Skip to main content

@swamp/gcp/apigee

v2026.04.23.1

Google Cloud apigee infrastructure models

Repository

https://github.com/systeminit/swamp-extensions

Labels

gcpgoogle-cloudapigeecloudinfrastructure

Contents

Quality score

Verified by Swamp

How well-documented and verifiable this extension is.

100%

Grade A

  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types1/1earned
  • Has description1/1earned
  • At least one platform tag (or universal)1/1earned
  • Two or more platform tags (or universal)1/1earned
  • License declared1/1earned
  • Verified public repository2/2earned

Install

$ swamp extension pull @swamp/gcp/apigee

environments_archivedeployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
gcsUri?stringInput only. The Google Cloud Storage signed URL returned from GenerateUploadUrl and used to upload the Archive zip file.
labels?recordUser-supplied key-value pairs used to organize ArchiveDeployments. Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: \\p{Ll}\\p{Lo}{0,62} Label values must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes, and must conform to the following PCRE regular expression: [\\p{Ll}\\p{Lo}\\p{N}_-]{0,63} No more than 64 labels can be associated with a given store.
name?stringName of the Archive Deployment in the following format: `organizations/{org}/environments/{env}/archiveDeployments/{id}`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a archiveDeployments
getGet a archiveDeployments
ArgumentTypeDescription
identifierstringThe name of the archiveDeployments
updateUpdate archiveDeployments attributes
deleteDelete the archiveDeployments
ArgumentTypeDescription
identifierstringThe name of the archiveDeployments
syncSync archiveDeployments state from GCP
generate_download_urlgenerate download url
generate_upload_urlgenerate upload url
environments_keyvaluemaps_entries.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
name?stringResource URI that can be used to identify the scope of the key value map entries.
value?stringRequired. Data or payload that is being retrieved and associated with the unique key.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a entries
getGet a entries
ArgumentTypeDescription
identifierstringThe name of the entries
updateUpdate entries attributes
deleteDelete the entries
ArgumentTypeDescription
identifierstringThe name of the entries
syncSync entries state from GCP
apis_debugsessions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a debugsessions
ArgumentTypeDescription
identifierstringThe name of the debugsessions
syncSync debugsessions state from GCP
instances_canaryevaluations.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
control?stringRequired. The stable version that is serving requests.
endTime?stringRequired. End time for the evaluation's analysis.
metricLabels?objectThe environment ID associated with the metrics.
startTime?stringRequired. Start time for the canary evaluation's analysis.
treatment?stringRequired. The newer version that is serving requests.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a canaryevaluations
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a canaryevaluations
ArgumentTypeDescription
identifierstringThe name of the canaryevaluations
syncSync canaryevaluations state from GCP
apis_keyvaluemaps.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
encrypted?booleanRequired. Flag that specifies whether entry values will be encrypted. This field is retained for backward compatibility and the value of encrypted will always be `true`. Apigee X and hybrid do not support unencrypted key value maps.
maskedValues?booleanOptional. Flag that specifies whether entry values will be masked when returned.
name?stringRequired. ID of the key value map.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a keyvaluemaps
getGet a keyvaluemaps
ArgumentTypeDescription
identifierstringThe name of the keyvaluemaps
updateUpdate keyvaluemaps attributes
deleteDelete the keyvaluemaps
ArgumentTypeDescription
identifierstringThe name of the keyvaluemaps
syncSync keyvaluemaps state from GCP
environments_targetservers.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
description?stringOptional. A human-readable description of this TargetServer.
host?stringRequired. The host name this target connects to. Value must be a valid hostname as described by RFC-1123.
isEnabled?booleanOptional. Enabling/disabling a TargetServer is useful when TargetServers are used in load balancing configurations, and one or more TargetServers need to taken out of rotation periodically. Defaults to true.
name?stringRequired. The resource id of this target server. Values must match the regular expression
port?numberRequired. The port number this target connects to on the given host. Value must be between 1 and 65535, inclusive.
protocol?enumImmutable. The protocol used by this TargetServer.
sSLInfo?objectThe SSL/TLS cipher suites to be used. For programmable proxies, it must be one of the cipher suite names listed in: http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites. For configurable proxies, it must follow the configuration specified in: https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#Cipher-suite-configuration. This setting has no effect for configurable proxies when negotiating TLS 1.3.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a targetservers
getGet a targetservers
ArgumentTypeDescription
identifierstringThe name of the targetservers
updateUpdate targetservers attributes
deleteDelete the targetservers
ArgumentTypeDescription
identifierstringThe name of the targetservers
syncSync targetservers state from GCP
instances.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
accessLoggingConfig?objectOptional. Boolean flag that specifies whether the customer access log feature is enabled.
consumerAcceptList?arrayOptional. Customer accept list represents the list of projects (id/number) on customer side that can privately connect to the service attachment. It is an optional field which the customers can provide during the instance creation. By default, the customer project associated with the Apigee organization will be included to the list.
description?stringOptional. Description of the instance.
diskEncryptionKeyName?stringOptional. Customer Managed Encryption Key (CMEK) used for disk and volume encryption. If not specified, a Google-Managed encryption key will be used. Use the following format: `projects/([^/]+)/locations/([^/]+)/keyRings/([^/]+)/cryptoKeys/([^/]+)`
displayName?stringOptional. Display name for the instance.
ipRange?stringOptional. Comma-separated list of CIDR blocks of length 22 and/or 28 used to create the Apigee instance. Providing CIDR ranges is optional. You can provide just /22 or /28 or both (or neither). Ranges you provide should be freely available as part of a larger named range you have allocated to the Service Networking peering. If this parameter is not provided, Apigee automatically requests an available /22 and /28 CIDR block from Service Networking. Use the /22 CIDR block for configuring your firewall needs to allow traffic from Apigee. Input formats: `a.b.c.d/22` or `e.f.g.h/28` or `a.b.c.d/22,e.f.g.h/28`
location?stringRequired. Compute Engine location where the instance resides.
maintenanceUpdatePolicy?objectOptional. Maintenance channel to specify relative scheduling for maintenance.
name?stringRequired. Resource ID of the instance. Values must match the regular expression `^a-z{0,30}[a-z\\d]$`.
scheduledMaintenance?objectOutput only. The start time (UTC) of the scheduled maintenance.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a instances
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a instances
ArgumentTypeDescription
identifierstringThe name of the instances
updateUpdate instances attributes
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after update (default: true)
deleteDelete the instances
ArgumentTypeDescription
identifierstringThe name of the instances
syncSync instances state from GCP
report_statusreport status
ArgumentTypeDescription
instanceUid?any
reportTime?any
resources?any
optimizedhoststats.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a optimizedHostStats
ArgumentTypeDescription
identifierstringThe name of the optimizedHostStats
syncSync optimizedHostStats state from GCP
securityfeedback.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
