API Management

Turn your API sprawl into an agent-ready catalog

Fri, 27 Feb 2026 17:00:00 +0000

In modern cloud architectures, APIs are the fundamental building blocks of applications. However, as organizations scale, these APIs often end up scattered across multiple gateways, teams, and platforms. This sprawl creates blind spots that hinder governance and reusability, but it creates an even bigger problem for the next generation of software: it can block the effective use of AI.

Today, we’ll share two ways you can solve this:

Specification boost (spec boost) add-on, which lets you automatically enhance the readability and discoverability of your API specifications in Apigee API hub.
A new integration between API hub and API Gateway.

Together, these features help you bring your distributed APIs into a single control plane and ensure they are ready for the agentic future.

Why this matters for your AI strategy

An agent is only as good as the tools you give it. Apigee API hub lets you consolidate and organize information about all of the APIs of interest to your organization. API hub lets you capture critical information about APIs that allows developers to discover and evaluate them easily and leverage the work of other teams wherever possible. By using API hub to control API sprawl, you ensure that:

Agents can find your APIs: Centralization prevents shadow APIs from being ignored by your AI tools.
Agents can use your APIs: Enhanced documentation reduces hallucinations and improves the success rate of function calling.

Sprawl hurts AI adoption

We often see organizations managing APIs across a mix of platforms — using API Gateway for simple serverless cases, Apigee for mission-critical workloads, and various third-party solutions. This distributed reality makes it difficult for platform teams to enforce security or track usage in three ways:

Scattered APIs: Hidden in different systems where agents can't discover them.
Incomplete APIs: Lacking the rich context — like examples and error codes — that agents need to understand how to use the API.
Non-existent APIs: Many legacy specless proxies run with no documentation at all, making them invisible to automated tools.

Step 1: Centralize your API metadata

The first step to fixing this is visibility. The new integration between API Gateway and API hub allows you to automatically synchronize your API metadata into a single repository.

API Gateway enables you to provide secure access to your backend services through a well-defined REST API that is consistent across all of your services, regardless of the service implementation.

When you connect API Gateway to API hub, the system automatically discovers and synchronizes your API definitions, OpenAPI specifications, and gateway configurations in near real-time . This works transparently in the background without requiring changes to your existing APIs or clients.

By bringing these assets together, you maintain distributed control — letting teams use the right gateway for the job — while standardizing knowledge in one place.

Step 2: Make APIs agent-ready with API spec boosting add-on

Once your APIs are centralized, you might realize that while your specifications are technically accurate, they aren't helpful enough for an AI agent. To bridge this gap, we are introducing a specification boost add-on for API hub in public preview.

This add-on makes your specification files agent ready. Boosting your specifications makes them more accessible to developers, API consumers, and AI agents.

How it works:

Analysis: It scans your centralized APIs to find gaps, such as missing usage examples or undefined error conditions.
Enhancement: It generates a "boosted" version of the specification that includes the precise parameter validation and behavioral examples agents need to function reliably.
Easy comparison: It creates a parallel version labeled specboost-draft. It does not overwrite your original source, allowing you to compare the original and boosted versions side-by-side before adoption.

You can enable this capability directly from the Add-on management section of the API hub console (see Figure 1).

Figure 1: The Add-on management screen in Google Cloud console where you can enable the specification boost add-on.

Once enabled, you can view the status of your specifications in the API hub list view. As shown in Figure 2, boosted specifications are clearly linked alongside your original files, making it easy to access the enhanced versions.

Figure 2: The Specification file list showing the original "s1" spec and the generated "s1-Specboost" version.

Get started

Both capabilities are available now.

For API Gateway users: You will see prompts to onboard to API hub directly in your console. To learn more about how to bring your APIs into a single control plane, read the API Gateway integration documentation.
For specification boost add-on: You can enable this directly within your API hub settings to begin generating enhanced specifications. Visit the documentation to learn how to prepare your portfolio for the agentic future.

Announcing advanced governance capabilities for Vertex AI Agent Builder

Thu, 18 Dec 2025 17:00:00 +0000

At Google Cloud, we continue to make critical investments to Vertex AI Agent Builder, our comprehensive and open platform, enabling you to build faster, scale efficiently, and govern with enterprise-grade security.

Today, with the integration of the Cloud API Registry, we’re excited to bring enhanced tool governance capabilities to Vertex AI Agent Builder. With this latest update, administrators can now manage available tools for developers across your organization directly in Vertex AI Agent Builder Console, and developers can leverage tools managed by the registry with a new ApiRegistry.

With this, organizations can anchor agents in the embedded security and operational controls that they already use, enabling deploying and managing agents as a digital workforce.

Following last month's expansion of our Agent Builder platform, we are also introducing new capabilities across the entire agent lifecycle to help developers build faster using new ADK capabilities and visual tools, and scale with high performance through the expansion of Agent Engine services, including the general availability of support for sessions and memory. Read more below.

1. Govern your tools with confidence

Building a useful agent requires the agent to have access to the necessary tools. However, developers today spend a significant amount of time building their tools for each agent, resulting in duplicate work. This approach also presents challenges for administrators who want to control what data and tools agents can access.

We are bringing enhanced tool governance with the integration of Cloud API Registry in the Vertex AI Agent Builder Console. This acts as a private registry that administrators can use to curate and govern a set of approved tools for developers to use across their organization, providing:

Pre-built tools for Google services: We recently announced MCP support for Google services like BigQuery and Google Maps, which will be available for use in Vertex AI Agent Builder.
Support for custom MCP servers: Unlock your entire API estate for the agentic age. Apigee now empowers you to transform your existing managed APIs into custom MCP servers, bridging your established digital assets with modern AI workflows. Additionally, by bringing these tools from multiple clouds into Apigee API hub, you help ensure your agent developers have instant and secure access to a curated catalog through the Cloud API Registry.
Enhanced tool management: Administrators using the new experience in Vertex AI Agent Builder to view, govern, and manage tools can now ensure the right tools are available to developers in their organization.
Simplified tool access: For developers, Agent Development Kit (ADK) introduces support of Cloud API Registry, introducing a new ApiRegistry object to easily leverage managed tools.

The demo above showcases the new user journey for managing and governing tools directly within the Vertex AI Agent Builder Console

2. Build your AI agents faster

Last month, we released Gemini 3 Pro, our most intelligent model, to every developer and enterprise team. It’s the best model in the world for multimodal understanding, and our most powerful agentic model yet. With full compatibility with ADK, you can now build, test, and deploy powerful AI agents with greater reliability and confidence. We are introducing new capabilities to help you move from concept to interactive product:

Full ADK support of Gemini 3 Pro and Flash: ADK now fully supports Gemini 3 Pro and Flash, allowing you to build reliable, production-ready agents.
ADK for TypeScript: We are extending ADK support for TypeScript, ensuring you can leverage the latest capabilities in ADK directly in whatever language you choose.
State management in ADK: We've made significant improvements to our agentic state management within ADK, which is the system for an AI agent to maintain context and memory during and across conversations. New improvements include:
- Recovery from failure: If a conversation crashes due to an error, ADK now restores the state natively, requiring no additional work from the developer.
- Continue with human-in-the-loop: You can now pause for human input anywhere, even inside complex workflows. ADK automatically remembers exactly where the agent stopped and resumes immediately after approval, so you don't have to write extra code to track progress.
- Rewind state and context: Developers can now rewind to any point in the conversation and invalidate all interactions after that point so the user can remove the “polluted” context rather than send a new message. This allows users to try different approaches to solving a problem without having to open new sessions.
Interactions API integration: ADK and the Agent2Agent protocol (A2A) now support the new Interactions API, providing a consistent way to manage multimodal input/output (text, audio, visual) across your agents, simplifying integration with client applications.
A2UI: Built on top of A2A protocol, A2UI is an early-stage UI toolkit to facilitate LLM-generated UIs for remote agents. This allows you to enable agents to pass shared UI widgets and components directly to user-facing applications without the security risks and overhead of iframes or sending executable code, allowing you to build rich user experiences securely.

Above is a demo showcasing A2UI in action where the user uploads a photo, a remote agent uses Gemini to understand it, and dynamically generates a custom form using A2UI for the specific needs of the customer.

You can start building today with adk-samples on GitHub or on Vertex AI Agent Garden, a growing repository of curated agent samples, solutions, and tools designed to accelerate your development and support one-click deployment of your agents built with ADK. Access our Agent Starter Pack, a template collection that provides a production-ready foundation for building, testing, and deploying AI agents.

3. Scale your AI agents effectively

Once you’ve built your agent, the next challenge is going into a production environment. That’s why we continue to expand the managed services available in Agent Engine to provide the core capabilities needed to scale your agents.

Manage context with confidence: We are moving Agent Engine sessions and memory bank to General Availability (GA). You can now use Agent Engine to manage both short-term and long-term memory for your production workloads. This allows your agents to maintain context across different interactions, which is critical for delivering helpful, personalized responses at scale. This product is powered by Google Cloud AI Research’s novel research method (accepted by ACL 2025), using a topic-based approach that sets a new standard for how agents learn and recall information.
Expanded regional support for Agent Engine services: All Agent Engine services are now available in seven additional regions worldwide. To learn more, refer to the documentation.
Pricing updates for Agent Engine: We lowered pricing for the Agent Engine runtime and will begin billing for additional Agent Engine services starting on January 28, 2026. You can review the Agent Engine pricing documentation for additional detail and hypothetical agent cost scenarios.

Product	Resource	SKU	Prior pricing	New pricing	Price change date
Runtime	vCPU / hour	8A55-0B95-B7DC	$0.0994	$0.0864	December 16, 2025
Runtime	Memory / GB-hr	0B45-6103-6EC1	$0.0105	$0.0090	December 16, 2025
Code Execution	vCPU / hour	448F-9419-C2EE	Free	$0.0864	January 28, 2026
Code Execution	Memory / GB-hr	AC0F-52B0-CE44	Free	$0.0090	January 28, 2026
Sessions	Stored session events	0D5A-FCD2-CB63	Free	$0.25/1,000 events	January 28, 2026
Memory Bank	Memories stored per month	E954-622B-C859	Free	$0.25/1,000 memories (LLMcostsbilled separately)	January 28, 2026
Memory Bank	Memories retrieved	6DEC-3026-DDFF	Free	$0.50/1,000 memories	January 28, 2026

The table above shows updated pricing for Agent Engine services and when the changes take place.

How customers are achieving more with Agent Builder

"Burns & McDonnell uses Vertex AI Agent Builder to transform how organizational knowledge is applied across the enterprise. With Experience IQ, we are building an AI agent using ADK that turns decades of project data and employee experience into real-time, actionable intelligence. Vertex AI enables this innovation to scale responsibly by combining deterministic business rules with probabilistic reasoning, making AI a trusted operational capability — not just a productivity tool. This agent helps teams quickly identify the right experience, reduce manual effort in staffing and planning, and make higher-confidence decisions grounded in verified data. With Vertex AI, Burns & McDonnell isn’t just managing knowledge — we are activating experience to drive faster, more confident decisions." - Matt Olson, Chief Innovation Officer, Burns & McDonnell

“Payhawk uses Vertex AI Agent Builder to transform agents into financial assistants that truly ‘know’ our customers. Leveraging Memory Bank, we moved from stateless interactions to long-term context retention, allowing agents to recall user constraints and historical patterns with continuity. For example, our Financial Controller Agent now remembers habits like expensing small meals and auto-submits them, reducing submission time by over 50%. Similarly, our Travel Agent proactively applies preferences like aisle seats. This significantly drops cognitive load, allowing agents to anticipate needs based on past behavior rather than just reacting to prompts.” - Diyan Bogdanov, Principal Applied AI Engineer, Payhawk

"Gurunavi uses Vertex AI Agent Builder to power 'UMAME!', an AI restaurant discovery app that leverages Agent Engine's Memory Bank to overcome a significant challenge: achieving a deep understanding of user context. Unlike conventional prompt-based systems, our agent leverages memory bank to remember a user's past actions, preferences, and temporal patterns to proactively present the best options. This eliminates the need for manual searches, creating a seamless experience. We project this context-aware capability will improve user experience by 30% or more. We view this memory function as a non-negotiable feature for helping everyone forge new culinary experiences together with AI.” - Toshiaki Iwamoto, CTO, Gurunavi

“SeaArt Entertainment uses Vertex AI Agent Builder to personalize the creative experience for digital artists. Before Memory Bank, our AI agents could not reliably remember users’ preferences. For example, when users worked on complex multimodal art projects, they had to repeatedly explain the same details — like their favorite character styles or model choices — across sessions. After integrating Memory Bank, our agents are now able to recall past conversations, actions, and user preferences. We especially like that the agent can seamlessly remember context across sessions, making interactions feel more natural and personal." - Aleksei Savin, Lead of Multimodal AI Platform, SeaArt Entertainment

Get started

Vertex AI Agent Builder provides the unified platform to manage the entire agent lifecycle, helping you close the gap from prototype to a production-ready agent. To explore these new features, visit the updated Agent Builder documentation and release notes.

If you’re a startup and you’re interested in learning more about building and deploying agents, download the Startup Technical Guide: AI Agents. This guide provides the knowledge needed to go from an idea to prototype to scale, whether your goals are to automate tasks, enhance creativity, or launch entirely new user experiences for your startup.

Announcing MCP support in Apigee: Turn existing APIs into secure and governed agentic tools

Wed, 10 Dec 2025 15:00:00 +0000

Today, we expanded Google’s support for Model Context Protocol (MCP) with the release of fully-managed, remote MCP servers, giving developers worldwide consistent and enterprise-ready access to Google and Google Cloud services. This includes support for MCP in Apigee, which makes it possible for agents to use your secure, governed APIs and custom workflows cataloged in Apigee API hub, as tools to complete tasks for end users.

With Apigee’s support for MCP, you don’t need to make any changes to your existing APIs, write any code, or deploy and manage any local or remote MCP servers. Apigee uses your existing API specifications and manages the underlying infrastructure and transcoding, so that you can focus on the business logic for your agents.

Overview of Apigee’s MCP support

Apigee provides 30+ built-in policies for authorization, authentication, security, and governance controls to ensure that API interactions are consistently protected. Apigee’s debugging UI and analytics capabilities provide end-to-end visibility over those interactions and monitoring and alerting for traffic and performance issues.

With Apigee’s support for MCP, you can turn your existing APIs into MCP tools, governed by the same set of policies and with full visibility over agentic interactions. You can do this by creating an “MCP proxy” in an environment group, specifying /mcp as the basepath and mcp.apigee.internal as the target URL, and including an OpenAPI specification. Once the MCP proxy is deployed, it will be registered in Apigee API hub as an “MCP” API.

Deployed MCP proxies are automatically registered in Apigee API hub

When a tools/list or tools/call request is made to the MCP endpoint, Apigee uses the operations documented in the OpenAPI spec as the MCP tools list. You can then bundle the MCP proxy in an API product, and apply granular quota and identity and access policies to ensure that only authorized MCP clients, agents, and developers can list and call those tools.

