190627033.html
index 5813e4f3..5289a890 100644
--- a/docs/apig/umn/apig-faq-190627033.html
+++ b/docs/apig/umn/apig-faq-190627033.html
@@ -1,11 +1,12 @@
-
How Do I Implement WebSocket Data Transmission?
-
APIG supports WebSocket data transmission. When creating an API, you can select HTTP, HTTPS, or HTTP&HTTPS. HTTP is equivalent to WebSocket (ws), and HTTPS is equivalent to WebSocket Secure (wss).
+
Does APIG Support WebSocket Data Transmission?
+
Yes.
+
When creating an API, you can select HTTP, HTTPS, or HTTP&HTTPS. HTTP is equivalent to WebSocket (ws), and HTTPS is equivalent to WebSocket Secure (wss).
diff --git a/docs/apig/umn/apig-faq-190803.html b/docs/apig/umn/apig-faq-190803.html
deleted file mode 100644
index 0e9eaf33..00000000
--- a/docs/apig/umn/apig-faq-190803.html
+++ /dev/null
@@ -1,20 +0,0 @@
-
-
-
Common FAQs
-
-
-
diff --git a/docs/apig/umn/apig-faq-191201.html b/docs/apig/umn/apig-faq-191201.html
index 82817e1b..b2c4dded 100644
--- a/docs/apig/umn/apig-faq-191201.html
+++ b/docs/apig/umn/apig-faq-191201.html
@@ -1,11 +1,11 @@
Can I Control Access to the Private IP Addresses of the ECSs in a VPC Channel (or Load Balance Channel)?
-
No.
+
diff --git a/docs/apig/umn/apig-faq-19122001.html b/docs/apig/umn/apig-faq-19122001.html
index e4ed75ce..700a79ab 100644
--- a/docs/apig/umn/apig-faq-19122001.html
+++ b/docs/apig/umn/apig-faq-19122001.html
@@ -1,11 +1,12 @@
Does APIG Support Persistent Connections?
-
Yes. But you should use persistent connections properly to avoid occupying too many resources.
+
Yes.
+
But you should use persistent connections properly to avoid occupying too many resources.
diff --git a/docs/apig/umn/apig-faq-19122002.html b/docs/apig/umn/apig-faq-19122002.html
index 6e74a113..b177b7a2 100644
--- a/docs/apig/umn/apig-faq-19122002.html
+++ b/docs/apig/umn/apig-faq-19122002.html
@@ -1,7 +1,7 @@
-
Does APIG Has Bandwidth Limits?
-
Dedicated gateways have bandwidth limits. When you create a dedicated gateway, you can set the bandwidth for public inbound and outbound access.
+
Does APIG Have Bandwidth Limits?
+
Dedicated gateways have bandwidth limits. When you create a dedicated gateway, you can set the bandwidth for public inbound and outbound access.
diff --git a/docs/apig/umn/apig-faq-19122003.html b/docs/apig/umn/apig-faq-19122003.html
index 754b6037..b0073d5f 100644
--- a/docs/apig/umn/apig-faq-19122003.html
+++ b/docs/apig/umn/apig-faq-19122003.html
@@ -1,11 +1,12 @@
Is There a Limit on the Size of the Response to an API Request?
-
No.
+
No.
+
But there is a limit on the size of the request body. For details, see the request_body_size parameter in the API Gateway User Guide.
diff --git a/docs/apig/umn/apig-faq-19122004.html b/docs/apig/umn/apig-faq-19122004.html
index 468b6b30..01dd9699 100644
--- a/docs/apig/umn/apig-faq-19122004.html
+++ b/docs/apig/umn/apig-faq-19122004.html
@@ -1,17 +1,17 @@
Why Doesn't Modification of the backend_timeout Parameter Take Effect?
-
Problem Description
Modification of the backend_timeout parameter in a dedicated gateway does not take effect.
+
Problem Description
Modification of the backend_timeout parameter in gateways does not take effect.
