Administration

Domain management

The product organizes discovered endpoints by domain (host header). Domains can be enabled or disabled to control which traffic is analyzed and stored.

Figure 5. The Domains page lists active and disabled domains. Each domain can be disabled or deleted.

To manage domains:

1. Go to Manage > Domains.

2. To pause analysis for a domain while retaining its historical data, select Disable.

3. To remove a domain and all of its associated data, select Delete.

4. To manually add a domain that has not yet been observed in traffic, select Add Domain.

Disabled domains appear in the Disabled Domains section at the bottom of the page.

User management

The product supports local user accounts with role-based access.

Figure 6. The Users page allows the administrator to create, edit, and remove local user accounts.

Roles

Role	Capabilities
Admin	Full access, including configuration, user management, licensing, BIG-IP integration, and all operational tasks
Maintainer	Operational access, including domain management, API discovery rules, and enforcement actions; cannot manage users or licenses
Viewer	Read-only access to the dashboard, endpoint inventory, and exports

Manage users

To manage users:

1. Go to System > Users.

2. To add a user, complete the inline form with Username, Role (Admin, Maintainer, or Viewer), and Password, then select Add.

3. To modify an existing user, select Edit in the Actions column.

4. From System > Users, generate an MCP Token for any user via the MCP Token action. You must have Admin privileges. The token allows AI agents and MCP clients to connect to the MCP Server. The user’s current role is embedded in the token. The token is shown only once and cannot be retrieved later. It must be copied and stored immediately. The token can be revoked at any time. Usage: the token is used as Authorization: Bearer <token> in the MCP client.

Important

Change the default admin password on first log in attempt.

Recovery Key (Admin account)

• The admin account has a Recovery Key — a one-time emergency credential used to regain access to the admin account if all other recovery options are exhausted.

• The Admin generates the Recovery Key in advance from System → Users via the Recovery Key action, and stores it in a secure, offline location.

• Generating a new Recovery Key permanently invalidates the previous one. The key is shown only once.

• If the admin password is lost, the admin uses Forgot Password on the login screen and the Recovery Key to regain access.

Important

The Recovery Key must be treated with the same level of security as a root credential. Do not store it alongside the password or on the same device used to log in.

API Discovery Policy

API Discovery Rules (Policy)

API Discovery Rules determine how traffic is classified and which actions are taken. Rules are evaluated top-down; the first matching rule is applied.

Figure 7. The Policy page displays ordered API Discovery Rules. The implied rule at the bottom always runs and is managed by backend defaults.

A rule consists of:

Field	Purpose
Name	Human-readable identifier for the rule
Domains	Scope of domains the rule applies to
Condition	Match criteria, edited through the View / Edit Condition button
Action	Action to take when the rule matches (for example, NON-API)
Comment	Optional free-text comment

The implied rule at the bottom always runs and is managed by backend defaults. After modifying rules, select Apply Rules to commit the changes.

Dynamic Path Templates

Dynamic Path Templates give you precise control over how API paths with dynamic segments are grouped into endpoints. They override the automatic dynamic-path pruner for matching API traffic.

By default, API Security automatically normalizes dynamic path segments — for example, grouping /users/123 and /users/456 into a single endpoint /users/$DYN$. Dynamic Path Templates let you tune this behavior when the automatic grouping is too broad or too narrow, improving discovery accuracy and reducing false positives.

 Figure 6.2 — Creating a Dynamic Path Template. Each path segment is assigned a type, and sample paths show a live preview of what matches.

#### How Dynamic Path Templates Work

• Templates run after Classification Rules, and only on traffic that has been classified as API traffic.

• Each template defines a route pattern in which every path segment is assigned a type.

• Matching paths are grouped into a single endpoint according to the template.

• Templates are evaluated in order; a new template is inserted at the top of the list.

#### Segment Types

When you define a route template, each segment of the path is assigned one of the following types:

<table border=”1” class=”docutils”> <thead> <tr> <th>Segment Type</th> <th>Meaning</th> <th>Example</th> </tr> </thead> <tbody> <tr> <td><strong>Static (exact match)</strong></td> <td>The segment must match exactly</td> <td><code>api</code>, <code>v1</code>, <code>product</code></td> </tr> <tr> <td><strong>Dynamic (any value)</strong></td> <td>Matches any value in this segment (<code>*</code>)</td> <td>any string or number</td> </tr> <tr> <td><strong>Dynamic (number only)</strong></td> <td>Matches numeric values only (<code>{int}</code>)</td> <td><code>101</code>, <code>202</code></td> </tr> <tr> <td><strong>Dynamic (text only)</strong></td> <td>Matches text values only</td> <td><code>profile</code>, <code>settings</code></td> </tr> <tr> <td><strong>Any number — separate endpoint per value</strong></td> <td>Each distinct value becomes its own endpoint (<code>{int:split}</code>)</td> <td><code>101</code> and <code>202</code> become separate endpoints</td> </tr> </tbody> </table>

Note: A template with only static segments still pins that exact path. The first segment must be static.

#### Create a Dynamic Path Template

1. Navigate to Manage → API Discovery Policy → Dynamic Path Templates.

2. Click to add a new route (Add API Dyn Route).

3. Enter a Name (required) and an optional Comment.

4. Define the Route template — for example, /api/v1/product/item/{int}. The editor lists each segment.

5. For each segment, choose a type from the list (Static, Dynamic any value, Dynamic number only, Dynamic text only, or Any number — separate endpoint per value).

6. Optionally enter Sample paths (one per line) to preview how the template behaves. The preview shows which paths match and which do not, and the resulting endpoint that will be created.

7. Optionally scope the template to specific HTTP Methods and Domains (both default to all).

8. Save the route.

#### Example

For the route template /api/v1/product/item/{int} with the final segment typed as Dynamic (number only):

• /api/v1/product/item/101 → matches → grouped as /api/v1/product/item/$DYN$

• /api/v1/product/item/202 → matches → grouped as /api/v1/product/item/$DYN$

• /api/v1/product/item/303 → matches → grouped as /api/v1/product/item/$DYN$

• /api/v1/product/item/101/extra → does not match (extra segment)

Result: a single dynamic endpoint /api/v1/product/item/$DYN$ that absorbs the matching numeric paths (101, 202, 303).