With this process you can, for example, designate specific API operations as MCP tools. You can then specify that an MCP tool for your “Payments” service can only be accessed by designated agents with known client identities and a legitimate need to use the tool.

You can then use Apigee Analytics to monitor MCP tool usage. And, with the recent launch of Apigee API insights, you can also use the new “Insights” tab in Apigee API hub’s catalog to view traffic and performance metrics for your MCP endpoints.

Benefits of Apigee’s approach to MCP support

Our main goal with MCP support in Apigee is to make sure that you can secure, govern, and monitor usage of MCP tools with the same policies and workflows in Apigee that you’re already familiar with.

What this means for you:

No added operational burden: You don’t need to set up and manage an MCP server for each of your APIs; just deploy an MCP proxy, and Apigee will take care of the rest. Apigee fully manages the MCP servers, transcoding, and protocol handling.
Tool observability and governance: Apigee’s built-in identity, authorization, and security policies can also be used to secure and govern your MCP endpoints and tools, and you can use Apigee analytics to monitor tool usage by MCP clients.
Comprehensive tool security: Apigee helps make sure that all agentic interactions are secure. For example, you can use Cloud Data Loss Prevention to classify and protect sensitive data passed from your tools, and use Model Armor to guard against prompt injection and jailbreaking attempts. You can make sure agents and users have the proper IAM permissions to invoke MCP tools, and view and fully debug the entire end-to-end flow of agentic interactions. You can also use Apigee Advanced API Security to keep your tools secure.
Centralized tool catalog: After you deploy an MCP proxy, Apigee automatically registers your MCP endpoint in Apigee API hub, along with your spec. This allows you to maintain a searchable, centralized tool catalog and promote tool reuse.

Using Apigee MCP tools with agent frameworks

Apigee’s MCP support is designed for maximum compatibility. Your secured Apigee MCP endpoints are usable with agents built using a variety of frameworks, including ADK, LangGraph, and other popular solutions across the AI ecosystem.

However, developers choosing Agent Development Kit (ADK) have an exclusive, streamlined advantage when developing agents within the Google ecosystem.

ADK is a flexible and modular framework for developing and deploying AI agents. While optimized for Gemini and the Google ecosystem, ADK is model-agnostic, deployment-agnostic, and is built for compatibility with other frameworks. ADK was designed to make agent development feel more like software development, to make it easier for developers to create, deploy, and orchestrate agentic architectures that range from simple tasks to complex workflows.

ADK includes a toolset for both Apigee and Application Integration, so that developers building custom agents with ADK can easily connect those agents to your MCP endpoints and tools that are governed and secured with Apigee. You can also use the ApigeeLLM wrapper for ADK to expose your LLM endpoint through an Apigee proxy, integrating governance into your agentic workflows. (Note: The ApigeeLLM wrapper is currently designed for use with Vertex AI and the Gemini API in Google AI Studio, but we’re planning to support other models and interfaces.)

Google Cloud also provides services for deploying custom agents. You can use Vertex AI Agent Engine to deploy your agents, and then put them in action across your organization using Gemini Enterprise.

Next steps

MCP support in Apigee is currently in preview use with customers. Please contact your Apigee or Google Cloud account team to access this feature.

Google Cloud Apigee Named a Leader for the 10th Consecutive Time in the Gartner® Magic Quadrant™ for API Management

Tue, 14 Oct 2025 18:30:00 +0000

We are excited to share that Google has been recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for API Management, positioned highest for our Ability to Execute — marking our tenth consecutive recognition.

Google was positioned highest in Ability to Execute of all vendors evaluated. We believe this reflects our commitment supporting traditional API use cases, but also in providing a bridge for our customers to AI and agentic AI management, using the same familiar platform and native controls.

Extending API management to gen AI and agentic AI

The rise of AI and agentic workloads is powered by an API nervous system. While AI tools create powerful possibilities, organizations often hit roadblocks moving from pilot to production. At issue are managing, securing, and scaling these solutions — especially with LLMs and the agents that leverage them in highly regulated environments.

Apigee, Google Cloud's native API management platform, bridges this gap. We are extending our proven capabilities directly to your AI initiatives, helping them deliver real, measurable business value.

Apigee functions as the intelligent, secure proxy for all your AI agents, tools, and backend models, enhancing their security, scalability, and governance. By serving as this crucial gateway, Apigee helps secure agentic workloads against risks, ensures operations are on governed data, and helps control costs.

Managing, governing, and securing agentic AI

A variety of Apigee capabilities help enterprise API and AI platform teams move AI initiatives into production. These capabilities include:

AI productization
API products are the the center of the Apigee platform, enabling platform teams to bundle discrete API operations into a product, manage access and quota, and make it available for consumption. Today, Apigee is helping teams move toward AI productization, bundling tools including third-party integrations (from Application Integration), agentic tools such as MCP servers, and of course APIs, into an AI product. This promotes developer reuse, granular access control, and monetization, so organizations can unlock new revenue streams.

Agent-ready tools
Apigee’s new API specification boosting capability (currently in Private Preview), based on a multi-agent tool built by Google DeepMind, automatically enhances existing API specifications to make them more discoverable by agents. It does so by including comprehensive examples, error scenarios, and business logic derived from your organization's API patterns.

AI cost management
Customers use Apigee’s native quota policies to enforce token limits at the API or AI product level. Our integration with Looker Studio (a free Google Cloud service) provides API platform teams with the ability to create custom reports on AI token usage that can be shared externally with stakeholders.

Centralized tool catalog and observability
Apigee API hub provides a centralized catalog in which to store information about their APIs, MCP servers, and third-party integrations. Built-in semantic search capabilities powered by Gemini help teams discover and reuse tools. Thanks to the Apigee API hub toolset for Agent Development Kit (ADK), developers building custom agents using ADK can easily give agents access to tools from Apigee API hub with a single line of code. API traffic and performance data is integrated into the catalog for access by humans and agents. Further, these same semantic capabilities drive emerging use cases for semantic tool identification.

Tool security and compliance
Apigee’s 60+ policies include security policies to help keep tools protected and safe, including native policies for AI safety using Model Armor. Additionally, Apigee Advanced API Security integrates natively with Apigee’s runtime, providing enhanced security capabilities like dynamic API security posture management and abuse detection powered by Google-engineered machine learning models. Finally, Apigee’s enhanced data residency capabilities help support compliant workloads worldwide.

Multi-cloud model routing
Apigee serves as a proxy between agents and backend LLM models, connecting agents with tools and providing routing to backend LLM models hosted on and off Google Cloud. Apigee’s circuit-breaking capabilities help ensure that AI and agentic applications remain highly available.

Apigee: Trusted by global leaders

Global leaders trust Apigee to manage mission-critical APIs at scale, even in highly regulated industries. We are committed to continuously investing in Apigee to ensure it remains a world-class, trusted service that meets the evolving needs of our customers. In our opinion, this recognition from Gartner reinforces our commitment to continuous innovation and the delivery of an exceptional developer experience.

Thank you to our customers and partners

We're incredibly grateful to our community of customers, developers, and partners for your continued support and trust in Apigee. Your feedback and collaboration are invaluable in driving our product roadmap and helping us deliver reliable API management experience.

Download the full report to learn more.

Protecting your APIs from OWASP’s top 10 security threats

Fri, 14 Mar 2025 16:00:00 +0000

APIs are an integral part of modern services, and the data they exchange is often highly sensitive. Without proper authentication, authorization, and protection against data leakage, your organization and your end users will face an increased risk of cyberattacks.

The Open Worldwide Application Security Project (OWASP) develops and publishes community-led documentation and standards for critical areas of software security, including APIs. APIs are estimated to comprise over half of internet traffic today.

That number is likely to climb as AI adoption grows, because AI already relies heavily on APIs for building foundation models, streamlining integration of AI capabilities into applications, facilitating interoperability between models running on different platforms, and providing continuous access to the real-time data needed to train and improve AI models.

Given the already large and growing reliance on APIs, organizations should implement an API security strategy. OWASP’s guidance on top 10 API security threats provides a starting point. We have taken their list and added mitigation recommendations for each risk they’ve identified. Our new whitepaper, Mitigating OWASP Top 10 API Security Threats, provides more details on each threat and how Apigee, Google Cloud’s API management platform, can help manage API risk.

aside_block: <ListValue: [StructValue([('title', '$300 in free credit to try Google Cloud security products'), ('body', <wagtail.rich_text.RichText object at 0x7f3ab82a8e80>), ('btn_text', 'Start building for free'), ('href', 'http://console.cloud.google.com/freetrial?redirectPath=/welcome'), ('image', <GAEImage: Google Cloud>)])]>

What you can do about the OWASP top 10 API security risks

For organizations who are just getting started with their API security program, OWASP’s list of top 10 API security risks provides a good starting point. It represents the most critical vulnerabilities that organizations should address to protect their API systems. These threats are broadly categorized into themes of authorization, authentication, resource management, security misconfiguration, and third-party risks.

Authorization flaws, including Broken Object Level Authorization (BOLA), Broken Object Property Level Authorization (BOPLA), and Broken Function Level Authorization (BFLA), are particularly concerning as they allow attackers to bypass access controls and manipulate data or functionalities.

BOLA occurs when an API fails to enforce proper access controls on individual data objects, enabling attackers to access or modify data without proper authorization. BOPLA, on the other hand, arises when access control measures are not effectively enforced on individual properties within a data object, allowing attackers to manipulate sensitive attributes. BFLA occurs when specific functions or operations within the API lack adequate access control mechanisms, enabling attackers to perform unauthorized actions.

Authentication weaknesses, such as broken authentication, can lead to impersonation and unauthorized access. Unrestricted resource consumption and unrestricted access to sensitive business flows can also disrupt operations and expose critical data that can be exploited by attackers.

Security misconfiguration and improper inventory management of APIs can create additional vulnerabilities that attackers can exploit. Finally, unsafe consumption of third-party APIs introduces external risks, as vulnerabilities in those APIs can compromise the security of the consuming API.

Addressing these threats requires a multi-layered approach, including robust access controls, secure authentication mechanisms, proper resource management, thorough security configurations, and careful integration of third-party APIs.

Mitigating security risks with Apigee and Advanced API Security

Apigee, Google Cloud’s API management platform, enables API platform teams to program and deploy secure API proxies that can protect your backend services from these kinds of attacks. The chart below highlights some specific capabilities in Apigee and Advanced API Security that can help you keep your APIs protected from OWASP’s Top 10 API Security risks.

OWASP Top 10 API Security Risks (2023)	Apigee and Advanced API Security mitigation capabilities
Broken Object Level Authorization (BOLA)	Quota management OAuth 2.0 and OpenID Connect Sensitive data protection API proxy security configuration checks and alerting Abuse and anomaly detection rules and machine learning models Security actions, to automatically flag and block suspicious traffic
Broken authentication	Authentication OAuth 2.0 and OpenID Connect API key verification JSON Web Token (JWT) support Abuse and anomaly detection rules and machine learning models API proxy security configuration checks and alerting
Broken Object Property Level Authorization (BOPLA)	Data masking OpenAPI specification validation API proxy security configuration checks and alerting Abuse and anomaly detection rules and machine learning models Traffic analysis and reporting
Unrestricted resource consumption	Quota management Spike Arrest policy Caching Abuse and anomaly detection rules and machine learning models (to identify activity that could signal a DoS attack or resource exhaustion) API proxy security configuration checks and alerting (e.g., check to ensure all proxies have a Spike Arrest policy)
Broken Function Level Authorization (BFLA)	API products (for granular access control) Quota management Spike Arrest policy OpenAPI specification validation API keys and OAuth support for API authentication Message validation for XML and SOAP payloads, validation of RESTful API requests, and GraphQL validation API proxy security configuration checks and alerting Abuse and anomaly detection rules and machine learning models
Unrestricted access to sensitive business flows	Authentication and role-based access control (RBAC) OAuth 2.0 and OpenID Connect API key verification and JSON Web Token (JWT) support Rate limiting Payload inspection for SQL injection attacks or cross-site scripting (XSS) attacks API proxy security configuration checks and alerting Abuse and anomaly detection rules and machine learning models
Server-Side Request Forgery (SSRF)	Input validation SIEM and WAF integrations API proxy security configuration checks and alerting Abuse and anomaly detection rules and machine learning models
Security misconfiguration	API proxy security configuration checks and alerting, to check and alert on security misconfigurations across proxies (and you can use our API to integrate proxy security score checks into your CI/CD pipeline) Comprehensive built-in security policies, including rate limiting and CORS policies Access control (including API key verification) Monitoring, logging, and alerting (supported through a native integration with Cloud Monitoring and support for 3P tools) Real-time protection against attacks, to prevent exploits of security misconfigurations
Improper inventory management	Versioning and lifecycle management Centralized API inventory and governance via API hub Shadow API discovery Monitoring, logging, and alerting (supported through a native integration with Cloud Monitoring and support for 3P tools) API proxy security configuration checks and alerting
Unsafe consumption of APIs	API products (for granular access control) Use an API gateway Access control policies, including OAuth 2.0, API key verification, and quota management Message validation for XML and SOAP payloads, validation of RESTful API requests, and GraphQL validation Monitoring, logging, and alerting (supported through a native integration with Cloud Monitoring and support for 3P tools) SIEM and WAF integrations Abuse and anomaly detection rules and machine learning models Real-time visibility into API consumption and risk, and threat response

Teams who want to take a layered approach to API and application security can use Apigee and Advanced API Security together with a Web Application Firewall (WAF) like Cloud Armor. Cloud Armor’s robust protection against DDoS attacks — including L3/L4 DDoS defense and DDoS thresholds — can help increase protection against unrestricted resource consumption and other security threats.

aside_block: <ListValue: [StructValue([('title', 'Hear monthly from our Cloud CISO in your inbox'), ('body', <wagtail.rich_text.RichText object at 0x7f3ab82a8d60>), ('btn_text', 'Subscribe today'), ('href', 'https://go.chronicle.security/cloudciso-newsletter-signup?utm_source=cgc-blog&utm_medium=blog&utm_campaign=FY23-Cloud-CISO-Perspectives-newsletter-blog-embed-CTA&utm_content=-&utm_term=-'), ('image', <GAEImage: Cloud CISO Perspectives new header July 2024 small>)])]>

Get started on API security with Apigee

To learn more about how Apigee can help mitigate the OWASP top 10 API security threats, read our free whitepaper. It explores each threat outlined above in more detail, including specific product capabilities that can help protect against each threat.

You can also learn more about Apigee’s built-in security policies and Advanced API Security’s capabilities in our docs. If you’re attending Google Next this April, check out our session on mitigating API and AI security risks with Google Cloud.

