API / APIGEE Gateway Interview Questions

Apigee is Google Cloud's native, full-lifecycle API management platform. It sits between backend services and the clients that consume them, acting as a secure, observable, and policy-enforcing proxy layer. Apigee handles traffic routing, authentication, rate limiting, analytics, developer portal...

Read full answer

Apigee offers three deployment models to accommodate different infrastructure requirements, data residency rules, and latency constraints. Apigee deployment models Model Management plane Runtime plane Best for Apigee (SaaS / cloud-native) Google-managed Google-managed Cloud-first; simplest to ope...

Read full answer

An API proxy is the primary unit of deployment in Apigee. It creates an abstraction layer between API consumers and backend services, so backend URLs, authentication schemes, and data formats can change without affecting consumers. Every request from a client hits the proxy first; the proxy appli...

Read full answer

A Flow is an ordered sequence of policy steps that Apigee executes as a request travels from client to backend and back. Understanding the flow pipeline is fundamental to knowing where to attach each policy. Apigee flow pipeline Phase Direction Description ProxyEndpoint PreFlow Request First to e...

Read full answer

Policies are the processing building blocks of an Apigee proxy. Each policy is a pre-built, reusable, XML-configured processing step that you attach to a flow. Because policies are declarative, most tasks require no custom code. Apigee provides over 40 built-in policies organised into five catego...

Read full answer

The VerifyAPIKey policy is Apigee's most fundamental security mechanism. It validates that an incoming request contains a valid API key that was issued by Apigee to a registered developer application. If the key is absent or invalid, Apigee immediately returns a 401 Unauthorized response and the ...

Read full answer

Apigee implements the complete OAuth 2.0 specification via the OAuthV2 policy . Apigee can act as an authorisation server (issuing tokens) or as a resource server (validating tokens), or both. All four OAuth 2.0 grant types are supported. OAuth 2.0 grant types in Apigee Grant type Use case Flow s...

Read full answer

Both policies limit traffic, but they operate on very different time scales and serve different purposes. Confusing them is a common interview question because both say 'rate limiting' but do fundamentally different jobs. Quota vs SpikeArrest Aspect Quota SpikeArrest Purpose Business-level entitl...

Read full answer

An API Product is a curated bundle of API proxy resources combined with a usage plan. It is the unit that developers subscribe to, and it represents how you monetise or control access to your APIs. A single API proxy can be included in multiple products with different entitlements. API Proxy vs A...

Read full answer

Apigee uses a clear hierarchical structure to organise all resources. Understanding this hierarchy is essential for managing multi-team and multi-environment API programmes. Apigee organisational hierarchy Level Name Description 1 (top) Organisation Top-level container; one per GCP project; holds...

Read full answer

A Shared Flow is a reusable sequence of policies that can be called from any API proxy using the FlowCallout policy. Shared flows solve the problem of duplicating the same policy logic across dozens of proxies -- a change to the shared flow propagates to all proxies that reference it. API Proxy v...

Read full answer

The ResponseCache policy stores successful backend responses in Apigee's in-memory cache. When an identical subsequent request arrives within the cache TTL, Apigee serves the cached response directly without contacting the backend at all. This reduces backend load and improves latency.