[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71H09G9G45Q65P90JTPJTG6":3,"skill-same:01M71H09G9G45Q65P90JTPJTG6":70},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":14,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":6,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M71H09G9G45Q65P90JTPJTG6","webapp-api-apigee",null,"- Wallarm Apigee Security Policies Guide: https:\u002F\u002Flab.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-apigee\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37],"apigee","api","webapp","webapp api apigee","security","cybersecurity","https","guide","lab","2026-11-10 10:12:30",false,"---\nname: webapp-api-apigee\ndescription: \"- Wallarm Apigee Security Policies Guide: https:\u002F\u002Flab.\"\ndomain: cybersecurity\n---\n\n# Implementing API Threat Protection with Apigee\n\n## Overview\n\nGoogle Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats.\n\n## When to Use\n\n- When deploying or configuring implementing api threat protection with apigee capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Google Cloud Platform account with Apigee organization provisioned\n- Apigee X or Apigee hybrid environment configured\n- Backend API services deployed and accessible from Apigee\n- Google Cloud CLI (gcloud) installed and authenticated\n- OpenAPI specification for target APIs\n- Understanding of Apigee proxy bundle structure\n\n## Core Security Policies\n\n### 1. JSON Threat Protection\n\nProtects against JSON-based denial-of-service attacks by limiting structural depth, entry counts, and string lengths:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CJSONThreatProtection name=\"JSON-Threat-Protection-1\">\n    \u003CDisplayName>JSON Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003C!-- Maximum nesting depth of JSON structure -->\n    \u003CObjectEntryNameLength>50\u003C\u002FObjectEntryNameLength>\n    \u003CObjectEntryCount>25\u003C\u002FObjectEntryCount>\n    \u003CArrayElementCount>100\u003C\u002FArrayElementCount>\n    \u003CContainerDepth>5\u003C\u002FContainerDepth>\n    \u003CStringValueLength>500\u003C\u002FStringValueLength>\n\u003C\u002FJSONThreatProtection>\n```\n\n### 2. XML Threat Protection\n\nShields against XML bombs, XXE attacks, and oversized XML payloads:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CXMLThreatProtection name=\"XML-Threat-Protection-1\">\n    \u003CDisplayName>XML Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CNameLimits>\n        \u003CElement>50\u003C\u002FElement>\n        \u003CAttribute>50\u003C\u002FAttribute>\n        \u003CNamespacePrefix>20\u003C\u002FNamespacePrefix>\n        \u003CProcessingInstructionTarget>50\u003C\u002FProcessingInstructionTarget>\n    \u003C\u002FNameLimits>\n    \u003CValueLimits>\n        \u003CText>1000\u003C\u002FText>\n        \u003CAttribute>500\u003C\u002FAttribute>\n        \u003CNamespaceURI>256\u003C\u002FNamespaceURI>\n        \u003CComment>256\u003C\u002FComment>\n        \u003CProcessingInstructionData>256\u003C\u002FProcessingInstructionData>\n    \u003C\u002FValueLimits>\n    \u003CStructureLimits>\n        \u003CNodeDepth>5\u003C\u002FNodeDepth>\n        \u003CAttributeCountPerElement>5\u003C\u002FAttributeCountPerElement>\n        \u003CNamespaceCountPerElement>3\u003C\u002FNamespaceCountPerElement>\n        \u003CChildCount>25\u003C\u002FChildCount>\n    \u003C\u002FStructureLimits>\n\u003C\u002FXMLThreatProtection>\n```\n\n### 3. Regular Expression Threat Protection\n\nDetects SQL injection, XSS, and other injection patterns in request parameters:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CRegularExpressionProtection name=\"RegEx-Threat-Protection-1\">\n    \u003CDisplayName>Regex Injection Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n\n    \u003C!-- SQL Injection patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update)|(\\bor\\b))\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- XSS patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*<\\s*script\\b[^>]*>[^<]+<\\s*\u002F\\s*script\\s*>\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- Header injection -->\n    \u003CHeader name=\"*\">\n        \u003CPattern>[\\r\\n]\u003C\u002FPattern>\n    \u003C\u002FHeader>\n\n    \u003C!