Operationalizing generative AI apps with Apigee

Thu, 13 Feb 2025 17:00:00 +0000

Generative AI is now well beyond the hype and into the realm of practical application. But while organizations are eager to build enterprise-ready gen AI solutions on top of large language models (LLMs), they face challenges in managing, securing, and scaling these deployments, especially when it comes to APIs. As part of the platform team, you may already be building a unified gen AI platform. Some common questions you might have are:

How do you ensure security and safety for your organization? As with any API, LLM APIs represent an attack vector. What are the LLM-specific considerations you need to worry about?
How do you stay within budget when your LLM adoption grows, while ensuring that each team has appropriate LLM capacity they need to continue to innovate and make your business more productive?
How do you put the right observability capabilities in place to understand your usage patterns, help troubleshoot issues, and capture compliance data?
How do you give end users of your gen AI applications the best possible experience, i.e., provide responses from the most appropriate models with minimal downtime?

Apigee, Google Cloud’s API management platform, has enabled our customers to address API challenges like these for over a decade. Here is an overview of the AI-powered digital value chain leveraging Apigee API Management.

Figure 1: AI-powered Digital Value chain

Gen AI, powered by AI agents and LLMs, is changing how customers interact with businesses, creating a large opportunity for any business. Apigee streamlines the integration of gen AI agents into applications by bolstering their security, scalability, and governance through features like authentication, traffic control, analytics, and policy enforcement. It also manages interactions with LLMs, improving security and efficiency. Additionally, Application Integration, an Integration-Platform-as-a-Service solution from Google cloud, offers pre-built connectors that allow gen AI agents to easily connect with databases and external systems, helping them fulfill user requests.

aside_block: <ListValue: [StructValue([('title', '$300 in free credit to try Google Cloud AI and ML'), ('body', <wagtail.rich_text.RichText object at 0x7f3ab454f1f0>), ('btn_text', 'Start building for free'), ('href', 'http://console.cloud.google.com/freetrial?redirectPath=/vertex-ai/'), ('image', None)])]>

This blog details how Apigee’s customers have been using the product to address challenges specific to LLM APIs. We’re also releasing a comprehensive set of reference solutions that enable you to get started on addressing these challenges yourself with Apigee. You can also view a webinar on the same topic, complete with product demos.

Apigee as a proxy for agents

AI agents leverage capabilities from LLMs to accomplish tasks for end-users. These agents can be built using a variety of tools — from no-code and low-code platforms, to full-code frameworks like LangChain or LlamaIndex. Apigee acts as an intermediary between your AI application and its agents. It enhances security by allowing you to defend your LLM APIs against the OWASP Top 10 API Security risks, manages user authentication and authorization, and optimizes performance through features like semantic caching. Additionally, Apigee enforces token limits to control costs and can even orchestrate complex interactions between multiple AI agents for advanced use cases.

Apigee as a gateway between LLM application and models

Depending on the task at hand, your AI agents might need to tap into the power of different LLMs. Apigee simplifies this by intelligently routing and managing failover of requests to the most suitable LLM using Apigee’s flexible configurations and templates. It also streamlines the onboarding of new AI applications and agents while providing robust access control for your LLMs. Beyond LLMs, agents often need to connect with databases and external systems to fully address users’ needs. Apigee’s robust API Management platform enables these interactions via managed APIs, and for more complex integrations, where custom business logic is required, you can leverage Google Cloud’s Application Integration platform.

It's important to remember that these patterns aren't one-size-fits-all. Your specific use cases will influence the architecture pattern for an agent and LLM interaction. For example, you might not always need to route requests to multiple LLMs. In some scenarios, you could connect directly to databases and external systems from the Apigee agent proxy layer. The key is flexibility — Apigee lets you adapt the architecture to match your exact needs.

Now let’s break down the specific areas where Apigee helps one by one:

AI safety
For any API managed with Apigee, you can call out to Model Armor, Google Cloud’s model safety offering that allows you to inspect every prompt and response to protect you against potential prompt attacks and help your LLMs respond within the guardrails you set. For example, you can specify that your LLM application does not provide answers about financial or political topics.

Latency and cost
Model response latency continues to be a major factor when building LLM-powered applications, and this will only get worse as more reasoning happens during inference. With Apigee, you can implement a semantic cache that allows you to cache responses to any model for semantically similar questions. This dramatically reduces the time end users need to wait for a response.

In this solution, Vertex AI Vector Search and Vertex AI Embeddings API process your prompts and help you identify similar prompts for which you can then retrieve a response from Apigee’s Cache. See Semantic Cache in Apigee reference solution to get started.

Performance
Different models are good at different things. For example, Gemini Pro models provide the highest quality answers, while Gemini Flash models excel at speed and efficiency. You can route users’ prompts to the best model for the job, depending on the use case or application.

You can decide which model to use by specifying it in your API call and Apigee routes it to your desired model while keeping a consistent API contract. See this reference solution to get started.

Distribution and usage limits
With Apigee you can create a unified portal with self-service access to all the models in your organization. You can also set up usage limits by individual apps and developers to maintain capacity for those who need it, while also controlling overall costs. See how you can set up usage limits in Apigee using LLM token counts here.

Availability
Due to the high computational demands of LLM inference, model providers regularly restrict the number of tokens you can use in a certain time window. If you reach a model limit, requests from your applications will get throttled, which could lead to your end users being locked out of the model. In order to prevent this, you can implement a circuit breaker in Apigee so that requests are re-routed to a model with available capacity. See this reference solution to get started.

Reporting
As a platform team, you need visibility into usage of the various models you support as well as which apps are consuming how many tokens. You might want to use this data for internal cost reporting or to optimize. Whatever your motivation, with Apigee, you can build dashboards that let you see usage based on the actual tokens counts — the currency of LLM APIs. This way you can see the true usage volume across your applications. See this reference solution to get started.

Auditing and troubleshooting
Perhaps you need to log all interactions with LLMs (prompts, responses, RAG data) to meet compliance or troubleshooting requirements. Or perhaps you want to analyze response quality to continue to improve your LLM applications. With Apigee you can safely log any LLM interaction with Cloud Logging, de-identify it, and inspect it from a familiar interface. Get started here.

Security
With APIs increasingly seen as an attack surface, security is paramount to any API program. Apigee can act as a secure gateway for LLM APIs, allowing you to control access with API keys, OAuth 2.0, and JWT validation. This helps you enforce using enterprise security standards to authenticate users and applications that interact with your models. Apigee can also help prevent abuse and overload by enforcing rate limits and quotas, safeguarding LLMs from malicious attacks and unexpected traffic spikes.

In addition to these security controls, you can also use Apigee to control the model providers and models that can be used. You can do this by creating policies that define the models that can be accessed by which users or applications. For example, you could create a policy that only allows certain users to access your most powerful LLMs, or you could create a policy that only allows certain applications to access your LLMs for specific tasks. This gives you granular control over how your LLMs are used, so they are only used for their intended purposes.

But Apigee can offer even more advanced protection with its Advanced API Security functionality. This allows you to defend your LLM APIs against the OWASP Top 10 API Security vulnerabilities.

By integrating Apigee with your LLM architecture, you create a secure and reliable environment for your AI applications to thrive.

Ready to unlock the full potential of gen AI?

Explore Apigee's comprehensive capabilities for operationalizing AI and start building secure, scalable, and efficient gen AI solutions today! Visit our Apigee generative AI samples page to learn more and get started, watch a webinar with more details, or contact us here!

Google Cloud Apigee named a Leader in the 2024 Gartner® Magic Quadrant™ for API Management

Thu, 24 Oct 2024 16:00:00 +0000

We're excited to announce that Google Cloud’s Apigee has been named a Leader in the 2024 Gartner® Magic Quadrant™ for API Management for the ninth consecutive time! We believe this consecutive recognition highlights our dedication to providing a comprehensive and innovative API management platform. Apigee empowers businesses to lead in the cloud era by harnessing its increased capacity, security, and scalability, all increasingly powered by generative AI.

Your partner in digital transformation

In today's digital-first world, APIs are essential for businesses to thrive. That's why industry leaders like General Mills, Nationwide Insurance, PUMA, Freightos, Tieto and Veolia trust Apigee to manage their API ecosystems. We value their confidence in our ability to help them deliver better customer experiences, drive innovation, secure their infrastructure, and unlock new revenue opportunities.

aside_block: <ListValue: [StructValue([('title', 'Try Google Cloud for free'), ('body', <wagtail.rich_text.RichText object at 0x7f3ab9fe8a60>), ('btn_text', 'Get started for free'), ('href', 'https://console.cloud.google.com/freetrial?redirectPath=/welcome'), ('image', None)])]>

Navigating the API landscape with confidence

The API landscape is constantly evolving — generative AI offers an unprecedented opportunity for productivity, while increasing security demands add new layers of complexity. Apigee is designed to help you navigate these challenges with confidence. Apigee provides:

Comprehensive API lifecycle management: Streamline your entire API lifecycle from design and development to deployment and monitoring.
Robust security features: Protect your APIs and data with advanced security policies and threat protection.
Scalability and performance: Handle high volumes of API traffic with ease, ensuring optimal performance and reliability.
Gen AI-powered insights: Gain valuable insights into API usage and performance to optimize your API strategy.

Our commitment to continued innovation

Apigee is dedicated to providing the essential capabilities developers need to succeed. We're committed to investing in Apigee to ensure it remains a world-class service that meets the evolving needs of our customers. This recognition from Gartner, in our opinion, reinforces our commitment to continuous innovation and the delivery of an exceptional developer experience.

This year, we've focused on key areas such as:

Gen AI integration: We’re empowering developers to leverage the power of gen AI to build, secure, and manage all their APIs with ease using the power of Gemini Code Assist to generate new APIs from a combination of prompts and your own enterprise context. LLM-enabled search simplifies API discovery and understanding interconnections.
Enhanced security and compliance: We've strengthened our platform with robust measures to combat threats and meet changing requirements. Developers can gain more control with the ability to flag or automatically block malicious consumers. Enhanced data-residency capabilities further support compliant workloads worldwide.
Improved developer experience: Developers can accelerate API development with intuitive tools and workflows such as VS Code leveraging Gemini Code Assist.
Accelerated API delivery: Quickly generate new APIs from existing specs, and easily create mock backends that can be run locally or deployed to Cloud Run for rapid prototyping.

Thank you to our customers and Partners

We're incredibly grateful to our thriving community of customers, developers, and partners for their continued support and trust in Apigee. Your feedback and collaboration are invaluable in driving our product roadmap and helping us deliver reliable API management experience.

Download the report

Download the full report here (requires an email address) or learn more.

^{Gartner, Magic Quadrant for API Management, Shameen Pillai, John Santoro, Nicholas Carter, Andrew Humphreys, Mark O'Neill, 16 October 2024.}^{Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.}^{This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Google.}^{GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved.}

From gRPC to RESTful APIs: Expose your gRPC services to the REST of the world

Wed, 14 Aug 2024 16:00:00 +0000

When designing a modern microservice architecture, performance is obviously key. Even outside of high-frequency trading and near-real time systems, extra milliseconds in inter-service communication matter a lot for the overall user experience. In this environment, gRPC has emerged as a high-performance communication protocol and is widely adopted for its low latency, efficient serialization and strongly typed messages.

On the other hand we need to acknowledge that most of the inter-service communications across system boundaries still heavily rely on HTTP APIs. That’s because the APIs largely serve as a contract between decoupled entities in the form of API producers and consumers, and changing them to gRPC would introduce a lot of friction. Additionally, not all developers are equipped or experienced enough to consume gRPC services. API providers would therefore risk missing out on a potential audience by limiting themselves to exposing gRPC services only.

In this blog we demonstrate how to easily bridge the gap between the highly-performant gRPC services and the widely adopted ecosystem of RESTful HTTP APIs. We propose a solution that leverages an automatically generated gRPC gateway that can be deployed alongside the existing gRPC service to handle the protocol translation that will provide an HTTP interface. Finally, we introduce Apigee as the enterprise API management platform to expose a clean RESTful API facade in a secure and self-service manner.

gRPC-to-HTTP gateway

Let’s assume that over the course of its operation, a fictitious company operating an e-commerce site realized that some of the components could provide value on their own and be included in their strategic API economy efforts. Our example is based on a sample microservices architecture that is composed of a range of sub-components written in different programming languages. The first service that they want to explore onboarding on to their API platform is the currency service. It provides two gRPC methods that lets clients list the supported currencies and perform a currency conversion from one currency to another.

As mentioned in the introduction, gRPC services are a popular choice for internal or so called "east-west" service-to-service communications. While gRPC exhibits superior performance characteristics, a significant number of APIs currently utilize HTTP as their primary communication protocol. Migrating these APIs to gRPC would require a substantial investment of resources, particularly considering that not all developers are familiar with the gRPC framework.

To overcome this challenge, we want to provide an adapter layer that provides a more traditional JSON HTTP-based API for the service. Instead of manually writing the protocol translation ourselves, we decided to use the open-source gRPC gateway project to automatically generate an adapter for our use case. The gateway is based off of a .proto file that specifies the services and messages. It serves as the single source of truth — or contract — between the service producer and consumers. To simplify generating the gateway, we created a convenience wrapper that allows us to generate the gateway by providing it a reference to the .proto file.

code_block: <ListValue: [StructValue([('code', './generate-gateway.sh --proto-path ./examples/currency.proto'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3ab9f3fb20>)])]>

The above command parses the supplied .proto file and generates the go module for translating an incoming HTTP REST request to gRPC and sending it to the specified endpoint. Finally, it wraps the gateway in a go module that can be deployed independently.

For the final architecture we’ll want to build a container image and deploy to a target runtime such as Cloud Run. To understand how the gateway works we can also run it locally:

code_block: <ListValue: [StructValue([('code', '(cd generated/gateway && docker build . -t gateway:latest)\r\ndocker run -p 8080:8080 -e GRPC_SERVER_ENDPOINT=localhost:9090 gateway:latest'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3ab45cf3a0>)])]>

The GRPC_SERVER_ENDPOINT environment variable here points to the gRPC endpoint that the gateway should send traffic to. In this case, we've already got the gRPC currency service running locally on port 9090. With the gateway started up, you can now send a regular JSON HTTP request to the gateway’s endpoint:

code_block: <ListValue: [StructValue([('code', 'curl -X POST localhost:8080/hipstershop.CurrencyService/Convert -d \'{"from": {"units": 3, "currency_code": "USD", "nanos": 0}, "to_code": "CHF"}\''), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3ab45cfb80>)])]>

As we can see, we’ve made our gRPC currency service available as a JSON HTTP API that can be easier to use within a wider API ecosystem. However, there's still room for improvement when we consider how this new API aligns with the company's well-established API strategy:

The API doesn’t follow the widely accepted RESTful API design principles and still largely reflects the structure of the original .proto specification.
The API doesn't support API management features such as authentication, centralized logging and monitoring, error handling, or monetization.
Developers don’t have access to a self-service option that allows them to discover new APIs and onboard themselves as API consumers.