comment?stringOptional. Optional text the user can provide for additional, unstructured context.
displayName?stringOptional. The display name of the feedback.
feedbackContexts?arrayRequired. The attribute the user is providing feedback about.
feedbackType?enumRequired. The type of feedback being submitted.
reason?enumOptional. The reason for the feedback.
securityFeedbackId?stringOptional. The id for this feedback report. If not provided, it will be set to a system-generated UUID.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a securityFeedback
getGet a securityFeedback
ArgumentTypeDescription
identifierstringThe name of the securityFeedback
updateUpdate securityFeedback attributes
deleteDelete the securityFeedback
ArgumentTypeDescription
identifierstringThe name of the securityFeedback
syncSync securityFeedback state from GCP
apimserviceextensions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
extensionProcessor?stringRequired. Name of the proxy deployed in the Apigee X instance.
extensions?arrayOptional. Whether this request should fail open.
lbForwardingRule?stringRequired. Name of the Google Cloud LB forwarding rule. Format: projects/{project}/regions/{region}/forwardingRules/{forwarding_rule} projects/{project}/global/forwardingRules/{forwarding_rule}
name?stringIdentifier. unique name of the APIM service extension. The name must conform with RFC-1034, is restricted to lower-cased letters, numbers and hyphens, and can have a maximum length of 63 characters. Additionally, the first character must be a letter and the last a letter or a number.
network?stringRequired. The network where the forwarding rule is created. Format: projects/{project}/global/networks/{network}
networkConfigs?arrayRequired. The region for the PSC NEG.
apimServiceExtensionId?stringOptional. ID used to uniquely identify of the service extension. It must conform with RFC-1034, is restricted to lower-cased letters, numbers and hyphens, and can have a maximum length of 63 characters. Additionally, the first character must be a letter and the last a letter or a number.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a apimServiceExtensions
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a apimServiceExtensions
ArgumentTypeDescription
identifierstringThe name of the apimServiceExtensions
updateUpdate apimServiceExtensions attributes
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after update (default: true)
deleteDelete the apimServiceExtensions
ArgumentTypeDescription
identifierstringThe name of the apimServiceExtensions
syncSync apimServiceExtensions state from GCP
environments_securityactions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
allow?objectMessage that should be set in case of an Allow Action. This does not have any fields.
apiProxies?arrayOptional. If unset, this would apply to all proxies in the environment. If set, this action is enforced only if at least one proxy in the repeated list is deployed at the time of enforcement. If set, several restrictions are enforced on SecurityActions. There can be at most 100 enabled actions with proxies set in an env. Several other restrictions apply on conditions and are detailed later.
conditionConfig?objectOptional. A list of access_tokens. Limit 1000 per action.
deny?objectOptional. The HTTP response code if the Action = DENY.
description?stringOptional. An optional user provided description of the SecurityAction.
expireTime?stringThe expiration for this SecurityAction.
flag?objectThe header name to be sent to the target.
name?stringImmutable. This field is ignored during creation as per AIP-133. Please set the `security_action_id` field in the CreateSecurityActionRequest when creating a new SecurityAction. Format: organizations/{org}/environments/{env}/securityActions/{security_action}
state?enumRequired. Only an ENABLED SecurityAction is enforced. An ENABLED SecurityAction past its expiration time will not be enforced.
ttl?stringInput only. The TTL for this SecurityAction.
securityActionId?stringRequired. The ID to use for the SecurityAction, which will become the final component of the action's resource name. This value should be 0-61 characters, and valid format is (^[a-z]([a-z0-9-]{​0,61}[a-z0-9])?$).
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a securityActions
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a securityActions
ArgumentTypeDescription
identifierstringThe name of the securityActions
updateUpdate securityActions attributes
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after update (default: true)
deleteDelete the securityActions
ArgumentTypeDescription
identifierstringThe name of the securityActions
syncSync securityActions state from GCP
disabledisable
enableenable
sites_apidocs.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
anonAllowed?booleanOptional. Boolean flag that manages user access to the catalog item. When true, the catalog item has public visibility and can be viewed anonymously; otherwise, only registered users may view it. Note: when the parent portal is enrolled in the [audience management feature](https://cloud.google.com/apigee/docs/api-platform/publish/portal/portal-audience#enrolling_in_the_beta_release_of_the_audience_management_feature), and this flag is set to false, visibility is set to an indeterminate state and must be explicitly specified in the management UI (see [Manage the visibility of an API in your portal](https://cloud.google.com/apigee/docs/api-platform/publish/portal/publish-apis#visibility)). Additionally, when enrolled in the audience management feature, updates to this flag will be ignored as visibility permissions must be updated in the management UI.
apiProductName?stringRequired. Immutable. The `name` field of the associated [API product](/apigee/docs/reference/apis/apigee/rest/v1/organizations.apiproducts). A portal may have only one catalog item associated with a given API product.
categoryIds?arrayOptional. The IDs of the API categories to which this catalog item belongs.
description?stringOptional. Description of the catalog item. Max length is 10,000 characters.
edgeAPIProductName?stringOptional. Immutable. DEPRECATED: use the `apiProductName` field instead
imageUrl?stringOptional. Location of the image used for the catalog item in the catalog. This can be either an image with an external URL or a file path for [image files stored in the portal](/apigee/docs/api-platform/publish/portal/portal-files\"), for example, `/files/book-tree.jpg`. When specifying the URL of an external image, the image won't be uploaded to your assets; additionally, loading the image in the integrated portal will be subject to its availability, which may be blocked or restricted by [content security policies](/apigee/docs/api-platform/publish/portal/csp). Max length of file path is 2,083 characters.
published?booleanOptional. Denotes whether the catalog item is published to the portal or is in a draft state. When the parent portal is enrolled in the [audience management feature](https://cloud.google.com/apigee/docs/api-platform/publish/portal/portal-audience#enrolling_in_the_beta_release_of_the_audience_management_feature), the visibility can be set to public on creation by setting the anonAllowed flag to true or further managed in the management UI (see [Manage the visibility of an API in your portal](https://cloud.google.com/apigee/docs/api-platform/publish/portal/publish-apis#visibility)) before it can be visible to any users. If not enrolled in the audience management feature, the visibility is managed by the `anonAllowed` flag.
requireCallbackUrl?booleanOptional. Whether a callback URL is required when this catalog item's API product is enabled in a developer app. When true, a portal user will be required to input a URL when managing the app (this is typically used for the app's OAuth flow).
title?stringRequired. The user-facing name of the catalog item. `title` must be a non-empty string with a max length of 255 characters.
visibility?booleanOptional. DEPRECATED: use the `published` field instead
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a apidocs
getGet a apidocs
ArgumentTypeDescription
identifierstringThe name of the apidocs
updateUpdate apidocs attributes
deleteDelete the apidocs
ArgumentTypeDescription
identifierstringThe name of the apidocs
syncSync apidocs state from GCP
get_documentationget documentation
update_documentationupdate documentation
ArgumentTypeDescription
