This pageapplies toApigee andApigee hybrid.

View Apigee Edge documentation.

This topic describes how to move API resources (API proxies, shared flows, and API products) between Apigee Spaces in an Apigee organization. Users can move resources between organization and Space levels or moveresources between Spaces. To move, manage, or view the API resources in an organization or Space, the user must have the appropriate permissions for the relevant organization or Space.

Move API resources from an organization to a Space

API resources created in an Apigee organization can be moved from the organization level to a Space or the other way around. An API resource moved to a Space inherits the IAM policy of that Space. In order to move the API resource from the organization level to a Space, the user must have the following permissions:

• apigee.RESOURCE_TYPE.move on the source scope (the organization or Space where the resource currently exists).

  Valid values forRESOURCE_TYPE includeapis,sharedflows, orapiproducts, depending upon the type of API resource moved.

• apigee.RESOURCE_TYPE.create on the target scope (the organization or Space where the resource is to be moved).

  Valid values forRESOURCE_TYPE includeapis,sharedflows, orapiproducts, depending upon the type of API resource moved.

To move an organization-level API resource to a Space, use the following command:

curl "https://apigee.googleapis.com/v1/organizations/ORG_NAME/RESOURCE_TYPE/RESOURCE_ID:move?space=SPACE_NAME" \  -X POST -H "Authorization: Bearer $TOKEN"

Where:

• ORG_NAME is the name of your Apigee organization.
• RESOURCE_TYPE is the type of the resource you are listing. Valid values include:
  • apis
  • sharedflows
  • apiproducts
• RESOURCE_ID is the name of the API proxy, shared flow, or API product you want to move.
• SPACE_NAME is the name of the Space where you are moving the resource.

For example, with the following command, a user with theApigee Organization Admin role for theacme organization movesan API proxy nameddemo from the organization level to thered Space:

curl "https://apigee.googleapis.com/v1/organizations/acme/apis/demo:move?space=red" \  -X POST -H "Authorization: Bearer $TOKEN"

The response should look similar to the following:

{  "metaData": {    "createdAt": "1739489725993",    "lastModifiedAt": "1741724822852",    "subType": "Proxy"  },  "name": "demo",  "revision": [    "1",    "2"  ],  "apiProxyType": "PROGRAMMABLE",  "space": "red"}

Once thedemo API proxy is moved to thered Space, members of thered Space can access the proxy, even if they do not have permission to access organization-level resources. Members of otherSpaces, who are not members of thered Space, can't view or access thedemo proxy.

Attempting to access thedemo proxy without the correct organization- or Space-level permissions results in the following error:

  {    "error": {      "code": 403,      "message": "Permission denied on resource \"organizations\/acme\/apis\/demo\" (or it may not exist).",      "status": "PERMISSION_DENIED"    }  }

To move an API resource from a Space to the organization level, use the following command, which omits thespace query parameter:

curl "https://apigee.googleapis.com/v1/organizations/ORG_NAME/RESOURCE_TYPE/RESOURCE_ID:move" \  -X POST -H "Authorization: Bearer $TOKEN"

Where:

• ORG_NAME is the name of your Apigee organization.
• RESOURCE_TYPE is the type of the resource you are listing. Valid values include:
  • apis
  • sharedflows
  • apiproducts
• RESOURCE_ID is the name of the API proxy, shared flow, or API product you want to move.

Move API resources between Spaces

API resources can be moved between Spaces in an Apigee organization. An API resource moved to a Space inherits the IAM policy of that Space. In order to move the API resource between Spaces in an Apigee organization, the user must have the following permissions:

• apigee.RESOURCE_TYPE.move for the Space where the API resource currently exists.

  Valid values forRESOURCE_TYPE includeapis,sharedflows, orapiproducts, depending upon the type of API resource being moved.

• apigee.RESOURCE_TYPE.create for the Space where the API resource is to be moved.

  Valid values forRESOURCE_TYPE includeapis,sharedflows, orapiproducts, depending upon the type of API resource being moved.

A user assigned theapigee.spaceContentEditor role for both Spaces will have the required permissions.

To move an API resource between Spaces in an Apigee organization, use the following command:

curl "https://apigee.googleapis.com/v1/organizations/ORG_NAME/RESOURCE_TYPE/RESOURCE_ID:move?space=SPACE_NAME" \  -X POST -H "Authorization: Bearer $TOKEN"

Where:

• ORG_NAME is the name of your Apigee organization.
• RESOURCE_TYPE is the type of the resource you are listing. Valid values include:
  • apis
  • sharedflows
  • apiproducts
• RESOURCE_ID is the name of the API proxy, shared flow, or API product you want to move.
• SPACE_NAME is the name of the new Space.

For example, a user with theapigee.proxies.move permission for thered Space and theapigee.proxies.create permission for theblue Space can use the followingcommand to move thedemo API proxy from thered Space to theblue Space:

curl "https://apigee.googleapis.com/v1/organizations/acme/apis/demo:move?space=blue" \  -X POST -H "Authorization: Bearer $TOKEN"

The response should look similar to the following:

{  "basepaths": ["/demo"],  "revision": 1,  "apiProxyId": "demo",  "space_id": "blue",  "createTime": ...,  "updateTime": ...}

In this example, the user does not need to have permissions at the organization level, only the required permissions set by each Space'ssetIamPolicy bindings.

Attempting to move thedemo API proxy without the correct permissions for both Spaces results in the following error:

  {    "error": {      "code": 403,      "message": "Permission denied on resource \"organizations\/acme\/apis\/demo\" (or it may not exist).",      "status": "PERMISSION_DENIED"    }  }