Lower entry barriers with API management

To achieve some of these capabilities and ultimately drive adoption of the API, we can leverage an API management layer in the form of an Apigee API Proxy facade. While Apigee can natively expose gRPC services in pass-through mode, here we operate on the previously converted protocol that allows us to apply a range of useful policies and configurations for:

Method, path and payload translations that allow us to provide a proper RESTful facade and abstracts the underlying message format of gRPC
Collection of metrics and rich analytics data to measure the operational performance and success of the API program
Consistent API security, error handling and traffic management controls to protect other systems and impose quotas on clients

To build on top of our gRPC gateway, we first need the API proxy to securely access our gRPC gateway, which could be deployed to Cloud Run where authentication can be enforced with Cloud IAM. With this security mechanism, our API proxy must be configured to use Google Cloud authentication itself, or forward on the credentials received from the API client.

Apigee's flexible and comprehensive approach to managing routes with an API proxy allows us to expose a RESTful path to API consumers and rewrite the path at runtime to what our gRPC gateway expects.

code_block: <ListValue: [StructValue([('code', 'curl -X POST "https://$APIGEE_HOSTNAME/currency/v1/convert" -d \'{"from": {"units": 3, "currency_code": "USD", "nanos": 0}, "to_code": "CHF"}\''), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3ab45cf0d0>)])]>

Proxying our currency service through an Apigee API proxy results in the automatic collection of API metrics and analytics data, providing us with rich insights into the health and success of our APIs. We can also build on our API proxy by attaching additional traffic management, security, mediation and even code extension policies.

To introduce and promote this API to a new audience, we can leverage Apigee's developer portal to publish an API product for developers to discover, explore and experiment with the API, opening up new opportunities. To build on this further, we can optionally monetize an API product to unlock additional revenue streams with a variety of different strategies, such as usage-based pricing or subscription plans.

Conclusion and next steps

In conclusion, we have demonstrated how gRPC services can be easily exposed to new audiences as HTTP APIs, while also leveraging the benefits of a comprehensive API management platform like Apigee. By combining the performance of gRPC with the familiarity and tooling of REST APIs, we can unlock new possibilities for our services and data, reaching a wider range of developers and applications. By embracing this hybrid approach, we can bridge the gap between gRPC and REST when building out an API ecosystem, so you can leverage the best of both worlds.

If you're interested, you can now put this to the test by carrying out the steps in the Apigee DevRel example.

Apigee and the Interoperability Model (ModI) for the Italian Public Administration

Fri, 09 Aug 2024 16:00:00 +0000

Apigee API Management allows the Italian Public Administration and its customers, suppliers, and system integrators to achieve full compliance with the new Interoperability Model (source New Interoperability Model - ModI) written and designed by Agency for Digital Italy (AgID).

Apigee as ModI platform enabler

One of the key aspects of the ModI is promoting the adoption of an API-first approach in order to help deliver maximum accessibility and interoperability across all the actors and services involved.

Apigee provides the right foundation for delivering ModI complaints interaction.

Below, we’ll describe how specific Apigee features help Public Administrations and other entities achieve compliance in the initiatives and programs that require Modl certification.

Hybrid and multi-cloud deployments
Each Public Administration organization has its own IT landscape. Some may have opted to host their digital services on-premises, while others prefer to host them on public cloud providers. Another might be on a digital innovation journey to migrate to one or more cloud hyperscalers or engaging in consolidation programs. Therefore, it’s important to select an API management platform that can support many different kinds of deployment models.

Apigee enables Public Administrations to achieve the architectural freedom to deploy their APIs anywhere — whether in their own data center or on the public cloud of their choice. For example, a public administration can choose to host and manage Apigee in containerized runtime services in its own Kubernetes cluster or choose a Google-managed option and have Apigee available on Google Cloud.

Learn more about the Apigee supported deployment platforms and operating models.

Traffic management and control policies
The ModI guidelines prescribe how interactions between public administrations and the use of their digital services should take place.

Apigee uses policies on API proxies to program API behavior without writing any code, allowing organizations to add common functionality, such as security controls, rate limiting, transformation, and mediation. Public Administrations can select from a robust set of more than 50 policies (pictured below) to drive and control the behavior, traffic, security, and quality of service (QoS) properties of every API. Apigee even supports custom scripts and code, such as JavaScript applications, to extend API functionality.

Apigee provides a robust set of 50+ policies to help meet ModI guidelines.

Monitoring and logging
Monitoring and logging also plays a vital role in the design and development of APIs. With this in mind, it’s critical for public administrations to select an API management platform that provides these capabilities for their digital services.

With Apigee, Public Administrations can leverage built-in and custom API analytics dashboards to investigate spikes, improve performance, and identify improvement opportunities by analyzing critical information from their API traffic. In addition, Apigee can debug API proxy flows, making it possible to investigate every detail of API transactions within the console or in any distributed tracing solution. Public Administrations can also isolate problem areas quickly by monitoring API performance or latency, identifying anomalous traffic patterns and receiving notifications about unpredictable behaviors.

Automated API Security with ML-based abuse detection
More and more frequently, governments and public services are being targeted in cybersecurity attacks. Government agencies and Public Administrations should take all the necessary precautions to minimize or eliminate API security risks.

Apigee provides Advanced API Security, an add-on capability to protect APIs from misconfigurations, malicious bot attacks, and critical abuses. Advanced API Security assesses managed APIs regularly, surfaces API proxies that do not meet ModI’s security standards, and provides recommended actions when issues are detected. ML-powered dashboards accurately identify critical API abuses by finding patterns within large amounts of bot alerts and acting promptly on important incidents.

Using Apigee, public administrations can easily define ModI’s complaint profiles, which can then be used to assess the degree of adherence of their digital services with respect to the guidelines.

Now let’s investigate in more detail how Public Administrations can leverage Apigee for their ModI compliance initiatives.

How to implement ModI guidelines and patterns within Apigee

As you have seen so far, the ModI guidelines collect a set of requirements that Public Administrations must comply with when exposing and/or consuming digital services via APIs.

These recommendations address several aspects, including identification of needs, organization, semantics, techniques, security, processes for ensuring National Digital Data Platform (PDND) interoperability, and more. In addition, the regulator of these guidelines also defines the level of applicability for requirements, indicating whether they are obligatory or optional.

While not all requirements relate to API management, leveraging Apigee can enable Public Administrations to adhere to certain guidelines. In particular, Apigee provides all the building blocks that can be used and assembled together to satisfy the ModI requirements for techniques and security.

For example, with Apigee, Public Administrations can expose digital services with both REST and SOAP protocols. In addition to the service exposition, Apigee can also be used to invoke downstream digital services exposed by other entities (both in REST and SOAP).

In order to validate the payload, this can be achieved with the out-of-the-box policies provided by Apigee, such as the OpenAPI Specification Validation policy and the SOAP Message Validation policy:

Plus, Public Administrations can also configure TLS and/or mTLS as transport protocols for these interactions, as recommended by ModI.

For addressing the security at the application level based on the ModI requirements, Apigee provides the following out of the box policies:

Apigee out-of-the-box security policies relevant to ModI guidelines.

Apigee also provides out of the box policies for inspecting the voucher that will be used in order to access these digital services and apply the right action based on the information contained in the voucher, such as:

We already mentioned that Apigee can also be used to invoke digital services exposed by other PAs and in case of need Apigee will also be able to orchestrate more than one downstream digital service. Additional out of the box policies like the following help with this:

It is important to note that out-of-the-box policies will need to be “assembled” together to expose and consume digital services in compliance with the ModI guidelines. To do this, Public Administrations can create a pre-configured set of policy flows for addressing different ModI requirements.

These pre-configured flows can be combined into a shared flow in Apigee and re-used by developers when they need to expose or consume digital services. These shared flows can be called from API proxies or other shared flows using the FlowCallout policy.

Public Administrations will need to have a central team that can configure shared flows and make them available to everyone.

Public Administrations can call shared flows in Apigee.

Once these specific shared flows are made available in Apigee, they can be included in the logic defined for exposing/invoking specific digital services.

Accenture accelerator for ModI

Apigee has partners like Accenture that are already working on these specific ModI compliance flows.

Accenture recognizes the significance of this solution and has developed ModI compliance flows within its innovation centers, in particular at the Accenture Cloud Innovation Center (ACIC) in Rome, to cover all the ModI requirements and guidelines. The Cloud Innovation Center is specifically focused on cloud solutions tailored to address customer’s unique business needs.

Positioned strategically, the ACIC not only provides industry knowledge, agility, and technical expertise for cloud-driven business transformations but also houses the specialized Center of Excellence dedicated to the Sovereign Cloud, ensuring strict adherence to regulatory requirements specific to the public sector. This creates an ideal environment to cultivate understanding and expertise in Apigee technology while addressing customer needs in compliance with government regulations.

The following section will delve deeper into Accenture's initiatives in using Apigee to enable ModI compliance flows.

The aim of the Accenture accelerator is to provide an out-of-the-box solution that enables customers to make their Apigee environment ModI compliant.

The accelerator is following the below process.

Analysis of official documentations
Gathering of ModI requirements
Categorization of ModI requirements

The outcome of the analysis produced a set of requirements needed for ModI compliance with impacts at the API management level, which were categorized as follows:

Natively supported: meaning they are natively satisfied by Apigee's out-of-the-box capabilities
Custom: meaning they will be satisfied through the development of reusable shared flows.
Procedural: meaning they will have to be applied at development time of individual e-service and are in charge of the api developers. They will be collected in a "Developer Handbook".

The breakdown of requirements in the categories is given below.

The Accenture accelerator will be made available via the Google Marketplace so that it can be easily adopted by interested customers. It will be published as a ready-to-use package that can be easily integrated into the target Apigee organization. At this point, the customer will have the opportunity to choose, for each API Proxy, which ModI requirements to apply, selecting the associated shared flow.

The following is an example of how to apply a ModI requirement using the Apigee Google Cloud console. The same approach can also be applied in GitOps mode.

Create an API proxy.

2. Enter API information

3. Deploy the API proxy.

4. Edit the API proxy.

5. Select a shared flow to apply a ModI requirement.

6. Update the API proxy.

Conclusion

Apigee API Management and Google Cloud partners are very well positioned to address the digitalization of the Italian Public Administration. Thanks to the large investments and open tenders at every level of the Italian Public Administration that the government has published, this opportunity should be seized quickly to help citizens and companies facilitate the movement of goods, people, services, and data throughout Italy and the European Union.

For further information you can get in contact with your Apigee representative.

Faster API development with the Cloud Code plugin for API management

Wed, 10 Jul 2024 16:00:00 +0000

Developers are at the heart of API delivery, and they need tools that make the process faster and easier. Apigee is a powerful API management platform that helps enterprises build, manage, monetize and scale APIs with tools that help developers simplify and speed up API development.

Apigee is accessible in the Google Cloud console, as well as via most commonly used IDEs via the Cloud Clode plug-in. With the Cloud Code plugin in VSCode, developers can create workspaces, build proxies, and even leverage Gemini Code Assist to streamline API delivery. To better understand the plug-in let’s first take a closer look at a workspace.

Workspace for organization

A workspace in Apigee is a collection of folders that is automatically created to help you develop APIs. Workspaces save time by providing you with a structured starting point to leverage all the tools you need for API development in one location. A workspace consists of:

API proxy: Proxies consist of a proxy endpoint (your API URL) and a target endpoint (connection point to your backend service). A proxy decouples your API from your backend. Additionally, you can enhance your proxy by extending functionality and management capabilities using policies which can be attached at different points as messages flow through your proxy.
Shared flow: A shared flow allows you to reuse common functionality like policies and resources across multiple APIs within an organization.
Environments: An environment is a dedicated space for creating, testing and deploying API proxies.
Test data: Test data allows you to bundle together a set of common resources that a developer might see in a production environment. Things like API products, developer accounts, test developer applications and values that your API would need to function.
Emulators: Emulators allow you to verify the functionality through unit and manual testing using a docker image (local runtime).

Gemini Code Assist for API management (Preview)

Gemini Code Assist unlocks the power of generative AI to help you build great software. Create an Open API specification from requirements that you describe in natural language within seconds, all from within the Cloud Code plugin. With tight integration with API Hub, you can register these specifications right from the plugin.

Harnessing the power of Gemini Code Assist starts with a prompt. A prompt allows you to describe your API specification in natural language. Gemini Code Assist offers contextual AI assistance because it understands objects in your organization's API hub, which it uses to generate a tailored specification response in seconds based on your business requirements. It does this by reusing objects, metadata and security schemas from specifications that are already registered in your organization's API hub, promoting consistency across all of your APIs.

Let’s say you want to create an API for placing new orders. In your prompt you may write, “Create an API for placing new orders.” Gemini then takes a look at all the APIs registered in API Hub and uses those business requirements to generate a draft. In the specification, Gemini pulls objects and schemas from the APIs in your registry to match the business requirements of other APIs. You can then refine the prompt until you get my desired specification using the editor. Additionally you can even see your prompt history all from the same screen.

Mock servers for increased velocity

Testing is a vital part of the API development process. The Cloud Code Plugin allows you to not only develop APIs but also test them locally or with others. Whenever an API specification is generated, a local mock server is also created alongside the specification. You can interact with your API from within the same UI you created your specification. Additionally you can modify parameters and insert mock values to simulate common scenarios and use cases. These auto generated mock servers allow for faster functionality verification of your API proxies.

In addition, you can easily deploy such a mock server to your Google Cloud project with a simple workflow. When you deploy your mock server to the cloud, you can share it with others on your team, speeding up the process of collecting feedback. For example, you as a service developer may share a mock service with your front-end counterparts who can try out the service before you write a single line of code implementing the API.

Get started

Ready to build and deploy an API with the Cloud Code plugin? Click here to get started. With Gemini Code Assist for API management you can reimagine API development.

How Altice Labs enhanced API management with Google's Application Integration

Thu, 20 Jun 2024 16:00:00 +0000

Editor’s note: Today we hear from Altice Labs, which leads research and development for telecom & business markets within Altice Group. The team builds cutting-edge telecommunications solutions that help Altice Group’s operating companies connect with over 500 million people worldwide — across video, broadband, mobile, and enterprise services.

While the existing IT infrastructure in our operating companies is robust, it’s also complex, comprising a growing number of legacy components and intricate workflows managed by an enterprise service bus (ESB). This complexity hinders our ability to rapidly launch new offerings and features. To overcome these challenges, we

Built APIs to streamline communication with fragmented systems
Ensured precise control and protection for these APIs using Apigee API Management
Orchestrated complex integration flows, data mappings, and error handling using Application Integration

The introduction of Application Integration, in particular, has really helped us manage complexity. Application Integration is Google Cloud’s Integration Platform as a Service (iPaaS) that automates business processes by connecting any application — both home-grown and third-party SaaS — with point-and-click simplicity. Its intuitive interface lets you build complex flows, map data, and streamline operations with pre-built tasks and triggers.

We became early adopters of Application Integration, applying it in scenarios where orchestration, asynchronous processing, error handling, and state management are crucial.

