Rate limits are based on application subscriptions. They're not per user or per consumer org.

You could look at creating an application per ad group or something like that, but the apic rate limits would remain per application, you'd need to create the apps per group.

20 consumer orgs is not high, that's tiny, I have more than that on my test system ;-) 20,000 would be a large number of consumer orgs.

Email notifications on rate limits is not currently possible but it's being looked at - I'd suggest raising an rfe.

Id strongly recommend you use apic artifacts such as consumer orgs and apps how they're intended or you'll likely have issues down the line.

eg a consumer org only exists to share application credentials with other people. If you wouldn't tell someone your app keys then you shouldn't be in the same consumer org as that is literally the primary purpose of a consumer org.

Consumer org membership cannot be externalised to AD groups either.

that must be managed internally inside apic, but you could write scripts to make the internal membership match what you want.

Rate limits are based on application subscriptions. They're not per user or per consumer org.

You could look at creating an application per ad group or something like that, but the apic rate limits would remain per application, you'd need to create the apps per group.

20 consumer orgs is not high, that's tiny, I have more than that on my test system ;-) 20,000 would be a large number of consumer orgs.

Email notifications on rate limits is not currently possible but it's being looked at - I'd suggest raising an rfe.

Id strongly recommend you use apic artifacts such as consumer orgs and apps how they're intended or you'll likely have issues down the line.

eg a consumer org only exists to share application credentials with other people. If you wouldn't tell someone your app keys then you shouldn't be in the same consumer org as that is literally the primary purpose of a consumer org.

Hi Chris,

What do you mean to   make the internal membership match what we want? Do you mean match internal membership with Consumer organization AD group? 

Is it possible to share some sample scripts to make the internal membership match what we want? 

Consumer org membership cannot be externalised to AD groups either.

that must be managed internally inside apic, but you could write scripts to make the internal membership match what you want.

Rate limits are based on application subscriptions. They're not per user or per consumer org.

You could look at creating an application per ad group or something like that, but the apic rate limits would remain per application, you'd need to create the apps per group.

20 consumer orgs is not high, that's tiny, I have more than that on my test system ;-) 20,000 would be a large number of consumer orgs.

Email notifications on rate limits is not currently possible but it's being looked at - I'd suggest raising an rfe.

Id strongly recommend you use apic artifacts such as consumer orgs and apps how they're intended or you'll likely have issues down the line.

eg a consumer org only exists to share application credentials with other people. If you wouldn't tell someone your app keys then you shouldn't be in the same consumer org as that is literally the primary purpose of a consumer org.

APIC is only going to use its internal list of who is in what consumer org. It is not possible to delegate that to external AD groups. Essentially your external consumer org AD groups are meaningless to APIC and cannot be used for anything directly.

That means you need to make that internal list match your external server - maybe through some kind of cron that runs nightly to make sure that the membership is correct - create new users, remove old ones, etc... That script can use the APIC Provider API/CLI in order to modify the membership of consumer orgs. I'm afraid I don't have any examples, its not something I've ever tried to do.

Remember if you're putting more than 10 users in a consumer org you are probably doing it wrong - consumer orgs only exist to share credentials, so it is a bit of a give away if you have too many users in a single one.

You can always group consumer organizations together into "Groups" which can then be used for setting product visibility.

A reminder - rate limits apply at the application level. A subscription is a link between a given application and a specific product plan.

If you want to raise an RFE for externalising the consumer org membership to AD groups then please do.

Hi Chris,

What do you mean to   make the internal membership match what we want? Do you mean match internal membership with Consumer organization AD group? 

Is it possible to share some sample scripts to make the internal membership match what we want? 

Consumer org membership cannot be externalised to AD groups either.

that must be managed internally inside apic, but you could write scripts to make the internal membership match what you want.

Rate limits are based on application subscriptions. They're not per user or per consumer org.

You could look at creating an application per ad group or something like that, but the apic rate limits would remain per application, you'd need to create the apps per group.

20 consumer orgs is not high, that's tiny, I have more than that on my test system ;-) 20,000 would be a large number of consumer orgs.

Email notifications on rate limits is not currently possible but it's being looked at - I'd suggest raising an rfe.

