API metadata is stored in CentraSite for each registered API-Portal. For each API-Portal, there is an API-Portal object registered. The API-Portal object has the type of API-Portal, which is a virtual type of type Gateway. An API-Portal is associated with an Organization. Multiple API-Portal instances can share the same Organization.

When an API is published to API-Portal, CentraSite creates a relationship between the API and the API-Portal object in the repository. An API can be published to multiple API-Portal instances.

When an API is unpublished (removed) from API-Portal, its metadata is deleted from the repository, and the API is no longer available from API-Portal. The API remains in CentraSite.

When an access token for an API is requested, CentraSite creates an AccessToken object in the repository and deploys it to the Mediator for run-time policy enforcement. This object is associated with the API-Portal object through a requested relationship. For the requesting user, a User object is created within the Organization associated with API-Portal. The User object is created as soon as a user requests an access token for the first time. The User object is deleted when no more AccessTokens exist.