One common process at our operating companies, for instance, is creating a billing account, which involves multiple backend systems. With Application Integration, the consumer (the internal application or component) interacts with a single API. Application Integration handles the orchestration and error management, ensuring data consistency — even across different systems — without exposing the API consumer to the underlying complexity. This avoids the need for manual cleanup, which would not be scalable for us.

A deeper dive into our integration strategy

Today, we continue to use Apigee to manage API traffic and security policies. But for complex integrations, we use Application Integration. This new architecture manages APIs for systems including CRM, identity management, shopping carts, and modules, supporting the customer journey, billing, and usage charging. It also involves components for operations and support, such as business support systems (BSS), operational support systems (OSS), service quality, and call centers.

Application Integration is really helpful in scenarios that require asynchronous processing. For instance, if an API consumer initiates a process that takes significant time, it won't have to wait for the process to complete; Application Integration allows the process to run in the background (asynchronously) and sends a callback when it's done.

There are also cases where the producers send synchronous responses, but the consumer awaits an asynchronous response. Application Integration maintains the state of the process while handling both synchronous and asynchronous responses.

Making an impact at Altice Group

The new IT architecture at Altice Labs allows for the agile creation, pricing, and management of various services run by Altice Group’s operating companies. The platform supports the entire customer journey, from discovering and subscribing to a service, through usage, support, and eventually, service termination or migration. This end-to-end management is crucial for maintaining service quality and customer satisfaction.

Initial phases of this project took place in Portugal, and we're planning several phases in other countries as well. When complete, operating company business teams worldwide will be able to define and introduce new offerings to customers more efficiently and with less effort.

Learn more about Application Integration.

Enhance the security of your DialogFlow CX chatbots with Apigee

Tue, 18 Jun 2024 16:00:00 +0000

Organizations that want to create a chatbot often turn to Dialogflow, Google Cloud’s service for creating conversational agents that can understand and respond to natural language. Available in two editions, many organizations choose Dialogflow CX for its advanced chatbot capabilities. However, integrating a chatbot with your website in the absence of a middleware solution may risk directly injecting sensitive credentials like service account keys into the frontend, or opting for unauthenticated URLs. This is not a best practice for production-grade systems and can result in exposing your agent and Google project ID, leaving them vulnerable.

You can mitigate this by introducing an Apigee layer between your frontend and DialogFlow CX APIs. Apigee is a full lifecycle API management platform offered by Google Cloud that enables businesses to design, secure, publish, analyze, monitor, and monetize their APIs. Apigee acts as a robust layer between backend services and clients that access them, providing a multitude of features and benefits. In this context, Apigee provides:

Centralized authentication and authorization: Apigee acts as a secure gateway, handling all authentication and authorization processes. This eliminates the need to expose credentials on the frontend.
Controlled access: Apigee allows you to define fine-grained access policies, determining which frontend components can interact with specific DialogFlow CX APIs.
API key management: Apigee helps manage API keys, simplifying the process of rotation and revocation if a compromise occurs.
Threat protection: Apigee offers built-in features like rate limiting, quota management, and spike arrest, safeguarding your APIs from abuse and potential attacks.

By using Apigee as an intermediary, you not only enhance the security of your chatbot integration but also gain a powerful tool for managing and monitoring your APIs. In this post we’ll walk you through how to configure Apigee to improve security for conversational agents.

Creating and configuring the Apigee Proxy for conversational agents

First create an instance of Apigee or reuse your existing Apigee instance on Google Cloud. Click here to set up an evaluation trail instance.
Create a DialogFlow CX Agent using this guide.
From the console, extract the Agent ID and location from the console and keep it handy.

4. Create a service account and grant “DialogFlow API Client” role.

5. Go to apigee.google.cloud and click on ‘Create a Proxy’ of type ‘Reverse Proxy’, give it a name, e.g., ’myproxy’.

6. Configure the target endpoint as the DialogFlow CX Detect Intent API, replace the project id, agent id and location appropriately.

code_block: <ListValue: [StructValue([('code', 'https://<location>-dialogflow.googleapis.com/v3/projects/<project-id>/locations/<location>/agents/<agent-id>/sessions/abc:detectIntent'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3aba25a5e0>)])]>

7. In the Proxy Develop tab, add <GoogleAccessToken> and <Scopes> in the HTTP target connection as shown below.

8. Deploy the proxy on the available environment. In this step, it's important to use the Service Account which you created earlier. This Service Account will be used to authenticate requests to the DialogFlow CX API.

9. Test your proxy through any API Client. You should see a response from the DialogFlow CX Intent API.

Whoa! Your proxy should be working and interacting with the DialogFlow CX.

You can verify on the Apigee debug console to trace the full path of the request.

Next steps

Now that you have your first proxy working, you are ready to take the next steps. You can:

Configure the Apigee Oauth policy to add authentication of the users invoking the proxy from the frontend
Add the Spike Arrest and Quota policy as per requirements

You can use this Apigee Proxy URL to embed in your website or chatbot frontend. With Apigee proxies, you now explore the power of effective API management, user access control, quota management, as well as monitoring and monetizing your APIs.

CSPs reach further and monetize smarter with network API digital marketplace syndication

Tue, 18 Jun 2024 06:00:00 +0000

The Telecommunications industry is undergoing a major transformation, driven by the rise of digitization and the need for more agile and efficient ways to deliver services. One of the key trends in this transformation is the emergence of network APIs to incubate innovation and drive new revenues through ecosystems.

Building APIs is one thing. Getting them to the developers and customers is another challenge entirely.

Given that application developers use different platforms and marketplaces, at Google Cloud we propose a marketplace syndication approach to reach and target the developers where they are. In this approach, network APIs for communication service providers (CSPs) are onboarded to an aggregator platform, provided by a third-party, and then syndicated to different marketplaces to provide the furthest reach and adoption of the APIs.

Google Cloud is working with leading API aggregator platform vendors including Ericsson, Glide, and Nokia in this syndication effort. We expect that over time we will see the emergence of aggregators who specialize in specific use cases, with global or regional coverage, innovative business models, and more. An approach that allows for multiple aggregators to connect to the developer marketplace will be ideal to provide the reach the developers need for their specific applications and customer business objectives.

Now is an important moment for CSPs to take a closer look at API creation and distribution, thanks to last year’s launch of the GSMA Open Gateway initiative and the associated CAMARA project.

Open Gateway is a framework of APIs designed to provide universal access to operator networks, with support from leading mobile network operators (MNOs), representing around 60% of mobile connections worldwide. This has led to the CAMARA project, a collaboration between the Linux Foundation and the GSMA Operator Platform Group to define a common Open Gateway API standard. The standard aims to accelerate developer communities with a consistent API design and consumption approach across the operator landscape globally.

The GSMA and other key industry initiatives are helping expose network APIs and create a more open and interoperable communications ecosystem, which is essential for the continued growth and innovation in the industry. With this growing interoperability comes growing opportunities — but only if your audience can find your APIs.

A digital API marketplace

A digital API marketplace can enable operators to package the CAMARA and other value-add APIs and API bundles, such as for subscriber identification and authorization, network slices, as sellable products, provide lifecycle management, and full digital, self-service order-to-cash functionalities. In particular, an API marketplace can provide the following benefits:

Catalog: A catalog of network APIs that can be serviced or served by a collection of operators.
Discovery: The ability to promote APIs on the Marketplace and applications that use the APIs to developers and end consumers respectively
Billing: A single billing of the API usage that should be included in the developer’s bill, along with any other services the developer may be using from the broader marketplace

Here is a look at how Google and our partners at Ericsson, Glide and Nokia are approaching a syndicated API marketplace:

Marketplace syndication unlocks new potential for the developer community to discover, procure, and consume API products into business applications, which uplifts the brand and revenue opportunity for CSPs. Among the opportunities are:

Wider reach, and amplified sales: Expanded footprint across multiple platforms, instantly multiplying audience and potential buyers.
Simplified management: The ability to maintain a single product catalog and pricing structure, eliminating the challenges of managing multiple marketplaces individually.
Streamlined data: Access to consolidated sales and customer insights, providing valuable data for informed marketing and product decisions.
Enhanced brand consistency: Delivery of a seamless brand experience across all platforms, boosting trust and customer loyalty.
Reduced operational costs: Eliminating the need for multiple platform fees and staff, freeing up resources for strategic initiatives.
Greater flexibility: The ability to adapt offerings to specific platforms and audiences, tailoring approach for maximum impact.

Our partners are enthusiastic about the opportunities offered by API syndication.

Eran Haggiag, CEO, Glide: “OpenGateway provides a unique opportunity in delivering AI-era identity, payment, and communication solutions. To unlock this potential, global alignment, startup agility, and reliable infrastructure are essential. We co-develop a Google-branded OpenGateway experience with major CSPs, available for the developer ecosystem. Glide leverages Google Cloud Marketplace with AI-enhanced automation to provide a seamless experience for developers across the ecosystem, rapidly growing global coverage. Google Cloud enables us to create an aligned, win-win ecosystem of developers and CSPs.”

Mikko Jarva, head of portfolio and architecture, Network Monetization Platform, Nokia: “Applications we use are critically dependent on networks; with rising digitization, the dependency for network awareness and specialization, delivered through network APIs, just keeps growing. Hence, we strongly support initiatives and collaborations to enable and expand the network API ecosystem, connecting networks through aggregator platforms like Nokia Network as Code and through marketplaces like Google Cloud with application developers.”

Joakim Sorelius, head of Global Network Platform, Product, and Engineering, Ericsson. “Ericsson and Vonage are leading the development of a global network platform by opening the network for Google Cloud developers and other third-party developers to make capabilities universally available for further innovation. With developers thriving on a well-built and supported API platform, enterprises can grow from new, unique, and customizable API innovations; at the same time, communication service providers benefit from network monetization and growth opportunities. We are committed to making CAMARA successful and aim to be a driver of the future evolution of CAMARA.”

Conclusion

The Open Gateway and other key industry API initiatives are poised to unlock key telecom industry transformations, with a digital API marketplace being a key enabler of this journey. At Google Cloud, we propose a marketplace API aggregation and syndication approach to expand the reach of the network APIs. However, marketplace syndication is not just about selling more - it's about selling smarter, building stronger relationships with your customers, application developers, and capturing your market.

For more details on our work with these partners, please visit

Glide, ClearX’s API spinoff, which powers a implementation recently launched on Google cloud marketplace with Telefonica, Orange, and Enstream
Nokia and Google Cloud are collaborating to bring advanced network capabilities to application developers. Learn more about Nokia Network as Code platform.
Ericsson offers a range of Network APIs built in-house and together with partners.

Unlocking API performance insights with Apigee custom reports

Fri, 14 Jun 2024 16:00:00 +0000

Monitoring API performance is crucial for user experience, business protection, and proactive issue resolution. To understand API performance, you need to understand key metrics like response time, throughput, error rate, latency, and availability. Poor performance can lead to user frustration, lost business, and damage to a company's reputation, making optimization of these metrics essential.

The custom reports feature of Apigee API Management offers a powerful way to slice and dice your API analytics data, giving you highly tailored insights into your API program. These reports are beneficial for all API stakeholders — business, platform, and development teams — empowering them to make data-driven decisions to enhance API performance monitoring. By focusing on API metrics like request endpoints, response codes, or error types, Apigee’s custom reports can pinpoint bottlenecks and anomalies, leading to quicker issue resolution. The ability to aggregate data over custom time periods further facilitates trend analysis, capacity planning and correlation of performance with specific events, enhancing overall monitoring strategies.

As part of this blog, we’ll explore key custom reports to troubleshoot production deployments, optimize performance, and enhance your overall API strategy. The primary audience are platform, operation or development teams who monitor the platform on a regular basis. These custom reports serve as a foundation that you can adapt and expand for various troubleshooting scenarios.

Understanding Apigee Custom Reports

Apigee offers up to 14 months of API analytics data retention (depending on the Subscription Entitlements), providing valuable historical insights. Out-of-the-box API monitoring dashboards and custom reports complement each other as critical components of the Apigee API monitoring journey. While the pre-built dashboards offer useful insights at the environment and API proxy levels, custom reports provide greater depth and flexibility.

With custom reports, retrieve data parameters specific to an API traffic and relevant to specific teams or purposes. Apply filters using a variety of dimensions and aggregate the filtered data (sum, average, etc.) for meaningful interpretations. For example, an operations team might want to identify which request URI within a specific API proxy and target host is receiving the most traffic. Additionally, you can incorporate custom API data points from collector resources for an even deeper and more tailored analysis.

There is a wide range of flexibility when creating custom reports, experimenting with different dimensions and metrics. For example, Target host is a recommended dimension in all reports than Target IP¹ as it makes analysis much easier. Hosts or FQDNs are simpler to remember than IP addresses, and these allow custom reports to capture traffic paths separately when multiple destinations are reached from a single target IP. Other useful dimensions as highlighted in reports are proxy base path, request URI, user agent, client IP, api product, developer app, geographical location etc.

Key custom reports

Report Name	Dimensions	Metrics
Latency Analysis	Proxy Base Path Target Host Request URI Client IP	avg(target response time) avg(total response time)
Response Code analysis	Proxy Base Path Target Host Request URI Target Response Code	sum(traffic)
API Product Performance Analysis	API Product Developer App Target Host Response Status Code Client IP Address	sum(traffic) avg(total response time)
Cache Analysis	Proxy Base Path Target Host Request URI	sum(cache_hit) sum(traffic)
User Agent Analysis	Proxy Base Path Target Host User Agent/User Agent Family/User Agent Type Response Code	sum(traffic)
API Location Analysis	Proxy Base Path Target Host Geographic Region	sum(traffic) avg(total response time)

These are discussed in detail in the following sections.

1. Latency analysis

Latency analysis helps identify bottlenecks and delays in systems or networks. It is useful in optimizing performance and improving the overall user experience.

In Apigee, having multiple target backends for a single proxy makes troubleshooting latency issues difficult. Custom reports help to derive latencies according to specific target endpoints with dimensions such as Target Host, Request URI and Client IP. This allows you to quickly identify the specific backends or specific request URIs causing the high latency and simplifying the debugging process. Client IP address as a dimension helps pinpoint the source of slowness for specific application users and aids in troubleshooting whether the issue lies within their local network, ISP, or on the route to the API server.

To create a report for latency analysis for target endpoints, follow these steps:

Select the metrics as avg(total response time) and avg(target response time)
Select the dimensions as Proxy Base Path, Target Host, Request URI and Client IP
Apply Filter to reduce the number of entries
Run the custom report for the time duration

Here are the screenshots of a sample custom report:

To further refine the analysis, Target Host and Request URI are selected. Target Hosts allows for filtering Target Endpoints within an API Proxy causing high latencies. With the Request URI filter, you troubleshoot issues related to individual API requests having high latency. Specific request URIs handling large payloads or complex operations might signal high latency and need to be troubleshooted further. The screenshot below shows a sample report with Request URI as the third dimension:

Client IP is added as a dimension to troubleshoot client specific issues. The screenshot below shows a sample report with Client IP as the fourth dimension:

2. Response code analysis

Response code analysis is important because it provides a rapid overview of API health and user experience. Response codes (e.g. 200 OK, 404 Not Found, 500 Internal Server Error) immediately signal success or failure. Analyzing response codes enables proactive fixes and optimizations, ultimately improving the reliability of your APIs.