-- URI path traversal -->\n    \u003CURIPath>\n        \u003CPattern>(\u002F\\.\\.)|(\\.\\.\u002F)\u003C\u002FPattern>\n    \u003C\u002FURIPath>\n\n    \u003C!-- JSON body injection -->\n    \u003CJSONPayload>\n        \u003CJSONPath>$.*\u003C\u002FJSONPath>\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update))\u003C\u002FPattern>\n    \u003C\u002FJSONPayload>\n\u003C\u002FRegularExpressionProtection>\n```\n\n### 4. SpikeArrest Policy\n\nPrevents traffic spikes from overwhelming backend services:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CSpikeArrest name=\"Spike-Arrest-1\">\n    \u003CDisplayName>API Spike Arrest\u003C\u002FDisplayName>\n    \u003CRate>30ps\u003C\u002FRate> \u003C!-- 30 per second smoothed -->\n    \u003CIdentifier ref=\"request.header.x-api-key\"\u002F>\n    \u003CMessageWeight ref=\"request.header.x-request-weight\"\u002F>\n    \u003CUseEffectiveCount>true\u003C\u002FUseEffectiveCount>\n\u003C\u002FSpikeArrest>\n```\n\n### 5. OAuth 2.0 Token Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003COAuthV2 name=\"Verify-OAuth-Token\">\n    \u003CDisplayName>Verify OAuth 2.0 Access Token\u003C\u002FDisplayName>\n    \u003COperation>VerifyAccessToken\u003C\u002FOperation>\n    \u003CExternalAuthorization>false\u003C\u002FExternalAuthorization>\n    \u003CExternalAccessToken>request.header.Authorization\u003C\u002FExternalAccessToken>\n    \u003CSupportedGrantTypes>\n        \u003CGrantType>authorization_code\u003C\u002FGrantType>\n        \u003CGrantType>client_credentials\u003C\u002FGrantType>\n    \u003C\u002FSupportedGrantTypes>\n    \u003CScope>read write\u003C\u002FScope>\n    \u003CGenerateResponse enabled=\"true\"\u002F>\n\u003C\u002FOAuthV2>\n```\n\n### 6. API Key Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CVerifyAPIKey name=\"Verify-API-Key-1\">\n    \u003CDisplayName>Verify API Key\u003C\u002FDisplayName>\n    \u003CAPIKey ref=\"request.header.x-api-key\"\u002F>\n\u003C\u002FVerifyAPIKey>\n```\n\n## Proxy Bundle Configuration\n\n### Complete Secure Proxy Flow\n\n```xml\n\u003C!-- apiproxy\u002Fproxies\u002Fdefault.xml -->\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CProxyEndpoint name=\"default\">\n    \u003CPreFlow name=\"PreFlow\">\n        \u003CRequest>\n            \u003C!-- Step 1: Verify API Key or OAuth token -->\n            \u003CStep>\n                \u003CName>Verify-OAuth-Token\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 2: Rate limiting -->\n            \u003CStep>\n                \u003CName>Spike-Arrest-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 3: Threat protection -->\n            \u003CStep>\n                \u003CName>JSON-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"application\u002Fjson\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003CStep>\n                \u003CName>XML-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"text\u002Fxml\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003C!-- Step 4: Injection prevention -->\n            \u003CStep>\n                \u003CName>RegEx-Threat-Protection-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 5: CORS enforcement -->\n            \u003CStep>\n                \u003CName>CORS-Policy\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FRequest>\n        \u003CResponse>\n            \u003C!-- Remove internal headers from response -->\n            \u003CStep>\n                \u003CName>Remove-Internal-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Add security headers -->\n            \u003CStep>\n                \u003CName>Add-Security-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FResponse>\n    \u003C\u002FPreFlow>\n\n    \u003CFlows>\n        \u003CFlow name=\"sensitive-operations\">\n            \u003CDescription>Additional protection for sensitive endpoints\u003C\u002FDescription>\n            \u003CRequest>\n                \u003CStep>\n                    \u003CName>Quota-Strict\u003C\u002FName>\n                \u003C\u002FStep>\n            \u003C\u002FRequest>\n            \u003CCondition>(proxy.pathsuffix MatchesPath \"\u002Fadmin\u002F**\") or\n                       (proxy.pathsuffix MatchesPath \"\u002Fusers\u002F*\u002Fsensitive\")\u003C\u002FCondition>\n        \u003C\u002FFlow>\n    \u003C\u002FFlows>\n\n    \u003CHTTPProxyConnection>\n        \u003CBasePath>\u002Fv1\u003C\u002FBasePath>\n        \u003CVirtualHost>secure\u003C\u002FVirtualHost>\n    \u003C\u002FHTTPProxyConnection>\n\n    \u003CRouteRule name=\"default\">\n        \u003CTargetEndpoint>default\u003C\u002FTargetEndpoint>\n    \u003C\u002FRouteRule>\n\u003C\u002FProxyEndpoint>\n```\n\n### Security Headers Policy\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CAssignMessage name=\"Add-Security-Headers\">\n    \u003CDisplayName>Add Security Response Headers\u003C\u002FDisplayName>\n    \u003CSet>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Content-Type-Options\">nosniff\u003C\u002FHeader>\n            \u003CHeader name=\"X-Frame-Options\">DENY\u003C\u002FHeader>\n            \u003CHeader name=\"Strict-Transport-Security\">max-age=31536000; includeSubDomains\u003C\u002FHeader>\n            \u003CHeader name=\"Cache-Control\">no-store, no-cache, must-revalidate\u003C\u002FHeader>\n            \u003CHeader name=\"Content-Security-Policy\">default-src 'none'\u003C\u002FHeader>\n            \u003CHeader name=\"X-Request-ID\">{messageid}\u003C\u002FHeader>\n        \u003C\u002FHeaders>\n    \u003C\u002FSet>\n    \u003CRemove>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Powered-By\"\u002F>\n            \u003CHeader name=\"Server\"\u002F>\n        \u003C\u002FHeaders>\n    \u003C\u002FRemove>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n    \u003CAssignTo createNew=\"false\" transport=\"http\" type=\"response\"\u002F>\n\u003C\u002FAssignMessage>\n```\n\n## Advanced API Security\n\nEnable Apigee's Advanced API Security add-on for machine-learning-based threat detection:\n\n```bash\n# Enable Advanced API Security on Apigee X instance\ngcloud apigee organizations update $ORG_NAME \\\n  --advanced-api-security-config=enabled\n\n# View detected abuse alerts\ngcloud apigee apis security-reports list \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME\n\n# Create security action to block suspicious traffic\ngcloud apigee security-actions create \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME \\\n  --action-type=DENY \\\n  --condition-type=IP_ADDRESS \\\n  --condition-values=\"192.168.1.100,10.0.0.50\" \\\n  --description=\"Block identified malicious IPs\"\n```\n\n## Deployment\n\n```bash\n# Deploy proxy bundle with security policies\ngcloud apigee apis deploy \\\n  --api=$API_NAME \\\n  --environment=$ENV_NAME \\\n  --revision=$REVISION \\\n  --organization=$ORG_NAME\n\n# Validate deployment\ngcloud apigee apis list-deployments \\\n  --api=$API_NAME \\\n  --organization=$ORG_NAME\n```\n\n## References\n\n- Apigee JSON Threat Protection: https:\u002F\u002Fcloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-platform\u002Freference\u002Fpolicies\u002Fjson-threat-protection-policy\n- Google Cloud Apigee Security Best Practices: https:\u002F\u002Fcloud.google.com\u002Farchitecture\u002Fbest-practices-securing-applications-and-apis-using-apigee\n- Apigee Advanced API Security: https:\u002F\u002Fdocs.cloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-security\n- Apigee OWASP API Top 10: https:\u002F\u002Fdocs.apigee.com\u002Fapi-platform\u002Ffaq\u002Fowasp-top-api-threats\n- Wallarm Apigee Security Policies Guide: https:\u002F\u002Flab.wallarm.com\u002Fwhat\u002Fapigee-api-security-policies-howto\u002F\n","# Implementing API Threat Protection with Apigee\n\n## Overview\n\nGoogle Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats.\n\n## When to Use\n\n- When deploying or configuring implementing api threat protection with apigee capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Google Cloud Platform account with Apigee organization provisioned\n- Apigee X or Apigee hybrid environment configured\n- Backend API services deployed and accessible from Apigee\n- Google Cloud CLI (gcloud) installed and authenticated\n- OpenAPI specification for target APIs\n- Understanding of Apigee proxy bundle structure\n\n## Core Security Policies\n\n### 1. JSON Threat Protection\n\nProtects against JSON-based denial-of-service attacks by limiting structural depth, entry counts, and string lengths:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CJSONThreatProtection name=\"JSON-Threat-Protection-1\">\n    \u003CDisplayName>JSON Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003C!