-
Possible Causes
The Timeout (ms) parameter on the Define Backend Request page is not modified.
+
Possible Causes
The Timeout (ms) parameter on the Define Backend Request page is not modified.
-
Solution
Log in to the APIG console, go to the API details page, click Edit, and modify the Timeout (ms) parameter on the Define Backend Request page.
+
Solution
Log in to the APIG console, go to the API details page, click Edit, and modify the Timeout (ms) parameter on the Define Backend Request page.
-
+
diff --git a/docs/apig/umn/apig-faq-19123001.html b/docs/apig/umn/apig-faq-19123001.html
index 2d6b1723..b0beac06 100644
--- a/docs/apig/umn/apig-faq-19123001.html
+++ b/docs/apig/umn/apig-faq-19123001.html
@@ -1,12 +1,12 @@
How Will the Requests for an API with Multiple Backend Policies Be Matched and Executed?
-
If multiple backend policies are configured for an API, APIG will match the backend policies in sequence. If an API request matches one of the backend policies, APIG immediately forwards the request to the corresponding backend and stops matching.
-
If no backend policy is matched, the API request is forwarded to the default backend server.
+
If multiple backend policies are configured for an API, APIG will match the backend policies in sequence. If an API request matches one of the backend policies, APIG immediately forwards the request to the corresponding backend and stops matching.
+
If no backend policy is matched, the API request is forwarded to the default backend server.
diff --git a/docs/apig/umn/apig-faq-19123002.html b/docs/apig/umn/apig-faq-19123002.html
index f9f4dab9..e3c2cb27 100644
--- a/docs/apig/umn/apig-faq-19123002.html
+++ b/docs/apig/umn/apig-faq-19123002.html
@@ -1,13 +1,13 @@
What Should I Do If "The API does not exist or has not been published in the environment." Is Displayed?
-
If an open API in APIG failed to be called, troubleshoot the failure by performing the following operations:
-
- The domain name, request method, or path used for calling the API is incorrect.
- For example, an API created using the POST method is called with GET.
- Missing a slash (/) in the access URL will lead to a failure in matching the URL in the API details. For example, URLs http://7383ea59c0cd49a2b61d0fd1d351a619.apigw.region.cloud.com/test/ and http://7383ea59c0cd49a2b61d0fd1d351a619.apigw.region.cloud.com/test represent two different APIs.
- - The API has not been published. APIs can be called only after they have been published in an environment. For details, see section "Publishing an API" in the User Guide. If the API has been published in a non-production environment, check whether the X-Stage header in the request is the name of the environment.
- The domain name is resolved incorrectly. If the domain name, request method, and path for calling the API are correct and the API has been published in an environment, the API may not be correctly resolved to the group to which the API belongs. For example, if you have multiple API groups and each group has an independent domain name, the API may be called using the independent domain name of another group. Ensure that the API is being called using the correct domain name.
- Check whether the API allows OPTIONS cross-region requests. If yes, enable cross-origin resource sharing (CORS) for the API, and create a new API that uses the OPTIONS method. For details, see section "CORS" in the User Guide.
+
If an open API in APIG failed to be called, troubleshoot the failure by performing the following operations:
+
- The domain name, request method, or path used for calling the API is incorrect.
- For example, an API created using the POST method is called with GET.
- Missing a slash (/) in the access URL will lead to a failure in matching the URL in the API details. For example, URLs http://7383ea59c0cd49a2b61d0fd1d351a619.apigw.region.cloud.com/test/ and http://7383ea59c0cd49a2b61d0fd1d351a619.apigw.region.cloud.com/test represent two different APIs.
+ - The API has not been published. APIs can be called only after they have been published in an environment. For details, see section "Publishing an API" in the API Gateway User Guide. If the API has been published in a non-production environment, check whether the X-Stage header in the request is the name of the environment.
- The domain name is resolved incorrectly. If the domain name, request method, and path for calling the API are correct and the API has been published in an environment, the API may not be correctly resolved to the group to which the API belongs. For example, if you have multiple API groups and each group has an independent domain name, the API may be called using the independent domain name of another group. Ensure that the API is being called using the correct domain name.