This reports filters using dimensions such as Target Hosts, Request URI and Target Response Code. It reveals error trends, pinpoints issues within backend systems, and highlights requests where errors are frequent.

To create a response code analysis report, follow these steps:

Select the metrics as sum(traffic)
Select the dimensions as Proxy Base Path, Target Host, Request URI and Target Response Code
Apply Filter to reduce the number of entries
Run the custom report for the specified time

Here are the screenshots of a sample custom report:

The below screenshot shows a sample report with Request URI as another dimension:

3. API product performance analysis

The report provides detailed and actionable insights for API product performance for each developer app/client IP and provides the following features.

Fine-grained troubleshooting for developer applications: The combination of dimensions like API Product, Developer App, Request URI, and Response Status Code pinpoints exactly where and under what conditions errors are occurring. This eliminates broad guesswork in problem resolution for specific API customers.
Client-focused insights: Developers or clients are the primary stakeholders consuming API products. The "Client IP Address" dimension helps isolate errors related to individual clients, highlighting potential network issues or misconfigurations on the consumer end.
Performance and error correlation for API product users: By including "avg(total response time)" alongside error metrics, you explore whether slow responses contribute to errors or if errors are impacting overall API performance.

To create a Response Code Analysis report for app developers, follow these steps:

Select the metrics as sum(traffic), and avg(total response time)
Select the dimensions as Developer App, API Product, Proxy Base Path, Target Host, Response Status Code, Client IP Address
Apply Filter to reduce the number of entries
Run the custom report for the specified time

Here are the screenshots of a sample custom report:

4. Cache-hit analysis

Cache-hit analysis is required to understand how well your caching system at Apigee is performing and helps in improving API speed for a better user experience. It gives the cache-hit value for Apigee cache which is an important parameter when evaluating caching systems. Using the custom reports, you have a granular view of Apigee cache performance with dimensions such as Request URI and metrics as Cache Hit and Total Traffic.

To create a Cache Hit Analysis report, follow these steps:

Select the metrics as sum(cache hit) and sum(traffic)
Select the dimensions as Proxy Base Path and Request URI
Apply Filter to reduce the number of entries
Run the custom report for the specified time

Here are the screenshots of a sample custom report:

To view the cache performance for a particular Request URI within an API proxy, select the Request URI dimension for the dropdown and generate the custom report.

5. User agent analysis

User agent analysis in Apigee is essential because it reveals the devices, browsers, and operating systems your API consumers are using. This information helps pinpoint device- or browser-specific compatibility issues, aids in debugging errors by providing detailed logs, allows for tailored API responses to improve user experience, and assists in identifying malicious bots or unusual activity for security purposes.

To create a User Agent Analysis report, follow these steps:

Select the metrics as sum(traffic)
Select the dimensions as Proxy Base Path, Target Host and User Agent/User Agent Family/User Agent Type and Response Code
Apply Filter to reduce the number of entries
Run the custom report for the specified time

Here are the screenshots of a sample custom report:

6. API-location analysis

API-location analysis per request URI is required to understand the geographical origin of the traffic hitting specific endpoints of your API. It helps identify errors specific to certain regions (potentially caused by network issues or regional disruptions), isolate performance problems related to distance, ensure your API delivers the right localized content, and even contribute to fraud detection by flagging unusual location patterns. This analysis also has advantages for performance optimization (like content delivery and resource placement), adherence to data privacy regulations, localized troubleshooting, proactive capacity planning, and making informed marketing decisions based on regional API usage patterns.

To create a Cache Hit Analysis report, follow these steps:

Select the metrics as sum(traffic) and avg(total response time)
Select the dimensions as Proxy Base Path, Target Host and Geographical Region
Apply Filter to reduce the number of entries
Run the custom report for the specified time

Here are the screenshots of a sample custom report:

Accessing custom reports

Report Retrieval Method from Google Cloud Console:

1. Navigate to custom report feature in UI

With your saved report, retrieve custom data
Select the environment and time period, and view the selected metrics grouped by your chosen dimensions.

2. (For Shorter Duration) Download the report from UI in real time

1. Click on ‘Export’ to download the report in csv format
2. (Optional) Open the csv file in your spreadsheet software

3. (For Longer Duration) Asynchronously generate the report using report job

1. Click on Submit Job
2. Select the environment and time period, and view the selected metrics grouped by your chosen dimensions and click on Create.
3. Click on Report Jobs to download the report once Job is completed
4. Open the CSV in your spreadsheet software

Please refer to the documentation for selection criteria for real time vs report jobs.

Here is screenshot of a sample downloaded report that was imported to Google Sheets:

Alternatively, use Apigee management APIs to create and access custom reports.

Quick recap on report creation from UI

Follow the steps below to create a new custom report:

Visit https://apigee.google.com/organizations/<project-name>/analytics/custom-reports. Click on ‘+Custom Report’.
Enter the report name and report description under the respective fields.
Select the desired metrics to be recorded. Select the aggregate function to be performed over the metrics.
Select one or more dimensions in sequence starting from proxy to specific resources scoped within the proxy
Use filters to limit results to metrics that meet particular conditions. This is an optional step.
Once all the parameters are selected, save the report.

Track API performance with custom reports

Custom reports is a versatile feature within the Apigee platform, offering in-depth, flexible analytics to track API performance and cater to the needs of various stakeholders. To get started, use the custom report feature within Google Cloud console or use Apigee management APIs. Explore Looker Studio Integration for enhanced visualization and analysis capabilities.

Ready to learn more? Explore how the experts from Google Cloud Consulting can help you get the most out of your APIs with Apigee and discover how Google Cloud Consulting can help you learn, build, operate and succeed.

^{1. Although Target Server Analysis over IP addresses are available out-of-box, their utility may be limited in scenarios such as ASM deployments with Apigee where a single Target Server IP supports multiple microservices.}

Create ecommerce experiences with commercetools and Google Cloud Application Integration

Fri, 24 May 2024 16:00:00 +0000

The world of digital commerce is rapidly evolving. To stay competitive, businesses need the ability to integrate their commerce systems with a wide array of applications and services. Furthermore, customers expect targeted and personalized experiences. Google’s AI and data solutions create an opportunity to deliver a personalized experience for customers within your ecommerce solutions. This can be done by implementing AI powered search capabilities, product recommendation, AI chatbots, content creation with AI and more. As organizations start to implement these capabilities, being able to connect Google Cloud services to commercetools, a cloud-native, headless commerce platform, offers significant value.

Google Cloud’s Application Integration is an Integration-Platform-as-a-Service (iPaaS) solution, offering tools to streamline data connectivity and management across various applications and services. We recently launched the commercetools connector (currently in public preview) to empower users to accelerate the integration between their ecommerce platform and Google Cloud solutions as well as other platforms available in the library of 80+ connectors. By leveraging the commercetools connector to integrate commercetools data with Google Cloud services such as BigQuery and Vertex AI, users can unlock a wide range of analytics and machine learning capabilities within their ecommerce. For example, users can use commercetools data as a model's prompt in order to generate personalized insights or leverage the commercetools data fed into BigQuery to create and execute machine learning models with BigQuery ML.

In this blog we will explore different functionalities of the commercetools connector and some of the use cases where you can leverage it to improve your customer experience.

Connect your commercetools platform with Google Cloud

commercetools provides a composable commerce platform, giving 450+ companies the components required to run outstanding shopping experiences across digital and physical touchpoints. commercetools equips some of the world's largest businesses with tools to future-proof digital offerings, reduce risks and costs, and drive revenue growth.

The commercetools connector can unlock a new level of integration, bringing numerous benefits:

Simplified integrations: Establish connections between your commercetools platform and the rich ecosystem of connectors, tasks and services available on Google’s Application Integration. The pre-built connectors make it easier to integrate with Google first party services such as BigQuery, Vertex AI, Pub/Sub, Cloud Spanner etc. as well as third-party systems for which we have connectors. You can let Application Integration handle the integrations for you while using data mapping tasks to easily address data transformation needs.This translates to faster time-to-market and reduced development costs.
Enhanced data flow: Enable powerful data analysis and machine learning for your ecommerce using Google Cloud services like BigQuery and Vertex AI with the pre-built connectors and the vertex AI prediction task. Use the integration tasks to orchestrate and transform the data flows between these applications. You can use the integration flows you design to drive business insights, intelligent product recommendations, personalized promotions, and more.
Accelerated innovation: Reduce the technical overhead of building and maintaining custom integrations for your ecommerce platform. Using application Integration to build your integrations between commercetools and Google Cloud with the drag-and-drop interface frees up developer resources and lets you focus on creating innovative customer experiences.

The commercetools connector facilitates a number of use cases, such as:

1. commercetools data to BigQuery:
The commercetools connector helps organizations transfer real-time data from commercetools to BigQuery in order to leverage their customer data and unlock insights to improve customer experience and increase conversion rate.

The following example shows how you can push product data from commercetools to BigQuery. The integration is triggered by an API call, although we could use any of the available triggers, including a scheduler, a pub/sub message and more. Then, Application Integration fetches product data from commercetools and proceeds to an iterative processing loop. This loop will call a sub integration for every product that will collect and store all the products in BigQuery.

With the commercetools data in BigQuery you can make informed and data-driven decisions combining data from your ecommerce and other diverse data sources.

2. On-demand AI-driven Insights:
Power your ecommerce by generating on demand predictions with Vertex AI. You can use events to trigger a prediction and get a real-time answer from your Vertex AI model, whether this is generating a reply to a text prompt, generating a product recommendation or predicting the demand of a product.

In the example below we use a pub/sub message to trigger a Vertex AI prediction using the Vertex AI task in Application Integration. We extract the commercetools product data and use it as the prompt for a Vertex AI model to generate product descriptions for the ecommerce products. We could take this a step further by updating the product in commercetools with the AI generated product description.

An integration flow of this kind helps you to connect your ecommerce platform data to extract AI insights directly from Vertex AI.

3. Ecommerce personalization:
Users are now connected to many devices and reach several digital interaction points before making a decision. For example, buyers tend to search both on websites and search engines before buying. This means that delivering personalized experiences across different channels has become increasingly important. With commercetools we can achieve an omnichannel ecommerce strategy by keeping data consistent across channels. The commercetools connector helps you to take this strategy one step further by integrating commercetools with customer data platforms (CDPs) and recommendation engines on Google Cloud and creating a centralized hub of customer data to fuel consistent personalization across different channels.

By combining the power of these two leading platforms, businesses gain the tools to create exceptional customer experiences that drive growth and success. Get started now: Find commercetools available in the Google Cloud Marketplace, visit the commercertools and Google Partnership page, and read more about Application Integration and the commercetools connector.

Using Gemini Code Assist to build APIs, integrations, and automation flows

Wed, 10 Apr 2024 16:00:00 +0000

APIs and integrations between applications form the digital nervous system of modern architectures. APIs are the pathways that connect your intelligence (AI models and apps) to data sources spread across different environments and systems, and integrations drive intelligent actions across your SaaS workflows. However, building these APIs and integrations often requires specialized expertise, requiring a lot of time and resources to ensure consistent standards and quality.

We're excited to announce that you will be able to use Gemini Code Assist in Google Cloud’s Apigee API Management and Application Integration (in public preview). Gemini code assist simplifies the process of building enterprise grade APIs and integrations using natural language prompts that don't require special expertise.

Gemini Code Assist: AI-powered assistance, tailored for your enterprise

While off-the-shelf AI assistants can help with building APIs and integrations, the process is still time-intensive because every enterprise is unique, each with their own requirements, schemas, and data sources. Unless the AI assistant understands this context, users still need to manually address these items.

Gemini Code Assist understands enterprise context such as security schemas, API patterns, integrations, etc., and uses it to provide tailored recommendations for your use case. Furthermore, using Gemini Code Assist lets you iterate on your existing API or integration in development, instead of prompting from scratch. Lastly, Gemini’s proactive suggestions inspire new ideas.

Using Gemini Code Assist to build APIs

Apigee is Google Cloud’s turnkey API Management solution for building, managing, and securing APIs – for any use case or environment (cloud or on-premises). You can access Apigee through the Google Cloud console or in commonly used IDEs like VS Code via the Cloud Clode plug-in.

And now, you can use Gemini Code Assist to create consistent quality APIs in Apigee without any specialized expertise. If the existing API specifications in API Hub do not meet your requirements, you can use Gemini to create a new one by simply describing what you need in natural language. Gemini Code Assist considers artifacts such as your security schemas or API objects in API Hub, and uses it to create a specification tailored to your enterprise. This saves a lot of time in development and review cycles.

Using Gemini Code Assist to generate tailored and consistent API specifications

In Apigee, you can simulate real-world API behavior and publish the specification to API Hub, for testing and driving multiple development streams in parallel.

Gemini Code Assist provides guidance and explanations during API proxy creation

Furthermore, Gemini offers step-by-step guidance for adding new policy configurations while creating an API proxy. Lastly, Gemini also provides explanations for your existing configurations, reducing the learning curve during updates and maintenance.

Using Gemini Code Assist to build integrations and automations

Application Integration is Google Cloud’s Integration Platform as a Service (iPaaS) that automates business processes by connecting any application — both home-grown and third-party SaaS — with point-and-click simplicity. Its intuitive interface lets you build complex flows, map data, and streamline operations with pre-built tasks and triggers.

And now, using Gemini Code Assist, anyone in your team can create end-to-end automation flows in Application Integration by just describing their requirements. For example, you can use Gemini to automate the task of updating a case in your CRM (like Salesforce), when a new issue is created in your bug tracking system (like JIRA). You can either issue a prompt to Gemini or use one-click suggestions provided in the interface. Based on the prompt and existing enterprise context such as APIs or applications, Gemini suggests multiple flows tailored for your use case.

Using Gemini Code Assist to create integration flows and automate SaaS processes

In accordance with your enterprise context, Gemini automatically creates variables and pre-configures tasks, making the integration ready for immediate use. Gemini doesn't just respond to prompts — it intelligently analyzes your flow and proactively suggests optimizations, such as replacing connectors or fine-tuning REST endpoint calls. Gemini also helps you to extend existing flows in a single click, significantly reducing your maintenance efforts.

Extending integration flows with proactive suggestions from Gemini Code Assist

The visual nature of the Application Integration interface makes the flow self-explanatory, making it easier for new users to ramp up. Gemini even automatically generates intelligent descriptions based on existing configurations, helping to get the integration into adoption faster.

