Apigee では、ポリシーを使用することにより、コードを記述することなく API の動作をプログラムできます。ポリシーは、特定の限定された管理機能を実装するモジュールのようなものです。ポリシーにより、一般的な管理機能を API に簡単に追加できます。ポリシーによって、セキュリティ、レート制限、変換、メディエーションの機能などが提供され、自身でコーディングやメンテナンスを行う必要がなくなります。
技術的には、ポリシーは XML 形式の構成ファイルです。各ポリシーの構造（必要な構成要素や任意の構成要素など）は、XML スキーマによって定義されます。XML ツールを使い慣れている場合は、GitHub の API Platform サンプルのポリシー スキーマをよく理解しておくことをおすすめします。
仲介カテゴリのポリシーでは、API プロキシ内のフローを通過するメッセージをアクティブに操作できます。このポリシーにより、メッセージ形式を XML から JSON（またはその逆）に変換でき、特定の XML 形式を別の XML 形式に変換することもできます。また、メッセージの解析、新しいメッセージの生成、送信メッセージの値の変更もできます。さらに、メディエーション ポリシーは、Apigee によって公開される基本的なサービスともやり取りして、アプリ、デベロッパー、セキュリティ トークン、API プロダクトに関するデータを実行時に取得できます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-18 UTC。"],[[["\u003cp\u003eApigee utilizes policies, which are pre-built modules, to enable API behavior management without direct coding, offering features like security, rate-limiting, transformation, and mediation.\u003c/p\u003e\n"],["\u003cp\u003ePolicies in Apigee are XML-formatted configuration files, grouped into categories like Traffic Management, Security, Mediation, and Extension, each with distinct functions.\u003c/p\u003e\n"],["\u003cp\u003eTo apply a policy to an API proxy, it must be attached to a flow within the proxy, and subsequent policy modifications require deploying the API proxy revision to an environment to take effect.\u003c/p\u003e\n"],["\u003cp\u003eApigee policies can enforce conditions, such as quotas, and generate error messages that include a \u003ccode\u003efaultstring\u003c/code\u003e and an \u003ccode\u003eerrorcode\u003c/code\u003e, allowing for customized fault handling and responses.\u003c/p\u003e\n"],["\u003cp\u003eCommon policy sets in Apigee often include basic API key validation and transformations, with examples provided for both request and response flows, involving policies such as \u003ccode\u003eSpikeArrest\u003c/code\u003e, \u003ccode\u003eQuota\u003c/code\u003e, and \u003ccode\u003eResponseCache\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# What's a policy?\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\nApigee enables you to *program* API behavior without writing any code, by using\n*policies*. A policy is like a module that implements a specific, limited management function.\nPolicies are designed to let you add common types of management capabilities to an API easily and\nreliably. Policies provide features like security, rate-limiting, transformation, and mediation\ncapabilities, saving you from having to code and maintain this functionality on your own.\n\nYou're not limited to the set of policy types provided by Apigee. You can also write\ncustom scripts and code (such as JavaScript applications), that extend API proxy\nfunctionality and enable you to innovate on top of the basic management capabilities supported by\nApigee policies.\n\nThis topic provides an overview of policy types and use in Apigee. For information on specific\npolicies, see the\n[Policies reference overview](/apigee/docs/api-platform/reference/policies/reference-overview-policy).\n\nPolicy types and categories\n---------------------------\n\nTechnically, a policy is an XML-formatted configuration file. Each policy's structure\n(for example, the required and optional configuration elements) is defined by an\n[XML schema](https://en.wikipedia.org/wiki/XML_schema). If you are proficient with XML tools,\nit is worthwhile to familiarize yourself with the policy schemas in the\n[API Platform samples](https://github.com/apigee/api-platform-samples/)\non GitHub.\n\nApigee policies are grouped into the following functional categories. The policies\navailable for each policy category are listed in the\n[Policy reference overview](/apigee/docs/api-platform/reference/policies/reference-overview-policy).