asyncApiDocumentation?any
graphqlDocumentation?any
oasDocumentation?any
keyvaluemaps.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
encrypted?booleanRequired. Flag that specifies whether entry values will be encrypted. This field is retained for backward compatibility and the value of encrypted will always be `true`. Apigee X and hybrid do not support unencrypted key value maps.
maskedValues?booleanOptional. Flag that specifies whether entry values will be masked when returned.
name?stringRequired. ID of the key value map.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a keyvaluemaps
getGet a keyvaluemaps
ArgumentTypeDescription
identifierstringThe name of the keyvaluemaps
updateUpdate keyvaluemaps attributes
deleteDelete the keyvaluemaps
ArgumentTypeDescription
identifierstringThe name of the keyvaluemaps
syncSync keyvaluemaps state from GCP
environments_apis_revisions_debugsessions_data.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a data
ArgumentTypeDescription
identifierstringThe name of the data
syncSync data state from GCP
organizations.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
addonsConfig?objectFlag that specifies whether the Advanced API Ops add-on is enabled.
apiConsumerDataEncryptionKeyName?stringOptional. Cloud KMS key name used for encrypting API consumer data. If not specified or [BillingType](#BillingType) is `EVALUATION`, a Google-Managed encryption key will be used. Format: `projects/*/locations/*/keyRings/*/cryptoKeys/*`
apiConsumerDataLocation?stringOptional. This field is needed only for customers using non-default data residency regions. Apigee stores some control plane data only in single region. This field determines which single region Apigee should use. For example: "us-west1" when control plane is in US or "europe-west2" when control plane is in EU.
attributes?arrayNot used by Apigee.
authorizedNetwork?stringOptional. Compute Engine network used for Service Networking to be peered with Apigee runtime instances. See [Getting started with the Service Networking API](https://cloud.google.com/service-infrastructure/docs/service-networking/getting-started). Valid only when [RuntimeType](#RuntimeType) is set to `CLOUD`. The value must be set before the creation of a runtime instance and can be updated only when there are no runtime instances. For example: `default`. When changing authorizedNetwork, you must reconfigure VPC peering. After VPC peering with previous network is deleted, [run the following command](https://cloud.google.com/sdk/gcloud/reference/services/vpc-peerings/delete): `gcloud services vpc-peerings delete --network=NETWORK`, where `NETWORK` is the name of the previous network. This will delete the previous Service Networking. Otherwise, you will get the following error: `The resource 'projects/...-tp' is already linked to another shared VPC host 'projects/...-tp`. Apigee also supports shared VPC (that is, the host network project is not the same as the one that is peering with Apigee). See [Shared VPC overview](https://cloud.google.com/vpc/docs/shared-vpc). To use a shared VPC network, use the following format: `projects/{host-project-id}/{region}/networks/{network-name}`. For example: `projects/my-sharedvpc-host/global/networks/mynetwork` **Note:** Not supported for Apigee hybrid.
billingType?enumOptional. Billing type of the Apigee organization. See [Apigee pricing](https://cloud.google.com/apigee/pricing).
controlPlaneEncryptionKeyName?stringOptional. Cloud KMS key name used for encrypting control plane data that is stored in a multi region. Only used for the data residency region "US" or "EU". If not specified or [BillingType](#BillingType) is `EVALUATION`, a Google-Managed encryption key will be used. Format: `projects/*/locations/*/keyRings/*/cryptoKeys/*`
customerName?stringNot used by Apigee.
description?stringOptional. Description of the Apigee organization.
disableVpcPeering?booleanOptional. Flag that specifies whether the VPC Peering through Private Google Access should be disabled between the consumer network and Apigee. Valid only when RuntimeType is set to CLOUD. Required if an authorizedNetwork on the consumer project is not provided, in which case the flag should be set to true. The value must be set before the creation of any Apigee runtime instance and can be updated only when there are no runtime instances. **Note:** Apigee will be deprecating the vpc peering model that requires you to provide 'authorizedNetwork', by making the non-peering model as the default way of provisioning Apigee organization in future. So, this will be a temporary flag to enable the transition. Not supported for Apigee hybrid.
displayName?stringOptional. Display name for the Apigee organization. Unused, but reserved for future use.
networkEgressRestricted?booleanOptional. Flag that specifies if internet egress is restricted for VPC Service Controls. Valid only when runtime_type is `CLOUD` and disable_vpc_peering is `true`.
portalDisabled?booleanOptional. Configuration for the Portals settings.
properties?objectThe property key
runtimeDatabaseEncryptionKeyName?stringOptional. Cloud KMS key name used for encrypting the data that is stored and replicated across runtime instances. Update is not allowed after the organization is created. If not specified or [RuntimeType](#RuntimeType) is `TRIAL`, a Google-Managed encryption key will be used. For example: "projects/foo/locations/us/keyRings/bar/cryptoKeys/baz". **Note:** Not supported for Apigee hybrid.
runtimeType?enumRequired. Runtime type of the Apigee organization based on the Apigee subscription purchased.
type?enumNot used by Apigee.
parent?stringRequired. Name of the Google Cloud project in which to associate the Apigee organization. Pass the information as a query parameter using the following structure in your request: `projects/`
createCreate a organizations
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a organizations
ArgumentTypeDescription
identifierstringThe name of the organizations
updateUpdate organizations attributes
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after update (default: true)
deleteDelete the organizations
ArgumentTypeDescription
identifierstringThe name of the organizations
syncSync organizations state from GCP
get_control_plane_accessget control plane access
get_deployed_ingress_configget deployed ingress config
get_project_mappingget project mapping
get_runtime_configget runtime config
get_security_settingsget security settings
get_sync_authorizationget sync authorization
set_addonsset addons
ArgumentTypeDescription
addonsConfig?any
set_sync_authorizationset sync authorization
ArgumentTypeDescription
etag?any
identities?any
update_control_plane_accessupdate control plane access
ArgumentTypeDescription
analyticsPublisherIdentities?any
name?any
synchronizerIdentities?any
update_security_settingsupdate security settings
ArgumentTypeDescription
mlRetrainingFeedbackEnabled?any
name?any
developers_subscriptions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
apiproduct?stringName of the API product for which the developer is purchasing a subscription.
endTime?stringTime when the API product subscription ends in milliseconds since epoch.
startTime?stringTime when the API product subscription starts in milliseconds since epoch.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a subscriptions
getGet a subscriptions
ArgumentTypeDescription
identifierstringThe name of the subscriptions
syncSync subscriptions state from GCP
expireexpire
securityprofiles.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
description?stringDescription of the security profile.
environments?arrayOutput only. Time at which environment was attached to the security profile.
name?stringImmutable. Name of the security profile resource. Format: organizations/{org}/securityProfiles/{profile}
profileConfig?objectChecks for abuse, which includes any requests sent to the API for purposes other than what it is intended for, such as high volumes of requests, data scraping, and abuse related to authorization.
scoringConfigs?arrayDescription of the config.
securityProfileId?stringRequired. The ID to use for the SecurityProfile, which will become the final component of the action\'s resource name. This value should be 1-63 characters and validated by "(^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$)".
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a securityProfiles