Get started

APIs and integrations are essential building blocks that provide differentiated experiences with AI models and applications. Using Gemini Code Assist, you can significantly reduce the toil of building these APIs and integrations, while adhering to your enterprise quality standards. You can use Gemini Code Assist (public preview) to simplify API and integration building within Apigee or Application Integration.

Introducing Shadow API detection for your Google Cloud environments

Wed, 10 Apr 2024 16:00:00 +0000

Enterprises operate a large and growing number of APIs — more than 200 on average — each a potential front door to sensitive data. Even more challenging can be figuring out which of these APIs are not actively managed “shadow APIs”. Born from well-intended development initiatives and legacy systems, shadow APIs operate without proper oversight or governance, and could be the source of damaging security incidents.

Today at Google Cloud Next, we are excited to announce shadow API detection in preview in Advanced API Security, part of our Apigee API Management solution.

Securing your APIs with Apigee API Management

Apigee is Google Cloud’s turnkey API management solution that can help you build, manage, and secure APIs in the cloud and on-premises. Apigee helps ensure the reliability of your API transactions with fine-grained controls and more than 50 built-in security policies, including authentication and authorization.

Advanced API Security works proactively to identify misconfigured APIs, detect malicious bot and business logic attacks, and helps organizations take swift action to mitigate threats. Previously, this protection was only available for actively-managed APIs. Now, with the ability to discover shadow APIs in Advanced API Security, you can eliminate hard-to-find blind spots and close security gaps.

Detecting shadow APIs in Advanced API Security

Advanced API Security now integrates with Google Cloud regional external Application Load Balancers to discover and identify API traffic in a specific region, to help support regulatory and performance requirements.

In the following example, we show how this works in our Belgium region (europe-west-1).

Select your Google Cloud external Application Load Balancer’s region to discover the associated APIs.

Through examination of requests and responses flowing through your load balancers, Advanced API Security extracts the APIs and their relevant details such as API endpoints, platform, protocol, parameter names, and responses. You can access critical details on where the API is operating, the kind of operations that are running, and the latest activity on these APIs via an intuitive interface.

Advanced API Security catalogs and organizes all the APIs linked to the selected load balancer

Shadow API detection also looks at historical data to uncover new API calls, and can provide always-on awareness and detection of emerging shadow APIs. You can tag individual endpoints that need further attention to ensure comprehensive protection across your API surface.

Detailed information on shadow API endpoints associated with your load balancer

Upon detecting shadow APIs, you can collaborate with the API owners to establish management in accordance with company-wide security and API management standards. You can also implement missing security measures to help reduce the risk of compromise.

Get started tracking down shadow APIs

By detecting shadow APIs, Advanced API Security can help you strengthen your security posture and adopt a more proactive approach to finding vulnerabilities lurking in your application infrastructure. Sign up today to gain access to Advanced API security with shadow API detection.

Powering Google Cloud with Gemini

Tue, 09 Apr 2024 12:00:00 +0000

aside_block: <ListValue: [StructValue([('title', 'Try Google Cloud for free'), ('body', <wagtail.rich_text.RichText object at 0x7f3ab7f24100>), ('btn_text', 'Get started for free'), ('href', 'https://console.cloud.google.com/freetrial?redirectPath=/welcome'), ('image', None)])]>

We are excited to share with you that Gemini for Google Cloud is here. Generative AI’s capabilities have grown tremendously over the last year, and we have infused it throughout our product portfolio.

Gemini for Google Cloud is a new generation of AI assistants for developers, Google Cloud services, and applications. These assist users in working and coding more effectively, gaining deeper data insights, navigating security challenges, and more. Using Google's Gemini family of models, Gemini for Google Cloud lets teams accomplish more in the cloud.

Gemini for Google Cloud offers enterprise-ready, AI capabilities that deliver robust security, compliance, and privacy controls, all with industry-leading availability.

Let’s take a detailed look at how we’re integrating Gemini into our Google Cloud offerings.

Accelerate software delivery with Gemini Code Assist

We are announcing Gemini Code Assist, the evolution of the Duet AI for Developers, which now uses our latest Gemini models. It offers AI-powered assistance to help developers build applications with higher velocity and quality in popular code editors like VS Code and JetBrains. Gemini Code Assist is an enterprise-grade coding assistance solution that supports your private codebase wherever it lives — on-premises, Gitlab, Github, Bitbucket, or even across multiple repositories. Built with robust enterprise features, it enables organizations to adopt AI assistance at scale while meeting security, privacy, and compliance requirements.

"As Google Cloud’s Gemini Code Assist launch partners, we are excited to report that we have seen efficiency gains of over 30% through the adoption of LLM based code acceleration workflows. Gemini Code Assist's time-saving code completion and bug resolution features have allowed us to push the boundaries of innovation and productivity.” - Asif Hasan, Co-Founder, Quantiphi Inc.

At Next, we are introducing many exciting new features to Gemini Code Assist:

Full codebase awareness, currently in private preview, allows you to perform large-scale changes across your entire codebase, including adding new features, updating cross-file dependencies, helping with version upgrades, comprehensive code reviews, and more. This capability is powered by Google’s Gemini 1.5 Pro model, which offers a one-million-token context window, the largest in the industry.
Code customization, currently in private preview. Enterprises can connect their private codebases to tailor Gemini Code Assist to assist developers in providing context-aware code generation. In addition, we are providing connections for Gemini Code Assist to reach multiple source-code repositories including GitLab, GitHub and Bitbucket.

“Code customization using RAG with Gemini Code Assist significantly increased the quality of Gemini's assistance for our developers in terms of code completion and generation. With code customization in place, we are expecting a big increase in the overall code-acceptance rate. ” Kai Du, Director of Engineering and Head of Generative AI, Turing

Integration Services: We are expanding the reach of Code Assist with Apigee and Application Integration to seamlessly access and connect your applications.
Ecosystem enhancements: Following our ecosystem announcement last December, we are improving Gemini Code Assist with data and knowledge sources from multiple partners today including Datadog, Datastax, Elastic, HashiCorp, Neo4j, Pinecone, Redis, Singlestore, Snyk, and Stack Overflow.

“This landmark, multi-dimensional AI-focused partnership, which includes Stack Overflow adopting the latest AI technology from Google Cloud, and Google Cloud integrating Stack Overflow knowledge into its AI tools, underscores our joint commitment to unleash developer creativity, unlock productivity without sacrificing accuracy, and deliver on socially responsible AI. By bringing together the strengths of our two companies, we can accelerate innovation across a variety of industries." - Prashanth Chandrasekar, CEO, Stack Overflow

Efficiently manage your application lifecycle with Gemini Cloud Assist

Gemini Cloud Assist helps cloud teams design, operate, and optimize their application lifecycle. Gemini’s contextual and personalized AI guidance understands your Google Cloud resources to help you craft new designs, deploy workloads, manage applications, troubleshoot issues, and optimize performance and costs. You can accelerate complex tasks and boost productivity to stay focused on your business. Gemini Cloud Assist offers the following capabilities:

Goal-driven design: Describe your desired design outcome and Gemini Cloud Assist can generate architecture configurations tailored to your needs. It even explains the reasoning behind its suggestions.
Guided operations and troubleshooting: Gemini Cloud Assist diagnoses issues, pinpoints root causes, and recommends solutions, helping you quickly resolve your incidents.
Tailored optimizations: Whether you prioritize cost savings, performance, or high availability, Gemini Cloud Assist identifies areas for enhancement and suggests how to achieve your goals.

Cloud Assist saves time with alert summarization, log explanation and contextual troubleshooting.

Gemini Cloud Assist is directly accessible through a chat interface in the Google Cloud console, and directly embedded into the interfaces where you manage different cloud products and resources. Gemini Cloud Assist is in private preview.

“Gemini Cloud Assist is useful in optimizing our Google Cloud environment and helps troubleshoot issues that come up.” - Sai Dutta, Enterprise Architect, Ford Motor Company

Elevate security expertise with Gemini in Security

Last year, we became one of the first major cloud providers in the market to make gen AI generally available to defenders. We are now adding Gemini in Security Operations to Chronicle to elevate the skills of security teams and boost their productivity, allowing them to more easily detect, investigate, and respond to threats. A new assisted investigation feature, generally available at the end of this month, converts natural language to new detections, summarizes event data, recommends actions to take, and navigates users through the platform via conversational chat.

Gemini in Security Operations allows users to quickly investigate incidents and alerts using conversational chat in Chronicle

“Gemini in Security Operations is enabling us to enhance the efficiency of our Cybersecurity Operations Center program as we continue to drive operational excellence.” - Ronald Smalley, Senior Vice President of Cybersecurity Operations, Fiserv

In addition, we are introducing new AI capabilities across our security portfolio:

Gemini in Threat Intelligence, in public preview, allows you to tap into Mandiant’s frontline threat intelligence using conversational search to get insights about threat actor behavior in seconds. It also helps users enhance the efficiency of their threat research by automating web crawling for relevant Open-Source Intelligence (OSINT) articles, ingesting information and providing concise summaries to aid analysts.
Gemini in Security Command Center, in public preview, summarizes critical and high-priority alerts for misconfigurations and vulnerabilities, and can provide recommendations on how to close potential exploits in simulated attack paths, helping organizations to proactively mitigate risk.

Gemini in Security features are built on our SecLM API, which helps make Gemini more security-specific and extensible.

With Gemini in Security, customers like Pfizer are performing complex analysis faster and helping new analysts on-board more quickly, freeing up time for seasoned analysts to pursue advanced threats. You can learn more about what’s new here and go deeper on Gemini in Security here.

Accelerate analytics and workflows with Gemini in BigQuery

Today, we are also announcing that Gemini in BigQuery is in preview. Gemini in BigQuery changes the game for data engineers and data analysts by enabling them to be more productive, improve query performance and optimize costs throughout the analytics lifecycle, from ingestion and pipeline creation to deriving valuable insights with AI-powered capabilities.

Gemini in BigQuery comes with a new data canvas which provides a new notebook-like experience with natural language support and embedded visualizations.

Imagine you are a data analyst at a bikeshare company. You can use the new data canvas of Gemini in BigQuery to explore the datasets, identify the top trips and create a customized visualization, all using natural language prompts within the same interface

Gemini in BigQuery also includes AI augmented data preparation that assists users with cleansing and wrangling of data along with the ability to build low-code visual data pipelines. It also offers query recommendations, semantic search, low-code visual data pipeline development tools, and intelligent recommendations for query performance improvement, error minimization, and cost optimization. Users can also create SQL or Python code using natural language prompts and get real-time suggestions while composing queries.

"With the new AI-powered assistive features in BigQuery and ease integrating with other Google Workspace products, our teams can extract valuable insights from data. The natural language-based experiences, low-code data preparation tools, and automatic code generation features streamline high-priority analytics workflows, enhancing the productivity of data practitioners and providing the space to focus on high impact initiatives. Moreover, users with varying skill sets, including our business users, can leverage more accessible data insights to effect beneficial changes, fostering an inclusive data-driven culture within our organization." - Tim Velasquez, Head of Analytics, Veo

We have also built a seamless connection from BigQuery to Vertex AI to give you direct access to AI models in Vertex AI from BigQuery. This allows you to seamlessly combine AI models, classic ML operators, and statistical functions together in your data pipelines for multi-modal analysis. With this new capability, you can analyze documents, videos, images and audio recordings together with your structured data.

Automate insights with Gemini in Looker

Gemini in Looker provides users with new ways to engage and chat with their business data. Today we are introducing a new Conversational Analytics offering in private preview, which delivers multi-turn capabilities for you to ask questions of your data as simply as you would ask your business expert a question on chat. Conversational Analytics offers a dedicated space in Looker to initiate a chat on any topic with your data and derive insights in mere seconds, leading you to your next phase of discovery and analysis.

Imagine you’re an ecommerce provider. You can query Gemini in Looker to learn sales trends and immediately explore the insights, with details on how the charts were created.

In addition to Conversational Analytics, we are releasing new capabilities in public preview, all designed to accelerate your ability to create sharp visualizations and reports, connect them with Workspace, and share them with your team — all without writing code.

Gemini in Looker is your always available intelligent assistant, ready to speed you from query to creation and search to sharing, and bring the benefits of BI to the vast majority of users within your organization.

Supercharge database development and management with Gemini in Databases

Gemini in Databases delivers AI-powered assistance that simplifies all aspects of the database journey, helping teams focus on what matters most.

Developers, operators, and database administrators can now build applications faster using natural language; manage, optimize and govern an entire fleet of databases from a single pane of glass; and accelerate database migrations. Gemini in Databases is now in preview.

Gemini brings SQL generation and summarization capabilities to Database Studio, our rich SQL editor in the Google Cloud console. Developers can now get high-quality assistance to accelerate their coding process based on best practices. Moreover, they can engage with our AI-driven chat interface to clarify questions and get help wherever needed.

Operators can also now manage an entire fleet of databases from a single pane of glass with Database Center. Database Center simplifies database fleet management through intelligent dashboards that proactively assess availability, data protection, security, and compliance issues, offering insights and tips. With smart recommendations, you can optimize performance and troubleshoot issues by simply letting the assistant do the analysis for you and following the advice provided.

For Gemini in Databases, ask Gemini “Are all my production databases highly available?” and see the affected databases within the Database Center

Gemini in Databases also assists with the last-mile of database migrations within our Database Migration Service, including code conversion. Additionally, to help upskill and retrain SQL developers, we've included explainability, which enables a side-by-side comparison of dialects, along with detailed explanations of the code and recommendations that were generated.

“With Gemini in Databases, we can get answers on fleet health in seconds and proactively mitigate potential risks to our applications more swiftly than ever before.” - Bogdan Capatina, Technical Expert in Database Technologies, Ford Motor Company

Gemini for Google Cloud is enterprise-ready from day one

We designed Gemini for Google Cloud specifically to handle the demanding needs of large-scale businesses. It integrates with your current systems, boosting efficiency immediately. We know data security and privacy are crucial for enterprises, which is why Gemini offers strong protection as a core feature. It helps you with:

Shared fate: We understand the potential copyright issues surrounding AI. If you are challenged on copyright grounds, we will assume responsibility for the potential legal risks involved with generative AI indemnification.
Control your data: You decide where your data resides to meet your company's requirements, while still benefiting from Google Cloud's vast, scalable network.
Deploy responsibly: Gemini is built with responsible AI in mind, allowing you to track sources and connect AI's responses directly to your own data for increased accountability.

Imagine what AI can do for you

With Gemini for Google Cloud, everyone from developers, to cloud operators, to security operators, to business analysts can harness the power of AI. The pace of AI innovation in the industry will continue to accelerate, and Google Cloud provides productive, responsible innovation that helps our customers generate value right now. Our customers are already seeing increases in productivity, faster times to market, reduced operating costs and an increased security posture. We are taking on the challenge of transforming businesses with AI, and this is just the beginning, with so much more to come.

