Expose an existing API through HTTP Inbound Endpoint - wso2

Question

I have an API deployed en wso2 ESB500. Just take this as an example.
<api xmlns="http://ws.apache.org/ns/synapse" name="patient" context="/patient">
<resource methods="GET" uri-template="/{patientID}">
<inSequence>
<payloadFactory media-type="text">
<format>I am patient $1</format>
<args>
<arg evaluator="xml" expression="get-property('uri.var.patientID')"/>
</args>
</payloadFactory>
<respond/>
</inSequence>
</resource>
</api>
I have the requirement to expose it in three different ways. One in plain HTTP, one way HTTPS and two way HTTPS. So there are 3 kind of consumers for the API, non-secured ones, secured ones, and "doubled" secured ones.
Multi-HTTPS is not an option as we are not able to start the ESB with different listening interfaces. So I have decided to expose the original API through three different HTTP Inbound Endpoints
This one exposes the API in regular HTTP
<?xml version="1.0" encoding="UTF-8"?>
<inboundEndpoint xmlns="http://ws.apache.org/ns/synapse"
name="http"
protocol="http"
suspend="false">
<parameters>
<parameter name="inbound.http.port">40000</parameter>
<parameter name="dispatch.filter.pattern">/patient/.*</parameter>
</parameters>
</inboundEndpoint>
This other one exposes the API in one way HTTPS
<?xml version="1.0" encoding="UTF-8"?>
<inboundEndpoint xmlns="http://ws.apache.org/ns/synapse"
name="oneWayHttps"
protocol="https"
suspend="false">
<parameters>
<parameter name="inbound.http.port">40001</parameter>
<parameter name="keystore">
<KeyStore xmlns="">
<Location>repository/resources/security/wso2carbon0.jks</Location>
<Type>JKS</Type>
<Password>wso2carbon</Password>
<KeyPassword>wso2carbon</KeyPassword>
</KeyStore>
</parameter>
<parameter name="dispatch.filter.pattern">/patient/.*</parameter>
</parameters>
</inboundEndpoint>
And two way HTTPS finally
<?xml version="1.0" encoding="UTF-8"?>
<inboundEndpoint xmlns="http://ws.apache.org/ns/synapse"
name="twoWayHttps"
protocol="https"
suspend="false">
<parameters>
<parameter name="inbound.http.port">40002</parameter>
<parameter name="keystore">
<KeyStore xmlns="">
<Location>repository/resources/security/wso2carbon1.jks</Location>
<Type>JKS</Type>
<Password>wso2carbon</Password>
<KeyPassword>wso2carbon</KeyPassword>
</KeyStore>
</parameter>
<parameter name="truststore">
<TrustStore xmlns="">
<Location>repository/resources/security/client-truststore.jks</Location>
<Type>JKS</Type>
<Password>wso2carbon</Password>
</TrustStore>
</parameter>
<parameter name="SSLVerifyClient">require</parameter>
<parameter name="dispatch.filter.pattern">/patient/[0-9]+</parameter>
</parameters>
</inboundEndpoint>
Everything works perfect. I give each client a different port and they are happy. But I have noticed the original API is still exposed through the transportReceiver configured in the axis2.xml file. So I would it like to be hidden, nobody should be calling it directly, but through the Inbounds. I know you can achieve this using firewall or load balancers. But I would like to know if there is a way to achieve it using an ESB solution.
I have thougth about inserting a property inside the inboud endpoint and check for its existance in the API itself. But it is not working for me as it seems the sequence for the inbound Endpoint is only executed when there is no dispatch.filter.pattern.
From the docs
The regular expression that defines the proxy services and API's to
expose via the inbound endpoint. Provide the .* expression to expose
all proxy services and API's or provide an expression similar to
^(/foo|/bar|/services/MyProxy)$ to define a set of services to expose
via the inbound endpoint. If you do not provide an expression only the
defined sequence of the inbound endpoint will be accessible.
So here I ask a lot of questions. But I believe the most important one is whenever I have an already deployed API en the ESB, how can I expose it in http, https one-way and mutual? and how can I hide the original API?
EDIT, the inbound.only parameter seems to be exactly what I am looking for. Unfortunately it is only available for proxy services, not API. Besides according to the documentation it can only be used in HTTP Inbound, not HTTPS.

Answer 1

You can expose not only APIs but also proxy services through the inbound endpoints. Here for the proxy services, there is a parameter inbound.only which allows only the inbound endpoint to invoke the proxy service. This parameter seems to be available only for the proxy services [1]. Refer to the following sample configuration
<?xml version="1.0" encoding="UTF-8"?>
<proxy xmlns="http://ws.apache.org/ns/synapse"
name="patient"
startOnLoad="true"
statistics="disable"
trace="disable"
transports="http,https">
<target>
<inSequence>
<log level="custom">
<property name="--Proxy--" value="invoked"/>
</log>
<respond/>
</inSequence>
</target>
<parameter name="inbound.only">true</parameter>
<description/>
</proxy>
[1]- https://docs.wso2.com/display/EI660/HTTP+Inbound+Protocol