This pageapplies toApigee andApigee hybrid.

View Apigee Edge documentation.

This page explains how to get started using Advanced API Security for Subscription and Pay-as-you-go organizations.

Required roles and permissions

The following sections describe the required roles and permissions to perform tasks using Advanced API Security.

Required roles for security reports

The table below shows the required roles to perform tasks related tosecurity reports.

Required roles for risk assessment

The table below shows the required roles to perform tasks related torisk assessment.

Required roles and permissions for abuse detection

The table below shows the required roles and permissions to perform tasks related toabuse detection.

Required roles for security actions

The table below shows the required roles to perform tasks related tosecurity actions.

Manage Advanced API Security for Subscription organizations

To use Advanced API Security as a Subscription customer, Advanced API Security must be part of your Subscription entitlements. SeeApigee entitlements. To add Advanced API Security to your entitlements, contactApigee Sales.

Once Advanced API Security is part of your entitlements, enable it in your organization:

• Get your Apigee add-ons configuration
• Enable Advanced API Security for Subscription organizations

If you are unsure whether you are using a Subscription or Pay-as-you-go Apigee organization, contact your Apigee organization administrator.

Get your Apigee add-ons configuration

In order to enable Advanced API Security for your Subscription organization, you first need to get your current Apigee add-ons configuration, using the following API call. This will also tell you whether Advanced API Security is already enabled.

curl "https://apigee.googleapis.com/v1/organizations/ORG" \  -X GET \  -H "Content-type: application/json" \  -H "Authorization: Bearer $TOKEN"

where

• ORG is the name of your organization.
• $TOKEN is the environment variable for anOAuth access token.

This call returns basic informationabout your organization, including a section for your Apigee add-ons configurationthat begins with the line:

"addonsConfig": {

Check to see whether this section contains the following entry:

"apiSecurityConfig": {          "enabled": true      }

If so, Advanced API Security is already enabled in the organization. Otherwise,you need to enable it, as described next.

Enable Advanced API Security for Subscription organizations

To enable Advanced API Security in a Subscription organization with the default configuration, issue aPOST request like the one shown below.

curl "https://apigee.googleapis.com/v1/organizations/ORG:setAddons" \  -X POST \  -H "Authorization: Bearer $TOKEN" \  -H "Content-type: application/json" \  -d '{    "addonsConfig": {      "apiSecurityConfig": {          "enabled": true      }<Other entries of your current add-ons configuration>    }  }'

• ORG is the name of your organization.
• $TOKEN is the environment variable for anOAuth access token.
• <Other entries of your current add-ons configuration> consists of any other entries of your currentApigee add-ons configuration.

"addonsConfig": {  "integrationConfig": {      "enabled":true  },  "monetizationConfig": {      "enabled":true  }},

curl "https://apigee.googleapis.com/v1/organizations/ORG:setAddons" \  -X POST \  -H "Authorization: Bearer $TOKEN" \  -H "Content-type: application/json" \  -d '{    "addonsConfig": {      "apiSecurityConfig": {          "enabled": true      },      "integrationConfig": {          "enabled": true      },      "monetizationConfig": {          "enabled": true      }    }  }'

{  "name": "organizations/apigee-docs-d/operations/0718a945-76e0-4393-a456-f9929603b32c",  "metadata": {    "@type": "type.googleapis.com/google.cloud.apigee.v1.OperationMetadata",    "operationType": "UPDATE",    "targetResourceName": "organizations/apigee-docs-d",    "state": "IN_PROGRESS"  }}

curl "https://apigee.googleapis.com/v1/organizations/$ORG:setAddons" \  -X POST \  -H "Authorization: Bearer $TOKEN" \  -H "Content-type: application/json" \  -d '{"addonsConfig": {      "apiSecurityConfig": {          "enabled": false      }     <Include current add-ons configuration>    }  }'

{  "name": "organizations/$ORG/operations/06274ffb-8940-41da-836d-781cba190437",  "metadata": {    "@type": "type.googleapis.com/google.cloud.apigee.v1.OperationMetadata",    "operationType": "UPDATE",    "targetResourceName": "organizations/$ORG",    "state": "IN_PROGRESS"  }}

For more information, see theConfigure organization add-ons API.

Manage Advanced API Security for Pay-as-you-go organizations

If you are aPay-as-you-go customer, you can enable Advanced API Security as a paid add-on. For more informationon enabling the Advanced API Security add-on for your Intermediate or Comprehensive Apigee environments, seeManage the Advanced API Security add-on.

If you are unsure whether you are using a Subscription or Pay-as-you-go Apigee organization, contact your Apigee organization administrator.

Manage Advanced API Security for eval organizations

The Advanced API Security add-on is automatically included with Apigeetrial (evaluation) organizations, but you'll need to enable it.

To enable it, follow the instructions inEnable Advanced API Security for Subscription organizations.

If you need to disable it, follow the instructions inDisable Advanced API Security for Subscription organizations.

Configure Advanced API Security using Terraform

Apigee supports using to manage some Advanced API Security functionality.

For example, you can use Terraform to configure:

• Security actions
• Risk Assessment v2 security profiles
• Risk Assessment v2 security monitoring conditions

For information on the currently supported functionality, see theApigee section of the Terraform Registry. Advanced API Security-related resource names start withgoogle_apigee_security. For information on general Apigee support for Terraform, seeUse Terraform with Apigee.

Next steps

Once you have enabled Advanced API Security, see:

• Security reports
• Risk assessment
• Abuse detection
• Security alerts
• Security actions