In November 2020, the Apigee Edge API reference documentation will move to a new experience based on the Apigee integrated portal and visitors to this site will be redirected.

You are viewing the Apigee Edge API reference documentation. For the main product docs, and to search all docs, go to

Create API Product

Resource Summary


Content Type

application/json, text/xml


API Product,



Create API Product

Creates an API product in an organization.

You create API products after you have proxied backend services using API proxies.

An API product is a collection of API resources combined with quota settings and metadata that you can use to deliver customized and productized API bundles to your developer community. This metadata may include scope, environments, API proxies, and an extensible profile.

API products enable you repackage APIs on-the-fly, without having to do any additional coding or configuration.

We recommend that you start with a simple API product including only required elements. You then provision credentials to apps to enable them to start testing your APIs.

Once you have authentication and authorization working against a simple API product, you can iterate to create finer-grained API products, defining different sets of API resources for each API product.


If you don't specify an API proxy in the request body, any app associated with the product can make calls to any API in your entire organization.
If you don't specify an environment in the request body, the product allows access to all environments.


For information about the request attributes that you can specify with this API, see Creating API products.

See also What is an API product?

Ensure optimal API product and app security

An organization-level property, features.keymanagement.disable.unbounded.permissions, strengthens the security of API products in verifying API calls. When the property is set to true, the following features are enforced.


App creation

When creating a developer or company app, the management API requires that the app be associated with an API product. (The management UI already enforces this.)


API product configuration

To create or update an API product, the API product must include at least one API proxy or a resource path in its definition.


Runtime security

API calls are rejected by an API product in the following situations:

  • An API product doesn't include at least one API proxy or resource path.
  • If the variable in the message doesn't include a resource path that the API product can evaluate.
  • If the app making the API call isn't associated with an API product.

Setting this organization property requires Sys Admin rights. Edge for Private Cloud sys admins can make add this property on their own with the Update organization properties API. If you are an Edge for Public Cloud user and the previously described restrictions are not in place, contact Apigee Support to set the organization property for you.

Resource URL /organizations/{org_name}/apiproducts

Header Parameters

Name Values Description

Specify the content type as application/json or text/xml.

Request Body

Name Description Default Required?
name The internal name of the API Product. Characters you can use in the name are restricted to: A-Z0-9._\-$ %. N/A Yes
displayName The name to be displayed in the UI or developer portal to developers registering for API access N/A Yes
approvalType manual or auto. If manual, consumer key is generated and returned in 'pending' state. If auto consumer key generated and returned in 'Approved' state. N/A Yes
attributes Arbitrary name/value pairs.

Note: With Apigee Edge for Public Cloud, the custom attribute limit is 18.

Use this property to specify the access level of the API product as either public, private, or internal. Only products marked public are available to developers in the Apigee developer portal. For example, you can set a product to internal while it's in development and then change access to public when it's ready to release on the portal. API products marked as private do not appear on the portal but can be accessed by external developers. For example:

       "attributes": [
          "name": "access",
          "value": "public"
For monetization, you can use the attributes field to specify transaction success criteria. For example:

       "attributes": [
          "value": "txProviderStatus == 'OK'"
In addition, for monetization you can use the attributes field to specify custom attributes on which you base rate plan charges. For example:

       "attributes": [
          "name": "MINT_CUSTOM_ATTRIBUTE_1",
          "value": "test1"
N/A No
description An overview of the API product. Include key information about the API product that is not captured by other fields. N/A No
apiResources A comma separated list of API resources to be bundled in the API Product. See Creating API products for more on setting this value.

For information about setting this value when creating a transaction recording policy for monetization, see Creating a transaction recording policy using the API.
N/A No
environments A comma-separated list of environment name in an organization. Requests to environments not listed are rejected. N/A No
proxies A comma-separated list of API proxy names in an organization. Requests to API proxies not listed are rejected. Api proxy names included here must already exist in the environment specified in the environment property because API Services validates proxy names when you create an API product. N/A No
quota The number of request messages permitted by this API product for the specified quotaInterval and quotaTimeUnit. For example, a quota of 50, for a quotaInterval of 12 and a quotaTimeUnit of hours means 50 requests are allowed every 12 hours. N/A No
quotaInterval The time interval over which the number of request messages is calculated. N/A No
quotaTimeUnit The time unit defined for the quotaInterval, as either: minute, hour, day, month. N/A No
scopes A comma separated list of scopes. These must map to the scopes defined in an Oauth policy associated with the API Product. Any scope mismatch between an Acces Token presented and the API Product results in auth failure. N/A No

org_name Mention the Organization name true

HTTP Basic

OAuth 2.0



Make a request and see the response.

Make a request and see the response.

Make a request and see the response.


Help or comments?

  • If something's not working: Ask the Apigee Community or see Apigee Support.
  • If something's wrong with the docs: Click the "Send Feedback" button.
    (Incorrect? Unclear? Broken link? Typo?)