- Check whether the API allows OPTIONS cross-region requests. If yes, enable cross-origin resource sharing (CORS) for the API, and create an API that uses the OPTIONS method. For details, see section "CORS" in the API Gateway User Guide.
diff --git a/docs/apig/umn/apig-faq-2005001.html b/docs/apig/umn/apig-faq-2005001.html
index e622a1ae..a2360856 100644
--- a/docs/apig/umn/apig-faq-2005001.html
+++ b/docs/apig/umn/apig-faq-2005001.html
@@ -1,7 +1,8 @@
How Do I Define Response Codes for an API?
-
API responses are defined by backend services (API providers). API Gateway (APIG) only transparently transmits responses to API callers.
+
There are two types of responses:
+
- Gateway response codes: returned by the gateway for API requests that are throttled, denied, or failed in authentication. For details about these response codes, see section "Creating a Gateway Response" in the API Gateway User Guide.
- Backend service responses: defined by backend API services (API providers) and transparently transmitted by APIG.
diff --git a/docs/apig/umn/apig-faq-2005002.html b/docs/apig/umn/apig-faq-2005002.html
index 4d3d8ee6..e9845f0f 100644
--- a/docs/apig/umn/apig-faq-2005002.html
+++ b/docs/apig/umn/apig-faq-2005002.html
@@ -1,7 +1,8 @@
How Do I Specify the Host Port for a VPC Channel (or Load Balance Channel)?
-
Use the port of the API backend service.
+
Use the port of the API backend service.
+
For details about how to configure the API backend, see section "Creating an API" in the API Gateway User Guide.
diff --git a/docs/apig/umn/apig-faq-2005003.html b/docs/apig/umn/apig-faq-2005003.html
index 893a9c94..11f52d65 100644
--- a/docs/apig/umn/apig-faq-2005003.html
+++ b/docs/apig/umn/apig-faq-2005003.html
@@ -1,7 +1,7 @@
Can I Specify a Private Network Load Balancer Address for the Backend Service?
-
- For dedicated gateways, you can use private network load balancer addresses.
- Alternatively, you can use the EIP bound to a public network load balancer.
+
- For dedicated gateways, you can use private network load balancer addresses.
- Alternatively, you can use the EIP bound to a public network load balancer.
diff --git a/docs/apig/umn/apig-faq-2005004.html b/docs/apig/umn/apig-faq-2005004.html
index 6af7f168..6d4d860f 100644
--- a/docs/apig/umn/apig-faq-2005004.html
+++ b/docs/apig/umn/apig-faq-2005004.html
@@ -1,7 +1,8 @@
How Do I Set the Backend Address If I Will Not Use a VPC Channel (or Load Balance Channel)?
-
You can specify the backend address as a public domain name or a public IP address, such as the Elastic IP (EIP) of an Elastic Cloud Server (ECS).
+
Specify the backend address as a public domain name or a public IP address, such as the Elastic IP (EIP) of an Elastic Cloud Server (ECS). To do this, enable public outbound access for the gateway.
+
Use a private network IP address, not a private network domain name.
diff --git a/docs/apig/umn/apig-faq-2005006.html b/docs/apig/umn/apig-faq-2005006.html
index 3da51d1f..d4ef5768 100644
--- a/docs/apig/umn/apig-faq-2005006.html
+++ b/docs/apig/umn/apig-faq-2005006.html
@@ -1,9 +1,9 @@
Can I Specify the Backend Address as a Subnet IP Address?
-
If you use a dedicated gateway, you can specify either an IP address that belongs to the same subnet where the gateway is deployed, or the private address of a local data center connected to the gateway through Direct Connect.