TPG Telecom reduces API delivery time by 50% with Apigee

Wed, 13 Mar 2024 16:00:00 +0000

TPG Telecom is a rising star in Australian telecommunications with a strategy based on extensive mergers and acquisitions (M&A) and organic growth. Our brands, including Vodafone, TPG, iiNet and AAPT, service five million mobile customers and 2.2 million fixed broadband customers through extensive mobile and fiber networks.

APIs are integral to our business on three levels. On the customer experience level, integration-based APIs focus on customer-related journeys, while we also use APIs for network and payment-related activities. However, our M&A-based growth strategy meant we were working with multiple technology stacks and systems with API capabilities. We needed to move to a modern API management platform for a range of reasons, including realizing the benefits of our existing and acquired businesses through cross-selling. The current customer relationship management (CRM) and billing systems provide APIs in different formats and protocols. As such, support for diverse API delivery platforms and visibility across APIs is essential to the business. Having Apigee as the API gateway allows TPG to expose APIs to the digital consumers system in a consistent format so that these digital systems can concentrate on the digital experience, rather than focus on implementing the complexities that support multiple API protocols. This helps ease the integration to the various backend systems.

API governance is important at TPG as we need to understand how they are being consumed and how they’re performing so that we can continuously evolve our API experience based on the feedback we get out of the APIs consumed. We use API metrics to trigger alarms that help us proactively identify and resolve issues in our downstream systems.

We wanted to replace what was a primarily on-premises API management solution with a decentralized, cloud-native platform to align with our broader business direction. We also sought to move from an outsourced, diverse development model to an agile, centralized DevSecOps, so we could deliver APIs in a seamless, consistent manner.

Working with another cloud provider, we needed a solution that would enable us to build APIs in a range of languages or frameworks and expose functionality consistently for consumption. It had to support the integration of a range of back-ends and enable runtimes within our preferred partner while ensuring seamless integration between accounts to our on-premises and partner cloud offerings. In addition, we had to put all our APIs under a common governance platform for visibility.

Why we selected Apigee

We evaluated several API management platforms and selected Apigee. It was the best fit for us for several reasons, including the fact it was a market leader due to its intuitive design and comprehensive feature set. The Apigee licensing model also enables us to better predict how much we would spend on licensing.

Also, it took us considerably less effort to expose and secure APIs and enable an automated CI/CD pipeline for faster, more efficient deployment. Finally, Google Cloud’s investments and proficiency in technologies such as AI, Kubernetes and service mesh, all technologies with rich applications to our business, helped prompt our selection.

Further, Apigee offered flexible deployment options and we selected Apigee hybrid to enable runtimes and integrations across multi-cloud and on-premises environments. Apigee also enabled us to establish a common governance platform for all APIs across our business.

We went live on Apigee with our first set of APIs at the end of 2022, and TPG Telecom is now on a multi-year journey to connect six platforms with up to 300 underlying systems. We’ve had a consistent experience consuming APIs exposed by TPG both for internal and external consumers. In addition, the security built into the Apigee platform ensures that the APIs being consumed do not have vulnerabilities in them, and are being monitored real time to pick up any performance or availability issues. As a result, we’re seeing a much faster integration.

Rather than enforce its use centrally, we are growing adoption across TPG on the basis of demonstrating value internally, which means looking for opportunities to work with teams to onboard APIs to Apigee.

Below are images of our current state Apigee architecture, and how we integrate APIs with external service providers:

Current state architecture - Apigee

Overcoming API visibility and duplication challenges

Apigee is helping us overcome a range of challenges we face by leveraging APIs within our business. For example, we had limited visibility of APIs and their consumption, which made creating policies hard, delayed fixing vulnerabilities and slowed the testing and release of APIs, which greatly reduced time-to-market speed. Additionally, there was extensive duplication of API-based products and services across our various businesses and brands due to a lack of visibility across business units. Without a single platform to expose APIs, external consumers leveraging our services resulted in API requests traversing multiple integration points and delaying response times. We also needed to refine our documentation approach to standardize and clarify our processes and implementation rules as well as provide a unified repository to store API artifacts relating to rules, patterns, and integration styles.

With Apigee and API Hub, we now have a central location from which to design and publish APIs, which are well documented with clear specifications available, and we are moving towards a single API format to reduce complexity and creation time.

Prior to Apigee, duplication also extended to security controls. Because we did not have a unified API management and API solution to provide an abstraction layer to API consumers, we had to engage disparate pentesting and security teams to independently test our back-end systems, network and customer experience applications. Reducing the time needed to implement the same controls on different platforms was a priority as pentesting cycles ran for two sprints. The first sprint involved recommending security measures for an application and the second sprint was to verify that those measures had been implemented.

We now use Apigee’s Advanced API Security as a single control plane to manage security across the hundreds of published APIs. The security control recommendations and remediations provided by Apigee’s Advanced API Security solution also streamline the process for enforcing critical security controls consistently.

Prior to implementing Apigee, our API management landscape was fragmented and complex. With multiple solutions, it was difficult to invest in platform engineering best practices, including CI/CD, observability and governance. We could not implement observability through New Relic, Splunk or other products, and we did not have active monitoring in place to identify any issues and notify the right people to respond. Without automated CI/CD, many of these platforms required highly manual build-deploy processes, which made it difficult to maintain and manage code versioning, as well as delaying the deployment of solutions to production, often by weeks.

Also, Apigee has enabled us to standardize logging and monitoring so all our APIs follow a common pattern and our Apigee logs go into Splunk for observability across the platform. We have also now configured some alerting and monitoring systems to identify if any of our systems are experiencing issues such as timeouts or delays, which enables us to promptly engage the relevant teams to resolve those problems.

Under our previous platform, execution logic was tightly coupled between API development and deployment, meaning our developers had to understand a considerable amount of business logic before they could deliver API services to external customers. Bringing these developers up to speed added unnecessarily to our overheads. Now with Apigee, we’ve implemented a loosely-coupled architecture and created a central API team, focused on deployment, standards, and runtime operations, reducing development overheads and accelerating the release cadence.

With Apigee we’ve been able to implement standardization, security, and consistent integration processes for our APIs. When planning for special events and promotions such as the launch of a new phone, we capture the volume of requests and expected launch traffic, and record other business metrics to determine the auto-scaling characteristics of our EKS cluster. Apigee Hybrid scales extremely well without any impact on performance or availability.

Onboarding APIs to production two times faster

We are now onboarding APIs to production in just two weeks, including integration, observability and associated automation. It used to take up to four weeks with our previous API management platform. Apigee Advanced API Security enables us to evaluate the security scores of each API and identify and fix a lot of issues prior to running penetration tests, providing a good degree of confidence that foundational security controls are protecting our production APIs.

We are now poised to step up the adoption of Apigee across the enterprise, for both internal and external API consumers, as well as realize the potential of APIs to unlock cross-sell and upsell opportunities within the TPG Telecom umbrella.

Modernize Apigee-GKE Connectivity with Private Service Connect and GKE Gateway

Wed, 28 Feb 2024 17:00:00 +0000

In today's cloud-native landscape, organizations demand both agile API management and the flexibility of microservices running on Kubernetes. Google Cloud offers powerful solutions for comprehensive API management capabilities with Apigee and Google Kubernetes Engine (GKE) for orchestration of containerized applications. But bridging these environments for streamlined API traffic to your Kubernetes-based microservices can present hurdles. Fortunately, there’s Private Service Connect (PSC), which you can use to create private and secure connections from your VPCs to Google, third parties, or your own services. In this scenario, PSC provides a secure, efficient, and elegant solution for the southbound communication from Apigee to your backend targets.

The connectivity challenge

The traditional methods of bridging Apigee and GKE introduce a series of networking complications. Some of the typical challenges hindering streamlined connectivity between Apigee and GKE include:

Public exposure: Routing API traffic from Apigee to GKE often necessitates exposing GKE services publicly. This introduces security risks by opening potential attack vectors.
Traffic bottlenecks and cost: Relying exclusively on public internet connectivity can result in unpredictable latency, affecting performance and driving up egress costs.
Management complexity: Configuring network and VPC Peering connections, ensuring CIDR ranges do not overlap, and managing access permissions across platforms like Apigee and GKE can create a complex administrative burden.

The Private Service Connect approach

PSC fundamentally transforms the way your Apigee deployment interacts with GKE services, unlocking a new level of security and simplicity using:

Private, internal networking: PSC exposes services from one VPC to another directly via a service attachment and endpoint without the need for complex VPC Peering or exposing clusters to the public internet. PSC facilitates the establishment of private endpoints within your Google Cloud VPC for your GKE Gateway. This enables Apigee to communicate with your Kubernetes service directly via Google Cloud’s internal network, bypassing the public internet entirely or requiring complex VPC Peering implementations.
Granular security controls: PSC allows you to expose only the specific services within your GKE cluster that Apigee is authorized to access. This granular approach minimizes risk.
Performance improvement: Private connectivity over Google Cloud's high-performance network fosters reduced latency and greater reliability, enhancing overall API response times.

Key components in the mix

Apigee: Google Cloud's robust API management platform simplifies creating, managing, securing, and monitoring APIs, providing policy enforcement, analytics, and monetization capabilities.
GKE Gateway: GKE’s implementation of the Kubernetes Gateway API (a newer, more flexible API specification) is an advanced networking resource that improves upon the Ingress object and provides expanded routing and load balancing features for internal and external traffic within your GKE cluster.
Private Service Connect: The cornerstone of this integration, PSC sets up a private connection and manages the routing between your Apigee VPC and the VPC hosting your GKE cluster.

Setting up the secure bridge

To establish this connectivity, you must complete the following steps. Here, we focus on the details of GKE Gateway creation, as the other steps are very straightforward and well documented.

1. Deploy the Internal GKE Gateway:
This is a very detailed process but at a high level, the following steps must be completed:

Create a VPC-native cluster: A VPC-native cluster is a cluster whose Pods and Services directly use IP addresses from your Google Cloud VPC network.
Enable the Gateway API: You can achieve this during cluster creation or by updating an existing cluster.
Configure a Proxy-only Subnet: This is a different subnet from the subnet your GKE cluster runs in. Ensure it is created with the REGIONAL_MANAGED_PROXY purpose
Create a named IP address: Named IP addresses let you reserve a static IP to be used by your Gateway resource. If you do not specify an IP address on the Gateway, then the Gateway controller automatically provides an IP address.
Create the Internal Gateway resource: A sample yaml file to create the Gateway using a named IP address is outlined below:

code_block: <ListValue: [StructValue([('code', 'kind: Gateway\r\napiVersion: gateway.networking.k8s.io/v1beta1\r\nmetadata:\r\n name: sample-gateway\r\nspec:\r\n gatewayClassName: gke-l7-rilb\r\n listeners:\r\n - name: http\r\n protocol: HTTP\r\n port: 80\r\n addresses:\r\n - type: NamedAddress\r\n value: <IP_ADDRESS_NAME>'), ('language', ''), ('caption', <wagtail.rich_text.RichText object at 0x7f3ab9ecbfd0>)])]>

2. Set up a PSC service attachment: Create a PSC service attachment in the VPC network where the GKE Gateway is deployed. Ensure to use the forwarding rule created for the GKE Gateway to configure the service attachment
3. Create an Endpoint attachment: This is configured in the Apigee organization.
4. Configure the Gateway routes to your GKE services: The benefit of this is deploying containerized applications and Routes can be decoupled from the Gateway deployment process.

Conclusion

Private Service Connect improves how Apigee interacts with GKE workloads, delivering enhanced security, better performance, and increased operational efficiency. By sidestepping the public internet or complex VPC Peering management and embracing Google Cloud's secure internal infrastructure, you can reduce risk and gain a streamlined and robust backbone for your cloud-native API services.

API Management

Turn your API sprawl into an agent-ready catalog

Why this matters for your AI strategy

Sprawl hurts AI adoption

Step 1: Centralize your API metadata

Step 2: Make APIs agent-ready with API spec boosting add-on

Get started

Announcing advanced governance capabilities for Vertex AI Agent Builder

1. Govern your tools with confidence

2. Build your AI agents faster

Above is a demo showcasing A2UI in action where the user uploads a photo, a remote agent uses Gemini to understand it, and dynamically generates a custom form using A2UI for the specific needs of the customer.

3. Scale your AI agents effectively

How customers are achieving more with Agent Builder

Get started

Announcing MCP support in Apigee: Turn existing APIs into secure and governed agentic tools

Overview of Apigee’s MCP support

Benefits of Apigee’s approach to MCP support

Using Apigee MCP tools with agent frameworks

Next steps

Google Cloud Apigee Named a Leader for the 10th Consecutive Time in the Gartner® Magic Quadrant™ for API Management

Extending API management to gen AI and agentic AI

Managing, governing, and securing agentic AI

Apigee: Trusted by global leaders

Thank you to our customers and partners

Protecting your APIs from OWASP’s top 10 security threats

What you can do about the OWASP top 10 API security risks

Mitigating security risks with Apigee and Advanced API Security

Get started on API security with Apigee

Operationalizing generative AI apps with Apigee

Apigee as a proxy for agents

Apigee as a gateway between LLM application and models

Ready to unlock the full potential of gen AI?

Google Cloud Apigee named a Leader in the 2024 Gartner® Magic Quadrant™ for API Management

Google Cloud Apigee named a Leader in the 2024 Gartner® Magic Quadrant™ for API Management

Your partner in digital transformation

Navigating the API landscape with confidence

Our commitment to continued innovation

Thank you to our customers and Partners

Download the report

From gRPC to RESTful APIs: Expose your gRPC services to the REST of the world

gRPC-to-HTTP gateway

Lower entry barriers with API management

Conclusion and next steps

gRPC vs REST: Understanding gRPC, OpenAPI and REST and when to use them in API design

Apigee and the Interoperability Model (ModI) for the Italian Public Administration

Apigee as ModI platform enabler

How to implement ModI guidelines and patterns within Apigee

Accenture accelerator for ModI

Conclusion

Faster API development with the Cloud Code plugin for API management

Workspace for organization

Gemini Code Assist for API management (Preview)

Mock servers for increased velocity

Get started

How Altice Labs enhanced API management with Google's Application Integration

A deeper dive into our integration strategy

Making an impact at Altice Group

Enhance the security of your DialogFlow CX chatbots with Apigee

Next steps

CSPs reach further and monetize smarter with network API digital marketplace syndication

A digital API marketplace

Conclusion

Unlocking API performance insights with Apigee custom reports

Understanding Apigee Custom Reports

Key custom reports

1. Latency analysis

2. Response code analysis

3. API product performance analysis

4. Cache-hit analysis

5. User agent analysis

6. API-location analysis

Accessing custom reports

Quick recap on report creation from UI

Track API performance with custom reports

Create ecommerce experiences with commercetools and Google Cloud Application Integration

Connect your commercetools platform with Google Cloud

Using Gemini Code Assist to build APIs, integrations, and automation flows

Gemini Code Assist: AI-powered assistance, tailored for your enterprise

Using Gemini Code Assist to build APIs

Using Gemini Code Assist to build integrations and automations