getGet a securityProfiles
ArgumentTypeDescription
identifierstringThe name of the securityProfiles
updateUpdate securityProfiles attributes
deleteDelete the securityProfiles
ArgumentTypeDescription
identifierstringThe name of the securityProfiles
syncSync securityProfiles state from GCP
list_revisionslist revisions
environments_traceconfig_overrides.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
apiProxy?stringID of the API proxy that will have its trace configuration overridden.
name?stringID of the trace configuration override specified as a system-generated UUID.
samplingConfig?objectSampler of distributed tracing. OFF is the default value.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a overrides
getGet a overrides
ArgumentTypeDescription
identifierstringThe name of the overrides
updateUpdate overrides attributes
deleteDelete the overrides
ArgumentTypeDescription
identifierstringThe name of the overrides
syncSync overrides state from GCP
spaces.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
displayName?stringOptional. Display name of the space.
spaceId?stringRequired. Resource ID of the space.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a spaces
getGet a spaces
ArgumentTypeDescription
identifierstringThe name of the spaces
updateUpdate spaces attributes
deleteDelete the spaces
ArgumentTypeDescription
identifierstringThe name of the spaces
syncSync spaces state from GCP
instances_nataddresses.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
name?stringRequired. Resource ID of the NAT address.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a natAddresses
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a natAddresses
ArgumentTypeDescription
identifierstringThe name of the natAddresses
deleteDelete the natAddresses
ArgumentTypeDescription
identifierstringThe name of the natAddresses
syncSync natAddresses state from GCP
activateactivate
apps.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a apps
ArgumentTypeDescription
identifierstringThe name of the apps
syncSync apps state from GCP
developers.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
accessType?stringAccess type.
appFamily?stringDeveloper app family.
apps?arrayList of apps associated with the developer.
attributes?arrayAPI key of the attribute.
companies?arrayList of companies associated with the developer.
developerId?stringID of the developer. **Note**: IDs are generated internally by Apigee and are not guaranteed to stay the same over time.
email?stringRequired. Email address of the developer. This value is used to uniquely identify the developer in Apigee hybrid. Note that the email address has to be in lowercase only.
firstName?stringRequired. First name of the developer.
lastName?stringRequired. Last name of the developer.
userName?stringRequired. User name of the developer. Not used by Apigee hybrid.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a developers
getGet a developers
ArgumentTypeDescription
identifierstringThe name of the developers
updateUpdate developers attributes
deleteDelete the developers
ArgumentTypeDescription
identifierstringThe name of the developers
syncSync developers state from GCP
attributesattributes
ArgumentTypeDescription
attribute?any
get_balanceget balance
get_monetization_configget monetization config
set_developer_statusset developer status
update_monetization_configupdate monetization config
ArgumentTypeDescription
billingType?any
environments_optimizedstats.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a optimizedStats
ArgumentTypeDescription
identifierstringThe name of the optimizedStats
syncSync optimizedStats state from GCP
securityprofilesv2.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
description?stringOptional. The description of the security profile.
name?stringIdentifier. Name of the security profile v2 resource. Format: organizations/{org}/securityProfilesV2/{profile}
profileAssessmentConfigs?recordRequired. The array of API Hub Gateway Types.
riskAssessmentType?enumOptional. The risk assessment type of the security profile. Defaults to ADVANCED_API_SECURITY.
securityProfileV2Id?stringRequired. The security profile id.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a securityProfilesV2
getGet a securityProfilesV2
ArgumentTypeDescription
identifierstringThe name of the securityProfilesV2
updateUpdate securityProfilesV2 attributes
deleteDelete the securityProfilesV2
ArgumentTypeDescription
identifierstringThe name of the securityProfilesV2
syncSync securityProfilesV2 state from GCP
sharedflows.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
contentType?stringThe HTTP Content-Type header value specifying the content type of the body.
data?stringThe HTTP request/response body as raw binary.
extensions?arrayApplication specific response metadata. Must be set in the first response for streaming APIs.
action?stringRequired. Must be set to either `import` or `validate`.
name?stringRequired. The name to give the shared flow
space?stringOptional. The ID of the space to associated with this shared flow. Any IAM policies applied to the space will affect access to this shared flow. Note that this field is only respected when creating a new shared flow. It has no effect when creating a new revision for an existing shared flow.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a sharedflows
getGet a sharedflows
ArgumentTypeDescription
identifierstringThe name of the sharedflows
deleteDelete the sharedflows
ArgumentTypeDescription
identifierstringThe name of the sharedflows
syncSync sharedflows state from GCP
movemove
ArgumentTypeDescription
space?any
apis.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
contentType?stringThe HTTP Content-Type header value specifying the content type of the body.
data?stringThe HTTP request/response body as raw binary.
extensions?arrayApplication specific response metadata. Must be set in the first response for streaming APIs.
apiProxyType?enumOutput only. The type of the API proxy.
labels?recordUser labels applied to this API Proxy.
latestRevisionId?stringOutput only. The id of the most recently created revision for this api proxy.
metaData?objectTime at which the API proxy was created, in milliseconds since epoch.
name?stringOutput only. Name of the API proxy.
readOnly?booleanOutput only. Whether this proxy is read-only. A read-only proxy cannot have new revisions created through calls to CreateApiProxyRevision. A proxy is read-only if it was generated by an archive.
revision?arrayOutput only. List of revisions defined for the API proxy.
space?stringOptional. The id of the space this proxy is associated with. Any IAM policies applied to the space will control access to this proxy. To learn how Spaces can be used to manage resources, read the [Apigee Spaces Overview](https://cloud.google.com/apigee/docs/api-platform/system-administration/spaces/apigee-spaces-overview).
action?stringAction to perform when importing an API proxy configuration bundle. Set this parameter to one of the following values: * `import` to import the API proxy configuration bundle. * `validate` to validate the API proxy configuration bundle without importing it.
validate?stringIgnored. All uploads are validated regardless of the value of this field. Maintained for compatibility with Apigee Edge API.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a apis
getGet a apis
ArgumentTypeDescription
identifierstringThe name of the apis
updateUpdate apis attributes
deleteDelete the apis
ArgumentTypeDescription
identifierstringThe name of the apis
syncSync apis state from GCP
movemove
ArgumentTypeDescription
space?any
deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
hostqueries.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
csvDelimiter?stringDelimiter used in the CSV file, if `outputFormat` is set to `csv`. Defaults to the `,` (comma) character. Supported delimiter characters include comma (`,`), pipe (`|`), and tab (`\\t`).
dimensions?arrayA list of dimensions. https://docs.apigee.com/api-platform/analytics/analytics-reference#dimensions
envgroupHostname?stringHostname needs to be specified if query intends to run at host level. This field is only allowed when query is submitted by CreateHostAsyncQuery where analytics data will be grouped by organization and hostname.
