Product with no environment access can be used to call API in any environment

[#1]

Hi Team,

I observed one thing on APIGEE which seems bit strange to me.

Steps I followed:

1. Created an API proxy with Verify API Key policy attached to it (Basically doing API key Verification only in the API).

2. Deployed it in dev & test environment.

3. Created a product with no environment selected which looks as follows:

4. Created an App "test-app"

Now as per my understanding. test-app should not be able to call the API as the product does not have access to any environment.

But when I make call to API I get 200 OK which should not be the case.

Does any one has any idea on this??

Thanks

[bhatikuldeep]

hi @Vipul Agarwal, I tried same flow and found strange as well, I checked the documentation here - http://docs.apigee.com/developer-services/content/creating-api-products which says;

If you select no environments, the product allows access to all environments.

seems the way it is 🙂

[#3]

Yeah, I see that. 😉

But should this be the case?