anchor.diff:  
   To configure the API, we’ll first create a plan to contain the policies that we want applied by the API Gateway at runtime when requests to the API are made. To create a new plan, select the “Plans” tab. We’ll create a “gold” plan:
   
  -image::images/11.png[ExampleImage_11]
  +image::images/example/11.png[Add a new plan]
   
   Once the plan is created, we will add policies to it:
   
  -image::images/12.png[ExampleImage_12]
  +image::images/example/12.png[Add a policy]
   
   apiman provides several OOTB policies/plans. Since we want to be able to demonstrate a policy being applied, we’ll select a Rate Limiting Policy, and set its limit to a very low level. If our API receives more than 10 requests in a day/month, the policy should block all subsequent requests. So much for a “gold” level of API!
   
  -image::images/13.png[ExampleImage_13]
  +image::images/example/13.png[Add and configure rate limiting]
   
   After we create the policy and add it to the plan, we have to lock the plan:
   
  -image::images/14.png[ExampleImage_14]
  +image::images/example/14.png[Lock the plan]
   
   And, here is the finished, and locked plan:
   
  -image::images/15.png[ExampleImage_15]
  +image::images/example/15.png[Plan status is "locked"]
   
   At this point, additional plans can be defined for the API. We’ll also create a “silver” plan, that will offer a lower level of API (i.e., a request rate limit lower than 10 per day/month) than the gold plan. Since the process to create this silver plan is identical to that of the gold plan, we’ll skip the screenshots.
   
   Now that the two plans are complete and locked, it’s time to define the API.
   
  -image::images/16.png[ExampleImage_16]
  +image::images/example/16.png[APIs tab]
   
   We’ll give the API an appropriate name, so that providers and consumers alike will be able to run a query in the API Manager to find it.
   
  -image::images/17.png[ExampleImage_17]
  +image::images/example/17.png[Add an API]
   
   After the API is defined, we have to define its implementation. In the context of the API Manager, the API Endpoint is the API’s direct URL. Remember that the API Gateway will act as a proxy for the API, so it must know the API’s actual URL. In the case of our example API, the URL is:  +++<u>+++http://localhost:8080/apiman-echo+++</u>+++
   
  -image::images/18.png[ExampleImage_18]
  +image::images/example/18.png[Add implementation information]
   
   The plans tab shows which plans are available to be applied to the API:
   
  -image::images/19.png[ExampleImage_19]
  +image::images/example/19.png[Make API available via available plans]
   
   Let’s make our API more secure by adding an authentication policy that will require users to login before they can access the API. Select the Policies tab, and then define a simple authentication policy. Remember the user name and password that you define here as we’ll need them later on when send requests to the API.
   
  -image::images/20.png[ExampleImage_20]
  +image::images/example/20.png[Add and configure a BASIC auth policy]
   
   After the authentication policy is added, we can publish the API to the API Gateway:
   
  -image::images/21.png[ExampleImage_21]
  +image::images/example/21.png[Added the policy]
   
   And, here it is, the published API:
   
  -image::images/22.png[ExampleImage_22]
  +image::images/example/22.png[Publish the API, API status is "Published"]
   
   OK, that finishes the definition of the API provider organization and the publication of the API.
   
  
positive.code: 
  To create the API provider organization, log back into the API Manager UI as the apiprov user and select “Create a new Organization”:
  
  image::images/8a.png[ExampleImage_8a]
  
  Select a name and description for the organization, and press “Create Organization”:
  
  image::images/9.png[ExampleImage_9]
  
  And, here’s our organization:
  
  image::images/10.png[ExampleImage_10]
  
  Note that in a production environment, users would request membership in an organization. The approval process for accepting new members into an organization would follow the organization's workflow, but this would be handled outside of the API Manager API. For the purposes of our demonstration, we'll keep things simple.
  
  
negative.code: 
  The best way to start our discussion of the different, but complementary types of security that we’ll examine in this article is with a diagram. The nodes involved are the client applications that will access our APIs, the apiman API Gateway, and the servers that host our APIs:
  
  image::images/apiman_006.png[]
  
  Let’s work our way through the diagram from left to right and start by taking a look at Policy Level Security.
  
  