Can APIGEE handle 50 MB request payload

[rbotre]

Can APIGEE handle 50 MB request payload?

A quick internet search says the limit for Apigee request payload is 10mb.

1. Is this the correct number or this is just the default, and it can be extended to accommodate 50mb?
2. If 10mb is the limit, do you know of any way to upload files beyond that size?

If it can be extended to 50mb, do you know of any issue that might come with that?

[viksinghv]

For file uploads, recommended way would be to use signed URLs.
https://www.googlecloudcommunity.com/gc/Cloud-Product-Articles/Screencast-Using-Apigee-to-create-a-S...
You can also use the Apigee's request/response streaming functionality.
https://docs.apigee.com/api-platform/develop/enabling-streaming

[rbotre]

Is it true that if we choose the signed URL route, the signed URL is only valid for 7 days? We demand that the client be able to access and download artefacts using a signed URL for at least three months. Do you have any suggestions??

[dchiesa1]

With the typical pattern, you shouldn't need "3 months" for an expiry.

The protocol is usually:

• client sends an API request to apigee-managed endpoint asking for a link to download the target file
• Apigee validates the client credentials, then if valid and not expired, generates the signedurl with a specified expiry (usually brief, like an hour). The Apigee proxy returns the signedurl to the client. 
• client performs a GET on the returned URL
• Google Cloud Storage validates the signedurl and if valid and not expired, permits the download. 

So basically the client makes 2 calls in short succession. The expiry of the signedurl needs only to accommodate the delay in the 2nd call. 

The Apigee+signedurl pattern is just a specific example of credential mediation: Apigee accepts one set of credentials and "exchanges it" for another. Something like a Token-exchange service, except ... in this case the inbound credentials to Apigee may or may not be a token, and the outbound credentials are always a signedurl. 

[viksinghv]

You specify an expiration time when you create the signed URL. Anyone who knows the URL can access the resource until the expiration time for the URL is reached or the key used to sign the URL is rotated.

Recommend checking details here
https://cloud.google.com/storage/docs/access-control/signed-urls