filter?stringBoolean expression that can be used to filter data. Filter expressions can be combined using AND/OR terms and should be fully parenthesized to avoid ambiguity. See Analytics metrics, dimensions, and filters reference https://docs.apigee.com/api-platform/analytics/analytics-reference for more information on the fields available to filter on. For more information on the tokens that you use to build filter expressions, see Filter expression syntax. https://docs.apigee.com/api-platform/analytics/asynch-reports-api#filter-expression-syntax
groupByTimeUnit?stringTime unit used to group the result set. Valid values include: second, minute, hour, day, week, or month. If a query includes groupByTimeUnit, then the result is an aggregation based on the specified time unit and the resultant timestamp does not include milliseconds precision. If a query omits groupByTimeUnit, then the resultant timestamp includes milliseconds precision.
limit?numberMaximum number of rows that can be returned in the result.
metrics?arrayAlias for the metric. Alias will be used to replace metric name in query results.
name?stringAsynchronous Query Name.
outputFormat?stringValid values include: `csv` or `json`. Defaults to `json`. Note: Configure the delimiter for CSV output using the csvDelimiter property.
reportDefinitionId?stringAsynchronous Report ID.
timeRange?stringRequired. Time range for the query. Can use the following predefined strings to specify the time range: `last60minutes` `last24hours` `last7days` Or, specify the timeRange as a structure describing start and end timestamps in the ISO format: yyyy-mm-ddThh:mm:ssZ. Example: "timeRange": { "start": "2018-07-29T00:13:00Z", "end": "2018-08-01T00:18:00Z" }
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a hostQueries
getGet a hostQueries
ArgumentTypeDescription
identifierstringThe name of the hostQueries
syncSync hostQueries state from GCP
get_resultget result
get_result_viewget result view
datacollectors.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
description?stringA description of the data collector.
name?stringID of the data collector. Must begin with `dc_`.
type?enumImmutable. The type of data this data collector will collect.
dataCollectorId?stringID of the data collector. Overrides any ID in the data collector resource. Must be a string beginning with `dc_` that contains only letters, numbers, and underscores.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a datacollectors
getGet a datacollectors
ArgumentTypeDescription
identifierstringThe name of the datacollectors
updateUpdate datacollectors attributes
deleteDelete the datacollectors
ArgumentTypeDescription
identifierstringThe name of the datacollectors
syncSync datacollectors state from GCP
environments_securityreports.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
csvDelimiter?stringDelimiter used in the CSV file, if `outputFormat` is set to `csv`. Defaults to the `,` (comma) character. Supported delimiter characters include comma (`,`), pipe (`|`), and tab (`\\t`).
dimensions?arrayA list of dimensions. https://docs.apigee.com/api-platform/analytics/analytics-reference#dimensions
displayName?stringSecurity Report display name which users can specify.
envgroupHostname?stringHostname needs to be specified if query intends to run at host level. This field is only allowed when query is submitted by CreateHostSecurityReport where analytics data will be grouped by organization and hostname.
filter?stringBoolean expression that can be used to filter data. Filter expressions can be combined using AND/OR terms and should be fully parenthesized to avoid ambiguity. See Analytics metrics, dimensions, and filters reference https://docs.apigee.com/api-platform/analytics/analytics-reference for more information on the fields available to filter on. For more information on the tokens that you use to build filter expressions, see Filter expression syntax. https://docs.apigee.com/api-platform/analytics/asynch-reports-api#filter-expression-syntax
groupByTimeUnit?stringTime unit used to group the result set. Valid values include: second, minute, hour, day, week, or month. If a query includes groupByTimeUnit, then the result is an aggregation based on the specified time unit and the resultant timestamp does not include milliseconds precision. If a query omits groupByTimeUnit, then the resultant timestamp includes milliseconds precision.
limit?numberMaximum number of rows that can be returned in the result.
metrics?arrayAggregation function: avg, min, max, or sum.
mimeType?stringValid values include: `csv` or `json`. Defaults to `json`. Note: Configure the delimiter for CSV output using the csvDelimiter property.
reportDefinitionId?stringReport Definition ID.
timeRange?stringRequired. Time range for the query. Can use the following predefined strings to specify the time range: `last60minutes` `last24hours` `last7days` Or, specify the timeRange as a structure describing start and end timestamps in the ISO format: yyyy-mm-ddThh:mm:ssZ. Example: "timeRange": { "start": "2018-07-29T00:13:00Z", "end": "2018-08-01T00:18:00Z" }
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a securityReports
getGet a securityReports
ArgumentTypeDescription
identifierstringThe name of the securityReports
syncSync securityReports state from GCP
get_resultget result
get_result_viewget result view
appgroups.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
attributes?arrayAPI key of the attribute.
channelId?stringchannel identifier identifies the owner maintaing this grouping.
channelUri?stringA reference to the associated storefront/marketplace.
displayName?stringapp group name displayed in the UI
email?stringOptional. Email of the AppGroup.
name?stringImmutable. Name of the AppGroup. Characters you can use in the name are restricted to: A-Z0-9._\\-$ %.
organization?stringImmutable. the org the app group is created
status?stringValid values are `active` or `inactive`. Note that the status of the AppGroup should be updated via UpdateAppGroupRequest by setting the action as `active` or `inactive`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a appgroups
getGet a appgroups
ArgumentTypeDescription
identifierstringThe name of the appgroups
updateUpdate appgroups attributes
deleteDelete the appgroups
ArgumentTypeDescription
identifierstringThe name of the appgroups
syncSync appgroups state from GCP
get_balanceget balance
get_monetization_configget monetization config
update_monetization_configupdate monetization config
ArgumentTypeDescription
billingType?any
securitymonitoringconditions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
apiHubGateway?stringOptional. The API Hub gateway monitored by the security monitoring condition. This should only be set if risk_assessment_type is API_HUB. Format: `projects/{project}/locations/{location}/plugins/{plugin}/instances/{instance}`
include?objectRequired. Name of this resource. For an Apigee API Proxy, this should be the id of the API proxy. For an API Hub Deployment, this should be the id of the deployment.
includeAllResources?objectMessage for include_all_resources option.
name?stringIdentifier. Name of the security monitoring condition resource. Format: organizations/{org}/securityMonitoringConditions/{security_monitoring_condition}
profile?stringRequired. ID of security profile of the security monitoring condition.
riskAssessmentType?enumOptional. The risk assessment type of the security monitoring condition. Defaults to ADVANCED_API_SECURITY.
scope?stringOptional. Scope of the security monitoring condition. When RiskAssessmentType is APIGEE, the scope should be set to the environment of the resources. When RiskAssessmentType is API_HUB, the scope should not be set.
securityMonitoringConditionId?stringOptional. Optional: The security monitoring condition id. If not specified, a monitoring condition uuid will be generated by the backend. This value should be 4-63 characters, and valid characters are /a-z-/.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a securityMonitoringConditions
getGet a securityMonitoringConditions
ArgumentTypeDescription
identifierstringThe name of the securityMonitoringConditions
updateUpdate securityMonitoringConditions attributes
deleteDelete the securityMonitoringConditions
ArgumentTypeDescription
identifierstringThe name of the securityMonitoringConditions
syncSync securityMonitoringConditions state from GCP
environments_keyvaluemaps.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
