API / APIGEE Gateway Interview Questions
What are Apigee Policies and what categories are available?
Policies are the processing building blocks of an Apigee proxy. Each policy is a pre-built, reusable, XML-configured processing step that you attach to a flow. Because policies are declarative, most tasks require no custom code. Apigee provides over 40 built-in policies organised into five categories.
| Category | Examples | Purpose |
|---|---|---|
| Security | VerifyAPIKey, OAuthV2, JWT, HMAC, BasicAuthentication, AccessControl | Authentication, authorisation, token validation, IP allowlisting |
| Traffic management | Quota, SpikeArrest, ResponseCache, ConcurrentRateLimit | Rate limiting, caching, protecting backends from traffic spikes |
| Mediation / transformation | AssignMessage, ExtractVariables, JSONToXML, XMLToJSON, KeyValueMapOperations | Transforming request/response content, setting variables, protocol conversion |
| Extension | ServiceCallout, JavaCallout, JavaScriptCallout, PythonScript | Calling external services, executing custom code |
| Data | MessageLogging, StatisticsCollector | Logging, custom analytics |
<!-- VerifyAPIKey policy example --> <VerifyAPIKey name="VerifyAPIKey"> <DisplayName>Verify API Key</DisplayName> <APIKey ref="request.header.x-api-key"/> </VerifyAPIKey> <!-- Quota policy example --> <Quota name="Quota" type="rollingwindow"> <Interval>1</Interval> <TimeUnit>minute</TimeUnit> <Allow count="100"/> </Quota> <!-- AssignMessage policy example --> <AssignMessage name="AM.SetBackendHeaders"> <AssignTo createNew="false" type="request"/> <Set> <Headers> <Header name="x-internal-caller">apigee</Header> </Headers> </Set> <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables> </AssignMessage>
What category of Apigee policy would you use to validate an OAuth 2.0 access token presented by a client?
Which Apigee policy type is used to execute custom JavaScript code within the proxy pipeline?
More Related questions...
