anchor.diff:  
   API Metrics can be accessed in the Management UI and through the REST API. The metrics are displayed visually in the Management UI, for example:
   
  -image::images/apiman_007.jpg[metrics]
  +image::images/apiman_007.png[metrics]
   
   == Section 4 - Consuming APIs
   === Invoking Managed APIs
  
positive.code: 
  The best way to start our discussion of the different, but complementary types of security that we’ll examine in this article is with a diagram. The nodes involved are the client applications that will access our APIs, the apiman API Gateway, and the servers that host our APIs:
  
  image::images/apiman_006.jpg[]
  
  Let’s work our way through the diagram from left to right and start by taking a look at Policy Level Security.
  
  
negative.code: 
  What happens first is that the authentication policy is applied and a login dialog is then displayed:
  
  image::images/example/35.png[Auth popup prompt]
  
  Enter the username and password (user1/password) that we defined when we created the authentication policy to access the API. The fact that you are seeing this dialog confirms that you are accessing the managed API and are not accessing the API directly.
  
  When you send a GET request to the API, you should see a successful response:
  
  [source, json]
  ----
  {
   "method" : "GET",
  