anchor.diff:   https://127.0.0.1:8443/apiman-gateway/Newcastle/EchoService/2.0/rincewind/wizard
   {
     "method" : "GET",
  -  "resource" : "/services/echo/rincewind/wizard",
  -  "uri" : "/services/echo/rincewind/wizard",
  +  "resource" : "/apiman-echo/rincewind/wizard",
  +  "uri" : "/apiman-echo/rincewind/wizard",
     "headers" : {
       "Authorization" : "Bearer eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJmODAyZjFmMy1kN2JmLTQ0YjQtODA2N...",
       "Host" : "127.0.0.1:8080",
  
positive.code: 
  First, log into apiman, and *Create a New Organization*; let's call it *_Newcastle_*. Select the *Services* tab, and add a *New Service*; we'll name this one *_EchoService_* and then *Create Service*.
  
  Select the *Implementation* tab, and set the endpoint to our echo service, `http://localhost:8080/services/echo`. Save and move onto the *Plans* tab, where you should opt to *Make this service public*. After saving, we can move onto the *Policies* tab, where the interesting stuff starts.
  
  Navigate to *Add Policy*, and select *Keycloak OAuth Policy* from the drop-down list. A substantial set of options are available for your perusal, but for the purposes of this blog demo we'll set the following:
  
  
negative.code: 
  == Preparation
  
  For this example, let's assume we're using apiman's http://www.apiman.io/latest/download.html[quickstart] setup and have it running. I suggest using the _'Or simply try this...'_ box.
  
  After you have your apiman quickstart running (replace *apiman-1.1.3.Final* in the path below with whatever version you downloaded), we can live deploy a handy *echo service* into our environment so we have something to test against:
  
  ```ShellSession
  cd ~/apiman-1.1.3.Final/wildfly-8.2.0.Final/apiman/quickstarts/echo-service/
  mvn clean install
  mvn wildfly:deploy
  ```
  
  == Installing the Plugin
  