encrypted?booleanRequired. Flag that specifies whether entry values will be encrypted. This field is retained for backward compatibility and the value of encrypted will always be `true`. Apigee X and hybrid do not support unencrypted key value maps.
maskedValues?booleanOptional. Flag that specifies whether entry values will be masked when returned.
name?stringRequired. ID of the key value map.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a keyvaluemaps
getGet a keyvaluemaps
ArgumentTypeDescription
identifierstringThe name of the keyvaluemaps
updateUpdate keyvaluemaps attributes
deleteDelete the keyvaluemaps
ArgumentTypeDescription
identifierstringThe name of the keyvaluemaps
syncSync keyvaluemaps state from GCP
apis_revisions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a revisions
ArgumentTypeDescription
identifierstringThe name of the revisions
deleteDelete the revisions
ArgumentTypeDescription
identifierstringThe name of the revisions
syncSync revisions state from GCP
update_api_proxy_revisionupdate api proxy revision
ArgumentTypeDescription
contentType?any
data?any
extensions?any
environments_apis_deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
appgroups_subscriptions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
apiproduct?stringRequired. Name of the API product for which the appgroup is purchasing a subscription.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a subscriptions
getGet a subscriptions
ArgumentTypeDescription
identifierstringThe name of the subscriptions
syncSync subscriptions state from GCP
expireexpire
hybrid_issuers.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a issuers
ArgumentTypeDescription
identifierstringThe name of the issuers
syncSync issuers state from GCP
keyvaluemaps_entries.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
name?stringResource URI that can be used to identify the scope of the key value map entries.
value?stringRequired. Data or payload that is being retrieved and associated with the unique key.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a entries
getGet a entries
ArgumentTypeDescription
identifierstringThe name of the entries
updateUpdate entries attributes
deleteDelete the entries
ArgumentTypeDescription
identifierstringThe name of the entries
syncSync entries state from GCP
environments_sharedflows_deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
apis_deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
environments_resourcefiles.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
contentType?stringThe HTTP Content-Type header value specifying the content type of the body.
data?stringThe HTTP request/response body as raw binary.
extensions?arrayApplication specific response metadata. Must be set in the first response for streaming APIs.
name?stringRequired. Name of the resource file. Must match the regular expression: [a-zA-Z0-9:/\\\\!@#$%^&{}\\[\\]()+\\-=,.~'` ]{1,255}
type?stringRequired. Resource file type. {{ resource_file_type }}
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a resourcefiles
getGet a resourcefiles
ArgumentTypeDescription
identifierstringThe name of the resourcefiles
updateUpdate resourcefiles attributes
deleteDelete the resourcefiles
ArgumentTypeDescription
identifierstringThe name of the resourcefiles
syncSync resourcefiles state from GCP
list_environment_resourceslist environment resources
developers_apps_attributes.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a attributes
ArgumentTypeDescription
identifierstringThe name of the attributes
deleteDelete the attributes
ArgumentTypeDescription
identifierstringThe name of the attributes
syncSync attributes state from GCP
update_developer_app_attributeupdate developer app attribute
ArgumentTypeDescription
name?any
value?any
environments_apis_revisions_debugsessions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
count?numberOptional. The number of request to be traced. Min = 1, Max = 15, Default = 10.
filter?stringOptional. A conditional statement which is evaluated against the request message to determine if it should be traced. Syntax matches that of on API Proxy bundle flow Condition.
name?stringA unique ID for this DebugSession.
timeout?stringOptional. The time in seconds after which this DebugSession should end. This value will override the value in query param, if both are provided.
tracesize?numberOptional. The maximum number of bytes captured from the response payload. Min = 0, Max = 5120, Default = 5120.
validity?numberOptional. The length of time, in seconds, that this debug session is valid, starting from when it's received in the control plane. Min = 1, Max = 15, Default = 10.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a debugsessions
getGet a debugsessions
ArgumentTypeDescription
identifierstringThe name of the debugsessions
deleteDelete the debugsessions
ArgumentTypeDescription
identifierstringThe name of the debugsessions
syncSync debugsessions state from GCP
apiproducts_rateplans.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
apiproduct?stringName of the API product that the rate plan is associated with.
billingPeriod?enumFrequency at which the customer will be billed.
consumptionPricingRates?arrayEnding value of the range. Set to 0 or `null` for the last range of values.
createCreate a rateplans
getGet a rateplans
ArgumentTypeDescription
identifierstringThe name of the rateplans
updateUpdate rateplans attributes
deleteDelete the rateplans
ArgumentTypeDescription
identifierstringThe name of the rateplans
syncSync rateplans state from GCP
environments_analytics_exports.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
csvDelimiter?stringOptional. Delimiter used in the CSV file, if `outputFormat` is set to `csv`. Defaults to the `,` (comma) character. Supported delimiter characters include comma (`,`), pipe (`|`), and tab (`\\t`).
datastoreName?stringRequired. Name of the preconfigured datastore.
dateRange?objectRequired. End date (exclusive) of the data to export in the format `yyyy-mm-dd`. The date range ends at 00:00:00 UTC on the end date- which will not be in the output.
description?stringOptional. Description of the export job.
name?stringRequired. Display name of the export job.
outputFormat?stringOptional. Output format of the export. Valid values include: `csv` or `json`. Defaults to `json`. Note: Configure the delimiter for CSV output using the `csvDelimiter` property.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a exports
getGet a exports
ArgumentTypeDescription
identifierstringThe name of the exports
syncSync exports state from GCP
environments_queries.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
csvDelimiter?stringDelimiter used in the CSV file, if `outputFormat` is set to `csv`. Defaults to the `,` (comma) character. Supported delimiter characters include comma (`,`), pipe (`|`), and tab (`\\t`).
dimensions?arrayA list of dimensions. https://docs.apigee.com/api-platform/analytics/analytics-reference#dimensions
envgroupHostname?stringHostname needs to be specified if query intends to run at host level. This field is only allowed when query is submitted by CreateHostAsyncQuery where analytics data will be grouped by organization and hostname.
filter?stringBoolean expression that can be used to filter data. Filter expressions can be combined using AND/OR terms and should be fully parenthesized to avoid ambiguity. See Analytics metrics, dimensions, and filters reference https://docs.apigee.com/api-platform/analytics/analytics-reference for more information on the fields available to filter on. For more information on the tokens that you use to build filter expressions, see Filter expression syntax. https://docs.apigee.com/api-platform/analytics/asynch-reports-api#filter-expression-syntax
groupByTimeUnit?stringTime unit used to group the result set. Valid values include: second, minute, hour, day, week, or month. If a query includes groupByTimeUnit, then the result is an aggregation based on the specified time unit and the resultant timestamp does not include milliseconds precision. If a query omits groupByTimeUnit, then the resultant timestamp includes milliseconds precision.
limit?numberMaximum number of rows that can be returned in the result.
metrics?arrayAlias for the metric. Alias will be used to replace metric name in query results.
name?stringAsynchronous Query Name.
