Apigee and Traceable Integration Guide

This section documents how to deploy Traceable policies on Apigee and connect them to the Traceable Platform Agent (TPA) for API security monitoring and blocking.

Quick Links

• Deployment Architectures

  • Load Balancer and TLS Connectivity

  • Export Modes and Flow Attachment

  • Latency and Timeouts

  • SSE Capture

  • Content Types

  • Custom Blocking Response

• Blocking Agent

  • Configuration

  • Installation

• Non-Blocking Agent

  • Configuration

  • Installation

• Troubleshooting

• Streaming Events Capture

• Images

Overview

Apigee is a platform for developing and managing APIs. By fronting services with a proxy layer, Apigee provides an abstraction for your backend service APIs, including:

• Security

• Rate limiting

• Quotas

• Analytics

• And more

Traceable offers a mechanism for capturing requests and responses passing through your Apigee deployment to detect anomalous behavior or attacks.

The following deployment diagram shows a high-level traffic flow architecture through Apigee and the Traceable agent. Traceable's policy captures the incoming request and makes an asynchronous call to the Traceable platform.

---

Data Export Options

Traceable provides three options to export data from Apigee:

1. MessageLogging

The MessageLogging policy logs information from an API proxy's flow, such as:

• Request or response data

• Headers

• Custom messages

It is typically used for:

• Monitoring

• Debugging

• Auditing

• Analytics

The logged data can be stored in various destinations, including:

• Files

• Syslog

• External systems such as Traceable

Note: The Apigee agent sends data to the Traceable platform agent using a TCP syslog call.

Recommendation: Use MessageLogging if you have Syslog configured in the Traceable Platform agent. It is also less resource-intensive for Apigee.

---

2. ServiceCallout

The ServiceCallout policy allows calling external HTTP or HTTPS services within an API proxy. It is typically used to:

• Interact with third-party APIs

• Connect with backend systems

• Retrieve or send data during API processing

---

3. JavaScriptCallout

The JavaScriptCallout option enables making HTTP/HTTPS requests using the HTTP client inside JavaScript code.

• It uses a fire-and-forget approach.

• Ensures full asynchronous execution.

• Does not wait for a connection to be established.

---

Before You Begin

Make sure the following prerequisites are met before starting the deployment. These apply to both MessageLogging and ServiceCallout policies.

• A basic working knowledge of the Apigee environment is expected.

• Traceable supports:

  • Apigee-X

  • Hybrid

  • Apigee Edge (cloud)

• Download the Traceable policy file bundle, which includes both:

  • MessageLogging policy

  • ServiceCallout policy

• Ensure the Traceable platform agent is deployed on a VM accessible from the Apigee environment.

  • See: Virtual Machine

• Note the IP address of the Traceable platform agent.

  • This will be used in the Traceable policy configuration.

Next Steps

• Deployment Architectures — reference patterns for LB/TLS, export modes, latency, SSE, and blocking responses

• Install and Configure Blocking Agent

• Install and Configure Non-Blocking Agent