# Implementing Api Threat Protection With Apigee > Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense. - **Type:** Skill - **Install:** `agentstack add skill-pinkpixel-dev-skills-collection-2-implementing-api-threat-protection-with-apigee` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [pinkpixel-dev](https://agentstack.voostack.com/s/pinkpixel-dev) - **Installs:** 0 - **Category:** [Security](https://agentstack.voostack.com/c/security) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [pinkpixel-dev](https://github.com/pinkpixel-dev) - **Source:** https://github.com/pinkpixel-dev/skills-collection-2/tree/main/SKILLS/implementing-api-threat-protection-with-apigee ## Install ```sh agentstack add skill-pinkpixel-dev-skills-collection-2-implementing-api-threat-protection-with-apigee ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Implementing API Threat Protection with Apigee ## Overview Google Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats. ## When to Use - When deploying or configuring implementing api threat protection with apigee capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation ## Prerequisites - Google Cloud Platform account with Apigee organization provisioned - Apigee X or Apigee hybrid environment configured - Backend API services deployed and accessible from Apigee - Google Cloud CLI (gcloud) installed and authenticated - OpenAPI specification for target APIs - Understanding of Apigee proxy bundle structure ## Core Security Policies ### 1. JSON Threat Protection Protects against JSON-based denial-of-service attacks by limiting structural depth, entry counts, and string lengths: ```xml JSON Threat Protection request 50 25 100 5 500 ``` ### 2. XML Threat Protection Shields against XML bombs, XXE attacks, and oversized XML payloads: ```xml XML Threat Protection request 50 50 20 50 1000 500 256 256 256 5 5 3 25 ``` ### 3. Regular Expression Threat Protection Detects SQL injection, XSS, and other injection patterns in request parameters: ```xml Regex Injection Protection request false [\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update)|(\bor\b)) [\s]*<\s*script\b[^>]*>[^<]+<\s*/\s*script\s*> [\r\n] (/\.\.)|(\.\./) $.* [\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update)) ``` ### 4. SpikeArrest Policy Prevents traffic spikes from overwhelming backend services: ```xml API Spike Arrest 30ps true ``` ### 5. OAuth 2.0 Token Validation ```xml Verify OAuth 2.0 Access Token VerifyAccessToken false request.header.Authorization authorization_code client_credentials read write ``` ### 6. API Key Validation ```xml Verify API Key ``` ## Proxy Bundle Configuration ### Complete Secure Proxy Flow ```xml Verify-OAuth-Token Spike-Arrest-1 JSON-Threat-Protection-1 request.header.Content-Type = "application/json" XML-Threat-Protection-1 request.header.Content-Type = "text/xml" RegEx-Threat-Protection-1 CORS-Policy Remove-Internal-Headers Add-Security-Headers Additional protection for sensitive endpoints Quota-Strict (proxy.pathsuffix MatchesPath "/admin/**") or (proxy.pathsuffix MatchesPath "/users/*/sensitive") /v1 secure default ``` ### Security Headers Policy ```xml Add Security Response Headers nosniff DENY max-age=31536000; includeSubDomains no-store, no-cache, must-revalidate default-src 'none' {messageid} false ``` ## Advanced API Security Enable Apigee's Advanced API Security add-on for machine-learning-based threat detection: ```bash # Enable Advanced API Security on Apigee X instance gcloud apigee organizations update $ORG_NAME \ --advanced-api-security-config=enabled # View detected abuse alerts gcloud apigee apis security-reports list \ --organization=$ORG_NAME \ --environment=$ENV_NAME # Create security action to block suspicious traffic gcloud apigee security-actions create \ --organization=$ORG_NAME \ --environment=$ENV_NAME \ --action-type=DENY \ --condition-type=IP_ADDRESS \ --condition-values="192.168.1.100,10.0.0.50" \ --description="Block identified malicious IPs" ``` ## Deployment ```bash # Deploy proxy bundle with security policies gcloud apigee apis deploy \ --api=$API_NAME \ --environment=$ENV_NAME \ --revision=$REVISION \ --organization=$ORG_NAME # Validate deployment gcloud apigee apis list-deployments \ --api=$API_NAME \ --organization=$ORG_NAME ``` ## References - Apigee JSON Threat Protection: https://cloud.google.com/apigee/docs/api-platform/reference/policies/json-threat-protection-policy - Google Cloud Apigee Security Best Practices: https://cloud.google.com/architecture/best-practices-securing-applications-and-apis-using-apigee - Apigee Advanced API Security: https://docs.cloud.google.com/apigee/docs/api-security - Apigee OWASP API Top 10: https://docs.apigee.com/api-platform/faq/owasp-top-api-threats - Wallarm Apigee Security Policies Guide: https://lab.wallarm.com/what/apigee-api-security-policies-howto/ ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [pinkpixel-dev](https://github.com/pinkpixel-dev) - **Source:** [pinkpixel-dev/skills-collection-2](https://github.com/pinkpixel-dev/skills-collection-2) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-pinkpixel-dev-skills-collection-2-implementing-api-threat-protection-with-apigee - Seller: https://agentstack.voostack.com/s/pinkpixel-dev - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.