outputFormat?stringValid values include: `csv` or `json`. Defaults to `json`. Note: Configure the delimiter for CSV output using the csvDelimiter property.
reportDefinitionId?stringAsynchronous Report ID.
timeRange?stringRequired. Time range for the query. Can use the following predefined strings to specify the time range: `last60minutes` `last24hours` `last7days` Or, specify the timeRange as a structure describing start and end timestamps in the ISO format: yyyy-mm-ddThh:mm:ssZ. Example: "timeRange": { "start": "2018-07-29T00:13:00Z", "end": "2018-08-01T00:18:00Z" }
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a queries
getGet a queries
ArgumentTypeDescription
identifierstringThe name of the queries
syncSync queries state from GCP
get_resultget result
get_resulturlget resulturl
apis_revisions_deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
sharedflows_deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
environments_stats.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a stats
ArgumentTypeDescription
identifierstringThe name of the stats
syncSync stats state from GCP
sites_apicategories.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
id?stringID of the category (a UUID).
name?stringName of the category.
siteId?stringName of the portal.
updateTime?stringTime the category was last modified in milliseconds since epoch.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a apicategories
getGet a apicategories
ArgumentTypeDescription
identifierstringThe name of the apicategories
updateUpdate apicategories attributes
deleteDelete the apicategories
ArgumentTypeDescription
identifierstringThe name of the apicategories
syncSync apicategories state from GCP
appgroups_apps.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
apiProducts?arrayList of API products associated with the AppGroup app.
appGroup?stringImmutable. Name of the parent AppGroup whose resource name format is of syntax (organizations/*/appgroups/*).
appId?stringImmutable. ID of the AppGroup app.
attributes?arrayAPI key of the attribute.
callbackUrl?stringCallback URL used by OAuth 2.0 authorization servers to communicate authorization codes back to AppGroup apps.
keyExpiresIn?stringImmutable. Expiration time, in seconds, for the consumer key that is generated for the AppGroup app. If not set or left to the default value of `-1`, the API key never expires. The expiration time can't be updated after it is set.
name?stringImmutable. Name of the AppGroup app whose resource name format is of syntax (organizations/*/appgroups/*/apps/*).
scopes?arrayScopes to apply to the AppGroup app. The specified scopes must already exist for the API product that you associate with the AppGroup app.
status?stringStatus of the App. Valid values include `approved` or `revoked`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a apps
getGet a apps
ArgumentTypeDescription
identifierstringThe name of the apps
updateUpdate apps attributes
deleteDelete the apps
ArgumentTypeDescription
identifierstringThe name of the apps
syncSync apps state from GCP
hoststats.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a hostStats
ArgumentTypeDescription
identifierstringThe name of the hostStats
syncSync hostStats state from GCP
envgroups.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
hostnames?arrayRequired. Host names for this environment group.
name?stringID of the environment group.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a envgroups
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a envgroups
ArgumentTypeDescription
identifierstringThe name of the envgroups
updateUpdate envgroups attributes
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after update (default: true)
deleteDelete the envgroups
ArgumentTypeDescription
identifierstringThe name of the envgroups
syncSync envgroups state from GCP
get_deployed_ingress_configget deployed ingress config
instances_attachments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
environment?stringID of the attached environment.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a attachments
getGet a attachments
ArgumentTypeDescription
identifierstringThe name of the attachments
deleteDelete the attachments
ArgumentTypeDescription
identifierstringThe name of the attachments
syncSync attachments state from GCP
environments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
apiProxyType?enumOptional. API Proxy type supported by the environment. The type can be set when creating the Environment and cannot be changed.
clientIpResolutionConfig?objectRequired. The index of the ip in the header. Positive indices 0, 1, 2, 3 chooses indices from the left (first ips) Negative indices -1, -2, -3 chooses indices from the right (last ips)
deploymentType?enumOptional. Deployment type supported by the environment. The deployment type can be set when creating the environment and cannot be changed. When you enable archive deployment, you will be **prevented from performing** a [subset of actions](/apigee/docs/api-platform/local-development/overview#prevented-actions) within the environment, including: * Managing the deployment of API proxy or shared flow revisions * Creating, updating, or deleting resource files * Creating, updating, or deleting target servers
description?stringOptional. Description of the environment.
displayName?stringOptional. Display name for this environment.
forwardProxyUri?stringOptional. URI of the forward proxy to be applied to the runtime instances in this environment. Must be in the format of {scheme}://{hostname}:{port}. Note that the only supported scheme is "http". The port must be supplied. To remove a forward proxy setting, update the field to an empty value. Note: At this time, PUT operations to add forwardProxyUri to an existing environment fail if the environment has nodeConfig set up. To successfully add the forwardProxyUri setting in this case, include the NodeConfig details with the request.
hasAttachedFlowHooks?boolean
name?stringRequired. Name of the environment. Values must match the regular expression `^[.\\\\p{Alnum}-_]{1,255}$`
nodeConfig?objectOutput only. The current total number of gateway nodes that each environment currently has across all instances.
properties?objectThe property key
type?enumOptional. EnvironmentType selected for the environment.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a environments
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a environments
ArgumentTypeDescription
identifierstringThe name of the environments
updateUpdate environments attributes
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after update (default: true)
deleteDelete the environments
ArgumentTypeDescription
identifierstringThe name of the environments
syncSync environments state from GCP
get_addons_configget addons config
get_api_security_runtime_configget api security runtime config
get_debugmaskget debugmask
get_deployed_configget deployed config
get_security_actions_configget security actions config
get_trace_configget trace config
modify_environmentmodify environment
ArgumentTypeDescription
apiProxyType?any
clientIpResolutionConfig?any
createdAt?any
deploymentType?any
description?any
displayName?any
forwardProxyUri?any
hasAttachedFlowHooks?any
lastModifiedAt?any
name?any
nodeConfig?any
properties?any
state?any
type?any
subscribesubscribe
unsubscribeunsubscribe
ArgumentTypeDescription
name?any
update_debugmaskupdate debugmask
ArgumentTypeDescription
faultJSONPaths?any
faultXPaths?any
name?any
namespaces?any
requestJSONPaths?any
requestXPaths?any
responseJSONPaths?any
responseXPaths?any
variables?any
update_environmentupdate environment
ArgumentTypeDescription
apiProxyType?any
clientIpResolutionConfig?any
createdAt?any
deploymentType?any
description?any
displayName?any
forwardProxyUri?any
hasAttachedFlowHooks?any
lastModifiedAt?any
name?any
nodeConfig?any
properties?any
state?any
type?any
update_security_actions_configupdate security actions config
ArgumentTypeDescription
enabled?any
name?any
updateTime?any
update_trace_configupdate trace config
ArgumentTypeDescription
endpoint?any
exporter?any
samplingConfig?any
hostsecurityreports.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
csvDelimiter?stringDelimiter used in the CSV file, if `outputFormat` is set to `csv`. Defaults to the `,` (comma) character. Supported delimiter characters include comma (`,`), pipe (`|`), and tab (`\\t`).
dimensions?arrayA list of dimensions. https://docs.apigee.com/api-platform/analytics/analytics-reference#dimensions
