is it possible to add policies to API Products in Apigee Edge?

[#1]

It seems Apigee Edge doesn't support product level policies, all policies are added at the API level. Is there a way to add product level policy in Apigee e.g., cache, query parameters, etc. or is this feature in the road map of Apigee.

[sudheendras]

Hi @sajad deyargaroo - Policies such as Caching, Key-Value-Map and even JavaScript, Python, Java extension policies can be used across API proxies. The scope of these assets is defined in the <Scope> attribute of the policy configuration.

For other policies, take a look at https://github.com/apigee/proxy-dependency-maven-plugin - this plugin facilitates maintaining common code in a single spot, then at deploy time copying that code into a deployment bundle. In fact there are other tools such as this one - grunt plugin. These tools will help you reuse policy configurations across API proxies.

thanks - sudhee

[#3]

No, I am talking about applying the policies at the Product level. We can add JavaScript/Python/Java files but the JavaScript policy has to be added to the Flow of the API proxy. Key-Value-Map as the environment configuration and prefixes in Cache policy is not about the Product level policies. Similarly, in case of maven, I can copy policy xml files to the apiproxy\policies folder of all the API proxies in the product but I am not actually looking for how to clone/copy policies across proxies but if Apigee is having any plans to support the Product level policies.

[DChiesa · Accepted solution]

> Is there a way to add product level policy in Apigee e.g., cache, query parameters, etc. or is this feature in the road map of Apigee.

No, this feature is not on the roadmap for Apigee Edge, and I'll explain why.

The API Proxy is the container to hold execution rules and logic for API traffic. This is where you attach caching rules, quota enforcement, token validation, transformation, and routing. All execution logic - all the "smart proxy" work - gets attached into an API Proxy. This is what the API Proxy does - it holds that logic. Some of the policies embedded into an API Proxy may be driven off of configuration data, or metadata, that is stored elsewhere. But in Apigee Edge, the rules themselves are attached to API Proxies, always. The API Proxy is the entity which contains proxy execution logic.

The API Product is intended for a different purpose - it is the unit of exposure. The API Product is the thing that consuming developers interact with, that they get authorized for, that they request access to. API Products can have metadata - like quota limits, or whether the product should be publicly visible, or any arbitrary metadata. But the API Product does not have execution logic attached to it.

Therefore you will likely never see Apigee extend Edge to allow you to attach policies to API Products. It doesn't make sense.