Id strongly recommend you use apic artifacts such as consumer orgs and apps how they're intended or you'll likely have issues down the line.

eg a consumer org only exists to share application credentials with other people. If you wouldn't tell someone your app keys then you shouldn't be in the same consumer org as that is literally the primary purpose of a consumer org.

Hi Chris,

Thank you. Let me discuss with team to see if any further questions on this rate limit. 

APIC is only going to use its internal list of who is in what consumer org. It is not possible to delegate that to external AD groups. Essentially your external consumer org AD groups are meaningless to APIC and cannot be used for anything directly.

That means you need to make that internal list match your external server - maybe through some kind of cron that runs nightly to make sure that the membership is correct - create new users, remove old ones, etc... That script can use the APIC Provider API/CLI in order to modify the membership of consumer orgs. I'm afraid I don't have any examples, its not something I've ever tried to do.

Remember if you're putting more than 10 users in a consumer org you are probably doing it wrong - consumer orgs only exist to share credentials, so it is a bit of a give away if you have too many users in a single one.

You can always group consumer organizations together into "Groups" which can then be used for setting product visibility.

A reminder - rate limits apply at the application level. A subscription is a link between a given application and a specific product plan.

If you want to raise an RFE for externalising the consumer org membership to AD groups then please do.

Hi Chris,

What do you mean to   make the internal membership match what we want? Do you mean match internal membership with Consumer organization AD group? 

Is it possible to share some sample scripts to make the internal membership match what we want? 

Consumer org membership cannot be externalised to AD groups either.

that must be managed internally inside apic, but you could write scripts to make the internal membership match what you want.

Rate limits are based on application subscriptions. They're not per user or per consumer org.

You could look at creating an application per ad group or something like that, but the apic rate limits would remain per application, you'd need to create the apps per group.

20 consumer orgs is not high, that's tiny, I have more than that on my test system ;-) 20,000 would be a large number of consumer orgs.

Email notifications on rate limits is not currently possible but it's being looked at - I'd suggest raising an rfe.

Id strongly recommend you use apic artifacts such as consumer orgs and apps how they're intended or you'll likely have issues down the line.

eg a consumer org only exists to share application credentials with other people. If you wouldn't tell someone your app keys then you shouldn't be in the same consumer org as that is literally the primary purpose of a consumer org.

Hi Chris,

When storing analytic data, is it possible to enable request body and disable response body? 

Hi Chris,

Thank you. Let me discuss with team to see if any further questions on this rate limit. 

APIC is only going to use its internal list of who is in what consumer org. It is not possible to delegate that to external AD groups. Essentially your external consumer org AD groups are meaningless to APIC and cannot be used for anything directly.

That means you need to make that internal list match your external server - maybe through some kind of cron that runs nightly to make sure that the membership is correct - create new users, remove old ones, etc... That script can use the APIC Provider API/CLI in order to modify the membership of consumer orgs. I'm afraid I don't have any examples, its not something I've ever tried to do.

Remember if you're putting more than 10 users in a consumer org you are probably doing it wrong - consumer orgs only exist to share credentials, so it is a bit of a give away if you have too many users in a single one.

You can always group consumer organizations together into "Groups" which can then be used for setting product visibility.

A reminder - rate limits apply at the application level. A subscription is a link between a given application and a specific product plan.

If you want to raise an RFE for externalising the consumer org membership to AD groups then please do.

Hi Chris,

What do you mean to   make the internal membership match what we want? Do you mean match internal membership with Consumer organization AD group? 

Is it possible to share some sample scripts to make the internal membership match what we want? 

Consumer org membership cannot be externalised to AD groups either.

that must be managed internally inside apic, but you could write scripts to make the internal membership match what you want.

Rate limits are based on application subscriptions. They're not per user or per consumer org.

You could look at creating an application per ad group or something like that, but the apic rate limits would remain per application, you'd need to create the apps per group.

20 consumer orgs is not high, that's tiny, I have more than that on my test system ;-) 20,000 would be a large number of consumer orgs.

Email notifications on rate limits is not currently possible but it's being looked at - I'd suggest raising an rfe.

Id strongly recommend you use apic artifacts such as consumer orgs and apps how they're intended or you'll likely have issues down the line.

eg a consumer org only exists to share application credentials with other people. If you wouldn't tell someone your app keys then you shouldn't be in the same consumer org as that is literally the primary purpose of a consumer org.