Policy reference overview

This page applies to Apigee and Apigee hybrid.

View Apigee Edge documentation.

Apigee's policies augment your APIs to control traffic, enhance performance, enforce security, and increase the utility of your APIs, without requiring you to write code or modify backend services.

In addition, Apigee provides extension policies that let you implement custom logic in the form of JavaScript, Python, Java, and XSLT stylesheets.

Policy categories and types

A policy's category indicates the functional area (for example, security or mediation) for the policy. Policies are shown sorted by category below.

The policy type refers to how the policy can be used in Apigee:

• Standard policies are suitable for internal development and lightweight API solutions. Standard policies can be used with any environment type. To see the list of standard policies, see Standard policies by category.
• Extensible policies provide more functionality than standard policies, including for traffic management, mediation, and security. The extensible policies also include policies to implement custom logic in the form of JavaScript, Python, Java, and XSLT stylesheets.
  
  Extensible policies can be used with intermediate and comprehensive environment types only. Using an extensible policy automatically converts that proxy to an Extensible proxy, which could have cost and other implications. Check the Pay-as-you-go entitlements and Subscription 2024 for information.
  
  To see the list of extensible policies, see Extensible policies by category.

For Pay-as-you-go users, the types of policies you can use in a proxy depend on the environment types you plan to deploy that proxy to. See Pay-as-you-go for more information.

If there are two policies, one standard and one extensible, that would both perform the functions you need, use the standard policy.

Standard policies by category

Following are the categories for the standard policies:

Traffic management policies	Mediation policies	Security policies	Extension policies
Let you control quotas and mitigate the effects of API traffic spikes. SpikeArrest policy	Let you perform message transformation, parsing, and validation, as well as raise faults and alerts. CORS policy GraphQL policy HTTPModifier policy JSONtoXML policy OASValidation policy PublishMessage policy RaiseFault policy ReadPropertySet policy SOAPMessageValidation policy XMLtoJSON policy	Let you apply security-related policies. AccessControl policy HMAC policy JWT policies: DecodeJWT policy VerifyJWT policy VerifyIAM policy	Let you define custom policy functionality, such as service callout and message data collection. AssertCondition policy ExternalCallout policy

Extensible policies by category

Following are the extensible policies, by category. Proxies with extensible policies can only be deployed to intermediate and comprehensive environments. Extensible policies are indicated in the user interface with this icon: .

Traffic management policies	Mediation policies	Security policies	Extension policies
Let you configure caching, control quotas, mitigate the effects of spikes, and perform other functions related to your API traffic. Caching policies: InvalidateCache policy LookupCache policy PopulateCache policy ResponseCache policy Quota policy ResetQuota policy	Let you perform message transformation, parsing, and validation, as well as raise faults and alerts. AccessEntity policy AssignMessage policy ExtractVariables policy KeyValueMapOperations policy MonetizationLimitsCheck policy ParseDialogflowRequest policy SetDialogflowResponse policy XSLTransform policy	Let you control access to your APIs with OAuth, API key validation, and other threat protection features. BasicAuthentication policy JSONThreatProtection policy JWS policies: DecodeJWS policy GenerateJWS policy VerifyJWS policy JWT policies: GenerateJWT policy OAuth v2 policies: DeleteOAuthv2Info policy GetOAuthv2Info policy OAuthv2 policy RevokeOAuthv2 policy SetOAuth v2 Info policy RegularExpressionProtection policy SAMLAssertion policy VerifyAPIKey policy XMLThreatProtection policy	Let you define custom policy functionality, such as service callout, message data collection, and calling Java, JavaScript, and Python scripts. DataCapture policy FlowCallout policy IntegrationCallout policy JavaCallout policy JavaScript policy MessageLogging policy PythonScript policy ServiceCallout policy SetIntegrationRequest policy TraceCapture policy