-
Unsupported network segments:
-
- 0.0.0.0/8
- 10.0.0.0/8
- 100.125.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
- 172.16.0.0/12
- 192.0.0.0/24
- 192.0.2.0/24
- 192.88.99.0/24
- 192.168.0.0/16
- 198.18.0.0/15
- 198.51.100.0/24
- 203.0.113.0/24
- 224.0.0.0/4
- 240.0.0.0/4
- 255.255.255.255/32
+
If you use a dedicated gateway, you can specify either an IP address that belongs to the same subnet where the gateway is deployed, or the private address of a local data center connected to the gateway through Direct Connect.
+
Unsupported network segments:
+
- 0.0.0.0/8
- 10.0.0.0/8
- 100.125.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
- 172.16.0.0/12
- 192.0.0.0/24
- 192.0.2.0/24
- 192.88.99.0/24
- 192.168.0.0/16
- 198.18.0.0/15
- 198.51.100.0/24
- 203.0.113.0/24
- 224.0.0.0/4
- 240.0.0.0/4
- 255.255.255.255/32
diff --git a/docs/apig/umn/apig-faq-2005007.html b/docs/apig/umn/apig-faq-2005007.html
deleted file mode 100644
index ff8fcd1d..00000000
--- a/docs/apig/umn/apig-faq-2005007.html
+++ /dev/null
@@ -1,11 +0,0 @@
-
-
-
Why Can't I Create APIs?
-
The creation of APIs is free of charge. If you cannot create APIs, your account must be in arrears.
-
-
-
diff --git a/docs/apig/umn/apig-faq-2005008.html b/docs/apig/umn/apig-faq-2005008.html
index 31c24723..8ee6676e 100644
--- a/docs/apig/umn/apig-faq-2005008.html
+++ b/docs/apig/umn/apig-faq-2005008.html
@@ -1,8 +1,8 @@
How Do I Provide an Open API to Specific Users?
-
You can provide an open API to specific users in either of the following ways:
-
- Select app authentication when you create the API, and share the AppKey and AppSecret with the target users.
- Configure an access control policy to allow access from specific IP addresses or account names, and bind the access control policy to the API.
+
You can provide an open API to specific users in either of the following ways:
+
- Select app authentication when you create the API, and share the AppKey and AppSecret with the target users.
- Configure an access control policy to allow access from specific IP addresses or account names, and bind the access control policy to the API.
diff --git a/docs/apig/umn/apig-faq-2005009.html b/docs/apig/umn/apig-faq-2005009.html
index 5adb9c71..357830b1 100644
--- a/docs/apig/umn/apig-faq-2005009.html
+++ b/docs/apig/umn/apig-faq-2005009.html
@@ -1,9 +1,9 @@
What Should I Do After Applying for an Independent Domain Name?
-
If you are using a dedicated gateway, add an A record that points the independent domain name to the inbound access address of the gateway. You can bind five independent domain names to an API group but can bind each independent domain name only to one API group.
-
To use a public domain name, add an A record (dedicated gateway) in Domain Name Service (DNS).
-
To use a private domain name, add an A record (dedicated gateway) in the DNS service and associate the domain name with the VPC in which your backend service is located.
+
If you are using a dedicated gateway, add an A record that points the independent domain name to the inbound access address of the gateway. You can bind five independent domain names to an API group but can bind each independent domain name only to one API group.
+
To use a public domain name, add an A record (dedicated gateway) in Domain Name Service (DNS).
+
To use a private domain name, add an A record (dedicated gateway) in the DNS service and associate the domain name with the VPC in which your backend service is located.
diff --git a/docs/apig/umn/apig-faq-2005010.html b/docs/apig/umn/apig-faq-2005010.html
index cb1f5e1f..0ca374d5 100644
--- a/docs/apig/umn/apig-faq-2005010.html
+++ b/docs/apig/umn/apig-faq-2005010.html
@@ -1,23 +1,25 @@
What Are the Possible Causes for an API Calling Failure?
-
Network
API calling failures may occur in three scenarios: within a VPC, between VPCs, and on a public network.
+
Network
API calling failures may occur in three scenarios: within a VPC, between VPCs, and on a public network.
-
