流量管理類別中的政策可讓您控管要求和回應訊息在 API Proxy 中的流動。這些政策支援作業和業務層級的控管。可讓您控管原始輸送量，也能以應用程式為單位控管流量。流量管理政策類型可讓您強制執行配額，也有助於防範阻斷服務攻擊。
安全性
安全類別的政策支援驗證、授權，以及以內容為基礎的安全防護。
中介服務
中介服務類別的政策可讓您在訊息流經 API Proxy 時，主動操控訊息。您可以透過這些轉換器，將訊息格式從 XML 轉換為 JSON (反之亦然)，或是將一種 XML 格式轉換為另一種 XML 格式。您也可以使用這些閘道剖析郵件、產生新郵件，以及變更外寄郵件的值。中介服務政策也會與 Apigee 公開的基本服務互動，讓您在執行階段擷取應用程式、開發人員、安全權杖和 API 產品的相關資料。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[[["\u003cp\u003eApigee utilizes policies, which are pre-built modules, to enable API behavior management without direct coding, offering features like security, rate-limiting, transformation, and mediation.\u003c/p\u003e\n"],["\u003cp\u003ePolicies in Apigee are XML-formatted configuration files, grouped into categories like Traffic Management, Security, Mediation, and Extension, each with distinct functions.\u003c/p\u003e\n"],["\u003cp\u003eTo apply a policy to an API proxy, it must be attached to a flow within the proxy, and subsequent policy modifications require deploying the API proxy revision to an environment to take effect.\u003c/p\u003e\n"],["\u003cp\u003eApigee policies can enforce conditions, such as quotas, and generate error messages that include a \u003ccode\u003efaultstring\u003c/code\u003e and an \u003ccode\u003eerrorcode\u003c/code\u003e, allowing for customized fault handling and responses.\u003c/p\u003e\n"],["\u003cp\u003eCommon policy sets in Apigee often include basic API key validation and transformations, with examples provided for both request and response flows, involving policies such as \u003ccode\u003eSpikeArrest\u003c/code\u003e, \u003ccode\u003eQuota\u003c/code\u003e, and \u003ccode\u003eResponseCache\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# What's a policy?\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nApigee enables you to *program* API behavior without writing any code, by using\n*policies*. A policy is like a module that implements a specific, limited management function.\nPolicies are designed to let you add common types of management capabilities to an API easily and\nreliably. Policies provide features like security, rate-limiting, transformation, and mediation\ncapabilities, saving you from having to code and maintain this functionality on your own.\n\nYou're not limited to the set of policy types provided by Apigee. You can also write\ncustom scripts and code (such as JavaScript applications), that extend API proxy\nfunctionality and enable you to innovate on top of the basic management capabilities supported by\nApigee policies.\n\nThis topic provides an overview of policy types and use in Apigee. For information on specific\npolicies, see the\n[Policies reference overview](/apigee/docs/api-platform/reference/policies/reference-overview-policy).\n\nPolicy types and categories\n---------------------------\n\nTechnically, a policy is an XML-formatted configuration file. Each policy's structure\n(for example, the required and optional configuration elements) is defined by an\n[XML schema](https://en.wikipedia.org/wiki/XML_schema). If you are proficient with XML tools,\nit is worthwhile to familiarize yourself with the policy schemas in the\n[API Platform samples](https://github.com/apigee/api-platform-samples/)\non GitHub.\n\nApigee policies are grouped into the following functional categories. The policies\navailable for each policy category are listed in the\n[Policy reference overview](/apigee/docs/api-platform/reference/policies/reference-overview-policy).\n\n### Traffic management\n\nPolicies in the traffic management category enable you to control the flow of request and\nresponse messages through an API proxy. These policies support both operational- and\nbusiness-level control. They give you control over raw throughput, and can also control traffic\non a per-app basis. Traffic management policy types enable you to enforce quotas, and they also\nhelp you to mitigate denial of service attacks.\n\n### Security\n\nPolicies in the security category support authentication, authorization, as well as\ncontent-based security.\n\n### Mediation\n\nPolicies in the mediation category enable you to actively manipulate messages as they flow\nthrough API proxies. They enable you to transform message formats, from XML to JSON (and\nvice-versa), or to transform one XML format to another XML format. They also enable you to\nparse messages, to generate new messages and to change values on outbound messages. Mediation\npolicies also interact with basic services exposed by Apigee, enabling you to retrieve data\nabout apps, developers, security tokens, and API products at runtime.\n\n### Extension\n\nPolicies in the extension category enable you to tap into the extensibility of Apigee to\nimplement custom behavior in the programming language of you choice.\n\nAttaching policies\n------------------\n\nIn order for a policy to apply to your API proxy, you must attach it to the proxy in a flow.\nFor information, see the other topics in this section, including\n[Attaching and configuring policies in the UI](/apigee/docs/api-platform/develop/attaching-and-configuring-policies-management-ui#new-proxy-editor)\nand\n[Attaching and configuring policies in XML files](/apigee/docs/api-platform/develop/attaching-and-configuring-policies-xml-files).\n\nDeploying policy changes\n------------------------\n\nFor policy changes to take effect, you must deploy the API proxy revision to an environment.\nAfter you attach a policy or make changes to an existing policy, use the Apigee UI or the\nApigee API to [deploy the changes](/apigee/docs/api-platform/deploy/ui-deploy-overview).\n\nVerifying policy enforcement\n----------------------------\n\nTo verify that a policy is enforced properly, the API must be invoked by an HTTP client. To\nverify a `Quota` configuration, set a quota (for example, at one request per minute),\nthen submit multiple requests to the API exceeding the quota limit\nthat you set in the quota policy. (The URI path, configured as the base path setting in the\nProxyEndpoint, in the request below is `/weather`). \n\n```scdoc\nhttp://ORG_NAME-test.apigee.net/weather/forecastrss?w=12797282\n```\n\nAfter you submit more than one request within a minute, you should see the following error\nmessage: \n\n```text\n{\n \"fault\":{\n \"faultstring\":\"policies.ratelimit.QuotaViolation\",\n \"detail\":{\n \"errorcode\":\"policies.ratelimit.QuotaViolation\"\n }\n }\n}\n```\n\nThis indicates that the `Quota` policy is being enforced by Apigee.\n\nPolicy-based fault handling\n---------------------------\n\nNote the format of the error message above. It contains a `faultstring` property\nand an `errorcode` property. In many cases, you need to implement some behavior to\nhandle these errors. For example, you may wish to issue a customized message to a developer whose\napp has exceeded the `Quota`.\n\nFor more on fault handling, see [Handling faults](/apigee/docs/api-platform/fundamentals/fault-handling).\n\nBest practices: Common policy sets\n----------------------------------\n\nTo meet basic management requirements, API proxies usually enforce the following policies:\n\n### Basic API key\nvalidation\n\n**ProxyEndpoint Request Flow:**\n\n1. `SpikeArrest`\n2. `XMLThreatProtection` or `JSONThreatProtection`\n3. API key validation\n4. `Quota`\n5. `ResponseCache`\n\n**ProxyEndpoint Response Flow:**\n\n1. `ResponseCache`\n\n### Basic transformation: JSON to\nXML\n\n**Request Flow:**\n\n1. `SpikeArrest`\n2. `JSONThreatProtection`\n3. API key validation\n4. `Quota`\n5. JSONToXML\n\n**Response Flow:**\n\n1. `XMLToJSON`\n2. `ResponseCache`"]]