-- Maximum nesting depth of JSON structure -->\n    \u003CObjectEntryNameLength>50\u003C\u002FObjectEntryNameLength>\n    \u003CObjectEntryCount>25\u003C\u002FObjectEntryCount>\n    \u003CArrayElementCount>100\u003C\u002FArrayElementCount>\n    \u003CContainerDepth>5\u003C\u002FContainerDepth>\n    \u003CStringValueLength>500\u003C\u002FStringValueLength>\n\u003C\u002FJSONThreatProtection>\n```\n\n### 2. XML Threat Protection\n\nShields against XML bombs, XXE attacks, and oversized XML payloads:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CXMLThreatProtection name=\"XML-Threat-Protection-1\">\n    \u003CDisplayName>XML Threat Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CNameLimits>\n        \u003CElement>50\u003C\u002FElement>\n        \u003CAttribute>50\u003C\u002FAttribute>\n        \u003CNamespacePrefix>20\u003C\u002FNamespacePrefix>\n        \u003CProcessingInstructionTarget>50\u003C\u002FProcessingInstructionTarget>\n    \u003C\u002FNameLimits>\n    \u003CValueLimits>\n        \u003CText>1000\u003C\u002FText>\n        \u003CAttribute>500\u003C\u002FAttribute>\n        \u003CNamespaceURI>256\u003C\u002FNamespaceURI>\n        \u003CComment>256\u003C\u002FComment>\n        \u003CProcessingInstructionData>256\u003C\u002FProcessingInstructionData>\n    \u003C\u002FValueLimits>\n    \u003CStructureLimits>\n        \u003CNodeDepth>5\u003C\u002FNodeDepth>\n        \u003CAttributeCountPerElement>5\u003C\u002FAttributeCountPerElement>\n        \u003CNamespaceCountPerElement>3\u003C\u002FNamespaceCountPerElement>\n        \u003CChildCount>25\u003C\u002FChildCount>\n    \u003C\u002FStructureLimits>\n\u003C\u002FXMLThreatProtection>\n```\n\n### 3. Regular Expression Threat Protection\n\nDetects SQL injection, XSS, and other injection patterns in request parameters:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CRegularExpressionProtection name=\"RegEx-Threat-Protection-1\">\n    \u003CDisplayName>Regex Injection Protection\u003C\u002FDisplayName>\n    \u003CSource>request\u003C\u002FSource>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n\n    \u003C!-- SQL Injection patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update)|(\\bor\\b))\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- XSS patterns -->\n    \u003CQueryParam name=\"*\">\n        \u003CPattern>[\\s]*<\\s*script\\b[^>]*>[^<]+<\\s*\u002F\\s*script\\s*>\u003C\u002FPattern>\n    \u003C\u002FQueryParam>\n\n    \u003C!-- Header injection -->\n    \u003CHeader name=\"*\">\n        \u003CPattern>[\\r\\n]\u003C\u002FPattern>\n    \u003C\u002FHeader>\n\n    \u003C!-- URI path traversal -->\n    \u003CURIPath>\n        \u003CPattern>(\u002F\\.\\.)|(\\.\\.\u002F)\u003C\u002FPattern>\n    \u003C\u002FURIPath>\n\n    \u003C!-- JSON body injection -->\n    \u003CJSONPayload>\n        \u003CJSONPath>$.*\u003C\u002FJSONPath>\n        \u003CPattern>[\\s]*((delete)|(exec)|(drop\\s*table)|(insert)|(shutdown)|(update))\u003C\u002FPattern>\n    \u003C\u002FJSONPayload>\n\u003C\u002FRegularExpressionProtection>\n```\n\n### 4. SpikeArrest Policy\n\nPrevents traffic spikes from overwhelming backend services:\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CSpikeArrest name=\"Spike-Arrest-1\">\n    \u003CDisplayName>API Spike Arrest\u003C\u002FDisplayName>\n    \u003CRate>30ps\u003C\u002FRate> \u003C!