通过流量管理类别中的政策，您可以通过 API 代理控制请求和响应消息的流。这些政策同时支持操作级和业务级控制。它们可让您控制原始吞吐量，还可以按应用控制流量。通过流量管理政策类型，您可以强制执行配额，还有助于减轻拒绝服务攻击的风险。
安全
安全类别中的政策支持身份验证、授权以及基于内容的安全措施。
中介
中介类别中的政策让您可以在消息流经 API 代理时主动对其执行操作。它们允许您将消息格式从 XML 转换为 JSON（反之亦然），或将一种 XML 格式转换为另一种 XML 格式。它们还可让您解析消息、生成新消息和更改出站消息的值。中介政策还与 Apigee 公开的基本服务进行交互，让您可以在运行时检索有关应用、开发者、安全令牌和 API 产品的数据。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-27。"],[[["\u003cp\u003eApigee utilizes policies, which are pre-built modules, to enable API behavior management without direct coding, offering features like security, rate-limiting, transformation, and mediation.\u003c/p\u003e\n"],["\u003cp\u003ePolicies in Apigee are XML-formatted configuration files, grouped into categories like Traffic Management, Security, Mediation, and Extension, each with distinct functions.\u003c/p\u003e\n"],["\u003cp\u003eTo apply a policy to an API proxy, it must be attached to a flow within the proxy, and subsequent policy modifications require deploying the API proxy revision to an environment to take effect.\u003c/p\u003e\n"],["\u003cp\u003eApigee policies can enforce conditions, such as quotas, and generate error messages that include a \u003ccode\u003efaultstring\u003c/code\u003e and an \u003ccode\u003eerrorcode\u003c/code\u003e, allowing for customized fault handling and responses.\u003c/p\u003e\n"],["\u003cp\u003eCommon policy sets in Apigee often include basic API key validation and transformations, with examples provided for both request and response flows, involving policies such as \u003ccode\u003eSpikeArrest\u003c/code\u003e, \u003ccode\u003eQuota\u003c/code\u003e, and \u003ccode\u003eResponseCache\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# What's a policy?\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nApigee enables you to *program* API behavior without writing any code, by using\n*policies*. A policy is like a module that implements a specific, limited management function.\nPolicies are designed to let you add common types of management capabilities to an API easily and\nreliably. Policies provide features like security, rate-limiting, transformation, and mediation\ncapabilities, saving you from having to code and maintain this functionality on your own.\n\nYou're not limited to the set of policy types provided by Apigee. You can also write\ncustom scripts and code (such as JavaScript applications), that extend API proxy\nfunctionality and enable you to innovate on top of the basic management capabilities supported by\nApigee policies.\n\nThis topic provides an overview of policy types and use in Apigee. For information on specific\npolicies, see the\n[Policies reference overview](/apigee/docs/api-platform/reference/policies/reference-overview-policy).\n\nPolicy types and categories\n---------------------------\n\nTechnically, a policy is an XML-formatted configuration file. Each policy's structure\n(for example, the required and optional configuration elements) is defined by an\n[XML schema](https://en.wikipedia.org/wiki/XML_schema). If you are proficient with XML tools,\nit is worthwhile to familiarize yourself with the policy schemas in the\n[API Platform samples](https://github.com/apigee/api-platform-samples/)\non GitHub.\n\nApigee policies are grouped into the following functional categories. The policies\navailable for each policy category are listed in the\n[Policy reference overview](/apigee/docs/api-platform/reference/policies/reference-overview-policy).\n\n### Traffic management\n\nPolicies in the traffic management category enable you to control the flow of request and\nresponse messages through an API proxy. These policies support both operational- and\nbusiness-level control. They give you control over raw throughput, and can also control traffic\non a per-app basis. Traffic management policy types enable you to enforce quotas, and they also\nhelp you to mitigate denial of service attacks.\n\n### Security\n\nPolicies in the security category support authentication, authorization, as well as\ncontent-based security.\n\n### Mediation\n\nPolicies in the mediation category enable you to actively manipulate messages as they flow\nthrough API proxies. They enable you to transform message formats, from XML to JSON (and\nvice-versa), or to transform one XML format to another XML format. They also enable you to\nparse messages, to generate new messages and to change values on outbound messages. Mediation\npolicies also interact with basic services exposed by Apigee, enabling you to retrieve data\nabout apps, developers, security tokens, and API products at runtime.\n\n### Extension\n\nPolicies in the extension category enable you to tap into the extensibility of Apigee to\nimplement custom behavior in the programming language of you choice.\n\nAttaching policies\n------------------\n\nIn order for a policy to apply to your API proxy, you must attach it to the proxy in a flow.\nFor information, see the other topics in this section, including\n[Attaching and configuring policies in the UI](/apigee/docs/api-platform/develop/attaching-and-configuring-policies-management-ui#new-proxy-editor)\nand\n[Attaching and configuring policies in XML files](/apigee/docs/api-platform/develop/attaching-and-configuring-policies-xml-files).\n\nDeploying policy changes\n------------------------\n\nFor policy changes to take effect, you must deploy the API proxy revision to an environment.\nAfter you attach a policy or make changes to an existing policy, use the Apigee UI or the\nApigee API to [deploy the changes](/apigee/docs/api-platform/deploy/ui-deploy-overview).\n\nVerifying policy enforcement\n----------------------------\n\nTo verify that a policy is enforced properly, the API must be invoked by an HTTP client. To\nverify a `Quota` configuration, set a quota (for example, at one request per minute),\nthen submit multiple requests to the API exceeding the quota limit\nthat you set in the quota policy. (The URI path, configured as the base path setting in the\nProxyEndpoint, in the request below is `/weather`). \n\n```scdoc\nhttp://ORG_NAME-test.apigee.net/weather/forecastrss?w=12797282\n```\n\nAfter you submit more than one request within a minute, you should see the following error\nmessage: \n\n```text\n{\n \"fault\":{\n \"faultstring\":\"policies.ratelimit.QuotaViolation\",\n \"detail\":{\n \"errorcode\":\"policies.ratelimit.QuotaViolation\"\n }\n }\n}\n```\n\nThis indicates that the `Quota` policy is being enforced by Apigee.\n\nPolicy-based fault handling\n---------------------------\n\nNote the format of the error message above. It contains a `faultstring` property\nand an `errorcode` property. In many cases, you need to implement some behavior to\nhandle these errors. For example, you may wish to issue a customized message to a developer whose\napp has exceeded the `Quota`.\n\nFor more on fault handling, see [Handling faults](/apigee/docs/api-platform/fundamentals/fault-handling).\n\nBest practices: Common policy sets\n----------------------------------\n\nTo meet basic management requirements, API proxies usually enforce the following policies:\n\n### Basic API key\nvalidation\n\n**ProxyEndpoint Request Flow:**\n\n1. `SpikeArrest`\n2. `XMLThreatProtection` or `JSONThreatProtection`\n3. API key validation\n4. `Quota`\n5. `ResponseCache`\n\n**ProxyEndpoint Response Flow:**\n\n1. `ResponseCache`\n\n### Basic transformation: JSON to\nXML\n\n**Request Flow:**\n\n1. `SpikeArrest`\n2. `JSONThreatProtection`\n3. API key validation\n4. `Quota`\n5. JSONToXML\n\n**Response Flow:**\n\n1. `XMLToJSON`\n2. `ResponseCache`"]]