\n\n### Traffic management\n\nPolicies in the traffic management category enable you to control the flow of request and\nresponse messages through an API proxy. These policies support both operational- and\nbusiness-level control. They give you control over raw throughput, and can also control traffic\non a per-app basis. Traffic management policy types enable you to enforce quotas, and they also\nhelp you to mitigate denial of service attacks.\n\n### Security\n\nPolicies in the security category support authentication, authorization, as well as\ncontent-based security.\n\n### Mediation\n\nPolicies in the mediation category enable you to actively manipulate messages as they flow\nthrough API proxies. They enable you to transform message formats, from XML to JSON (and\nvice-versa), or to transform one XML format to another XML format. They also enable you to\nparse messages, to generate new messages and to change values on outbound messages. Mediation\npolicies also interact with basic services exposed by Apigee, enabling you to retrieve data\nabout apps, developers, security tokens, and API products at runtime.\n\n### Extension\n\nPolicies in the extension category enable you to tap into the extensibility of Apigee to\nimplement custom behavior in the programming language of you choice.\n\nAttaching policies\n------------------\n\nIn order for a policy to apply to your API proxy, you must attach it to the proxy in a flow.\nFor information, see the other topics in this section, including\n[Attaching and configuring policies in the UI](/apigee/docs/api-platform/develop/attaching-and-configuring-policies-management-ui#new-proxy-editor)\nand\n[Attaching and configuring policies in XML files](/apigee/docs/api-platform/develop/attaching-and-configuring-policies-xml-files).\n\nDeploying policy changes\n------------------------\n\nFor policy changes to take effect, you must deploy the API proxy revision to an environment.\nAfter you attach a policy or make changes to an existing policy, use the Apigee UI or the\nApigee API to [deploy the changes](/apigee/docs/api-platform/deploy/ui-deploy-overview).\n\nVerifying policy enforcement\n----------------------------\n\nTo verify that a policy is enforced properly, the API must be invoked by an HTTP client. To\nverify a `Quota` configuration, set a quota (for example, at one request per minute),\nthen submit multiple requests to the API exceeding the quota limit\nthat you set in the quota policy. (The URI path, configured as the base path setting in the\nProxyEndpoint, in the request below is `/weather`). \n\n```scdoc\nhttp://ORG_NAME-test.apigee.net/weather/forecastrss?w=12797282\n```\n\nAfter you submit more than one request within a minute, you should see the following error\nmessage: \n\n```text\n{\n \"fault\":{\n \"faultstring\":\"policies.ratelimit.QuotaViolation\",\n \"detail\":{\n \"errorcode\":\"policies.ratelimit.QuotaViolation\"\n }\n }\n}\n```\n\nThis indicates that the `Quota` policy is being enforced by Apigee.\n\nPolicy-based fault handling\n---------------------------\n\nNote the format of the error message above. It contains a `faultstring` property\nand an `errorcode` property. In many cases, you need to implement some behavior to\nhandle these errors. For example, you may wish to issue a customized message to a developer whose\napp has exceeded the `Quota`.\n\nFor more on fault handling, see [Handling faults](/apigee/docs/api-platform/fundamentals/fault-handling).\n\nBest practices: Common policy sets\n----------------------------------\n\nTo meet basic management requirements, API proxies usually enforce the following policies:\n\n### Basic API key\nvalidation\n\n**ProxyEndpoint Request Flow:**\n\n1. `SpikeArrest`\n2. `XMLThreatProtection` or `JSONThreatProtection`\n3. API key validation\n4. `Quota`\n5. `ResponseCache`\n\n**ProxyEndpoint Response Flow:**\n\n1. `ResponseCache`\n\n### Basic transformation: JSON to\nXML\n\n**Request Flow:**\n\n1. `SpikeArrest`\n2. `JSONThreatProtection`\n3. API key validation\n4. `Quota`\n5. JSONToXML\n\n**Response Flow:**\n\n1. `XMLToJSON`\n2. `ResponseCache`"]]