-- 30 per second smoothed -->\n    \u003CIdentifier ref=\"request.header.x-api-key\"\u002F>\n    \u003CMessageWeight ref=\"request.header.x-request-weight\"\u002F>\n    \u003CUseEffectiveCount>true\u003C\u002FUseEffectiveCount>\n\u003C\u002FSpikeArrest>\n```\n\n### 5. OAuth 2.0 Token Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003COAuthV2 name=\"Verify-OAuth-Token\">\n    \u003CDisplayName>Verify OAuth 2.0 Access Token\u003C\u002FDisplayName>\n    \u003COperation>VerifyAccessToken\u003C\u002FOperation>\n    \u003CExternalAuthorization>false\u003C\u002FExternalAuthorization>\n    \u003CExternalAccessToken>request.header.Authorization\u003C\u002FExternalAccessToken>\n    \u003CSupportedGrantTypes>\n        \u003CGrantType>authorization_code\u003C\u002FGrantType>\n        \u003CGrantType>client_credentials\u003C\u002FGrantType>\n    \u003C\u002FSupportedGrantTypes>\n    \u003CScope>read write\u003C\u002FScope>\n    \u003CGenerateResponse enabled=\"true\"\u002F>\n\u003C\u002FOAuthV2>\n```\n\n### 6. API Key Validation\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CVerifyAPIKey name=\"Verify-API-Key-1\">\n    \u003CDisplayName>Verify API Key\u003C\u002FDisplayName>\n    \u003CAPIKey ref=\"request.header.x-api-key\"\u002F>\n\u003C\u002FVerifyAPIKey>\n```\n\n## Proxy Bundle Configuration\n\n### Complete Secure Proxy Flow\n\n```xml\n\u003C!-- apiproxy\u002Fproxies\u002Fdefault.xml -->\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CProxyEndpoint name=\"default\">\n    \u003CPreFlow name=\"PreFlow\">\n        \u003CRequest>\n            \u003C!-- Step 1: Verify API Key or OAuth token -->\n            \u003CStep>\n                \u003CName>Verify-OAuth-Token\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 2: Rate limiting -->\n            \u003CStep>\n                \u003CName>Spike-Arrest-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 3: Threat protection -->\n            \u003CStep>\n                \u003CName>JSON-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"application\u002Fjson\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003CStep>\n                \u003CName>XML-Threat-Protection-1\u003C\u002FName>\n                \u003CCondition>request.header.Content-Type = \"text\u002Fxml\"\u003C\u002FCondition>\n            \u003C\u002FStep>\n            \u003C!-- Step 4: Injection prevention -->\n            \u003CStep>\n                \u003CName>RegEx-Threat-Protection-1\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Step 5: CORS enforcement -->\n            \u003CStep>\n                \u003CName>CORS-Policy\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FRequest>\n        \u003CResponse>\n            \u003C!-- Remove internal headers from response -->\n            \u003CStep>\n                \u003CName>Remove-Internal-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n            \u003C!-- Add security headers -->\n            \u003CStep>\n                \u003CName>Add-Security-Headers\u003C\u002FName>\n            \u003C\u002FStep>\n        \u003C\u002FResponse>\n    \u003C\u002FPreFlow>\n\n    \u003CFlows>\n        \u003CFlow name=\"sensitive-operations\">\n            \u003CDescription>Additional protection for sensitive endpoints\u003C\u002FDescription>\n            \u003CRequest>\n                \u003CStep>\n                    \u003CName>Quota-Strict\u003C\u002FName>\n                \u003C\u002FStep>\n            \u003C\u002FRequest>\n            \u003CCondition>(proxy.pathsuffix MatchesPath \"\u002Fadmin\u002F**\") or\n                       (proxy.pathsuffix MatchesPath \"\u002Fusers\u002F*\u002Fsensitive\")\u003C\u002FCondition>\n        \u003C\u002FFlow>\n    \u003C\u002FFlows>\n\n    \u003CHTTPProxyConnection>\n        \u003CBasePath>\u002Fv1\u003C\u002FBasePath>\n        \u003CVirtualHost>secure\u003C\u002FVirtualHost>\n    \u003C\u002FHTTPProxyConnection>\n\n    \u003CRouteRule name=\"default\">\n        \u003CTargetEndpoint>default\u003C\u002FTargetEndpoint>\n    \u003C\u002FRouteRule>\n\u003C\u002FProxyEndpoint>\n```\n\n### Security Headers Policy\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>\n\u003CAssignMessage name=\"Add-Security-Headers\">\n    \u003CDisplayName>Add Security Response Headers\u003C\u002FDisplayName>\n    \u003CSet>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Content-Type-Options\">nosniff\u003C\u002FHeader>\n            \u003CHeader name=\"X-Frame-Options\">DENY\u003C\u002FHeader>\n            \u003CHeader name=\"Strict-Transport-Security\">max-age=31536000; includeSubDomains\u003C\u002FHeader>\n            \u003CHeader name=\"Cache-Control\">no-store, no-cache, must-revalidate\u003C\u002FHeader>\n            \u003CHeader name=\"Content-Security-Policy\">default-src 'none'\u003C\u002FHeader>\n            \u003CHeader name=\"X-Request-ID\">{messageid}\u003C\u002FHeader>\n        \u003C\u002FHeaders>\n    \u003C\u002FSet>\n    \u003CRemove>\n        \u003CHeaders>\n            \u003CHeader name=\"X-Powered-By\"\u002F>\n            \u003CHeader name=\"Server\"\u002F>\n        \u003C\u002FHeaders>\n    \u003C\u002FRemove>\n    \u003CIgnoreUnresolvedVariables>false\u003C\u002FIgnoreUnresolvedVariables>\n    \u003CAssignTo createNew=\"false\" transport=\"http\" type=\"response\"\u002F>\n\u003C\u002FAssignMessage>\n```\n\n## Advanced API Security\n\nEnable Apigee's Advanced API Security add-on for machine-learning-based threat detection:\n\n```bash\n# Enable Advanced API Security on Apigee X instance\ngcloud apigee organizations update $ORG_NAME \\\n  --advanced-api-security-config=enabled\n\n# View detected abuse alerts\ngcloud apigee apis security-reports list \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME\n\n# Create security action to block suspicious traffic\ngcloud apigee security-actions create \\\n  --organization=$ORG_NAME \\\n  --environment=$ENV_NAME \\\n  --action-type=DENY \\\n  --condition-type=IP_ADDRESS \\\n  --condition-values=\"192.168.1.100,10.0.0.50\" \\\n  --description=\"Block identified malicious IPs\"\n```\n\n## Deployment\n\n```bash\n# Deploy proxy bundle with security policies\ngcloud apigee apis deploy \\\n  --api=$API_NAME \\\n  --environment=$ENV_NAME \\\n  --revision=$REVISION \\\n  --organization=$ORG_NAME\n\n# Validate deployment\ngcloud apigee apis list-deployments \\\n  --api=$API_NAME \\\n  --organization=$ORG_NAME\n```\n\n## References\n\n- Apigee JSON Threat Protection: https:\u002F\u002Fcloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-platform\u002Freference\u002Fpolicies\u002Fjson-threat-protection-policy\n- Google Cloud Apigee Security Best Practices: https:\u002F\u002Fcloud.google.com\u002Farchitecture\u002Fbest-practices-securing-applications-and-apis-using-apigee\n- Apigee Advanced API Security: https:\u002F\u002Fdocs.cloud.google.com\u002Fapigee\u002Fdocs\u002Fapi-security\n- Apigee OWASP API Top 10: https:\u002F\u002Fdocs.apigee.com\u002Fapi-platform\u002Ffaq\u002Fowasp-top-api-threats\n- Wallarm Apigee Security Policies Guide: https:\u002F\u002Flab.wallarm.com\u002Fwhat\u002Fapigee-api-security-policies-howto\u002F\n",{"name":5,"domain":34,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fwebapp-api-apigee","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-apigee",{"tool":56,"command":57},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-apigee",{"tool":59,"command":60},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-apigee","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-apigee\u002FSKILL.md",true,[64],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"index.json","REFERENCE","参考文档",504,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-apigee\u002Findex.json",[71,96,119,141,163,178],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":38},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,34,95],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":38},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[103,78,104,81,105,106,107,34,108,109,110,111,112,113,83,114,115,116,117,118],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":38},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[126,127,128,129,130,131,34,108,132,109,133,134,83,116,135,136,137,138,139,140],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":38},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[79,148,149,150,151,152,153,84,154,34,95,155,156,157,158,159,160,161,162,83],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":38},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[170,171,79,172,150,152,173,84,174,154,34,95,109,30,175,176,177,162,83,85],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":38},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[185,79,150,186,173,84,187,188,34,95,189,190,191,192,193,194,83,85,195,196],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]