displayName?stringSecurity Report display name which users can specify.
envgroupHostname?stringHostname needs to be specified if query intends to run at host level. This field is only allowed when query is submitted by CreateHostSecurityReport where analytics data will be grouped by organization and hostname.
filter?stringBoolean expression that can be used to filter data. Filter expressions can be combined using AND/OR terms and should be fully parenthesized to avoid ambiguity. See Analytics metrics, dimensions, and filters reference https://docs.apigee.com/api-platform/analytics/analytics-reference for more information on the fields available to filter on. For more information on the tokens that you use to build filter expressions, see Filter expression syntax. https://docs.apigee.com/api-platform/analytics/asynch-reports-api#filter-expression-syntax
groupByTimeUnit?stringTime unit used to group the result set. Valid values include: second, minute, hour, day, week, or month. If a query includes groupByTimeUnit, then the result is an aggregation based on the specified time unit and the resultant timestamp does not include milliseconds precision. If a query omits groupByTimeUnit, then the resultant timestamp includes milliseconds precision.
limit?numberMaximum number of rows that can be returned in the result.
metrics?arrayAggregation function: avg, min, max, or sum.
mimeType?stringValid values include: `csv` or `json`. Defaults to `json`. Note: Configure the delimiter for CSV output using the csvDelimiter property.
reportDefinitionId?stringReport Definition ID.
timeRange?stringRequired. Time range for the query. Can use the following predefined strings to specify the time range: `last60minutes` `last24hours` `last7days` Or, specify the timeRange as a structure describing start and end timestamps in the ISO format: yyyy-mm-ddThh:mm:ssZ. Example: "timeRange": { "start": "2018-07-29T00:13:00Z", "end": "2018-08-01T00:18:00Z" }
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a hostSecurityReports
getGet a hostSecurityReports
ArgumentTypeDescription
identifierstringThe name of the hostSecurityReports
syncSync hostSecurityReports state from GCP
get_resultget result
get_result_viewget result view
envgroups_attachments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
environment?stringRequired. ID of the attached environment.
name?stringID of the environment group attachment.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a attachments
getGet a attachments
ArgumentTypeDescription
identifierstringThe name of the attachments
deleteDelete the attachments
ArgumentTypeDescription
identifierstringThe name of the attachments
syncSync attachments state from GCP
environments_keystores.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
name?stringRequired. Resource ID for this keystore. Values must match the regular expression `[\\w[:space:].-]{1,255}`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a keystores
getGet a keystores
ArgumentTypeDescription
identifierstringThe name of the keystores
deleteDelete the keystores
ArgumentTypeDescription
identifierstringThe name of the keystores
syncSync keystores state from GCP
developers_apps_keys.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
apiProducts?arrayList of API products for which the credential can be used. **Note**: Do not specify the list of API products when creating a consumer key and secret for a developer app. Instead, use the UpdateDeveloperAppKey API to make the association after the consumer key and secret are created.
attributes?arrayAPI key of the attribute.
consumerKey?stringConsumer key.
consumerSecret?stringSecret key.
expiresAt?stringTime the developer app expires in milliseconds since epoch.
expiresInSeconds?stringInput only. Expiration time, in seconds, for the consumer key. If not set or left to the default value of `-1`, the API key never expires. The expiration time can't be updated after it is set.
issuedAt?stringTime the developer app was created in milliseconds since epoch.
scopes?arrayScopes to apply to the app. The specified scope names must already be defined for the API product that you associate with the app.
status?stringStatus of the credential. Valid values include `approved` or `revoked`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a keys
getGet a keys
ArgumentTypeDescription
identifierstringThe name of the keys
deleteDelete the keys
ArgumentTypeDescription
identifierstringThe name of the keys
syncSync keys state from GCP
replace_developer_app_keyreplace developer app key
ArgumentTypeDescription
apiProducts?any
attributes?any
consumerKey?any
consumerSecret?any
expiresAt?any
expiresInSeconds?any
issuedAt?any
scopes?any
status?any
update_developer_app_keyupdate developer app key
ArgumentTypeDescription
apiProducts?any
attributes?any
consumerKey?any
consumerSecret?any
expiresAt?any
expiresInSeconds?any
issuedAt?any
scopes?any
status?any
analytics_datastores.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
datastoreConfig?objectName of the Cloud Storage bucket. Required for `gcs` target_type.
displayName?stringRequired. Display name in UI
targetType?stringDestination storage type. Supported types `gcs` or `bigquery`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a datastores
getGet a datastores
ArgumentTypeDescription
identifierstringThe name of the datastores
updateUpdate datastores attributes
deleteDelete the datastores
ArgumentTypeDescription
identifierstringThe name of the datastores
syncSync datastores state from GCP
testtest
ArgumentTypeDescription
createTime?any
datastoreConfig?any
displayName?any
lastUpdateTime?any
org?any
self?any
targetType?any
environments_references.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
description?stringOptional. A human-readable description of this reference.
name?stringRequired. The resource id of this reference. Values must match the regular expression [\\w\\s\\-.]+.
refers?stringRequired. The id of the resource to which this reference refers. Must be the id of a resource that exists in the parent environment and is of the given resource_type.
resourceType?stringThe type of resource referred to by this reference. Valid values are 'KeyStore' or 'TrustStore'.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a references
getGet a references
ArgumentTypeDescription
identifierstringThe name of the references
updateUpdate references attributes
deleteDelete the references
ArgumentTypeDescription
identifierstringThe name of the references
syncSync references state from GCP
endpointattachments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
location?stringRequired. Location of the endpoint attachment.
name?stringName of the endpoint attachment. Use the following structure in your request: `organizations/{org}/endpointAttachments/{endpoint_attachment}`
serviceAttachment?stringFormat: projects/*/regions/*/serviceAttachments/*
endpointAttachmentId?stringID to use for the endpoint attachment. ID must start with a lowercase letter followed by up to 31 lowercase letters, numbers, or hyphens, and cannot end with a hyphen. The minimum length is 2.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a endpointAttachments
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a endpointAttachments
ArgumentTypeDescription
identifierstringThe name of the endpointAttachments
deleteDelete the endpointAttachments
ArgumentTypeDescription
identifierstringThe name of the endpointAttachments
syncSync endpointAttachments state from GCP
appgroups_apps_keys.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
attributes?arrayAPI key of the attribute.
consumerKey?stringImmutable. Consumer key.
consumerSecret?stringSecret key.
expiresInSeconds?stringImmutable. Expiration time, in seconds, for the consumer key. If not set or left to the default value of `-1`, the API key never expires. The expiration time can't be updated after it is set.
scopes?arrayScopes to apply to the app. The specified scope names must already be defined for the API product that you associate with the app.
status?stringStatus of the credential. Valid values include `approved` or `revoked`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a keys
getGet a keys
ArgumentTypeDescription
identifierstringThe name of the keys
deleteDelete the keys
ArgumentTypeDescription
identifierstringThe name of the keys
syncSync keys state from GCP
update_app_group_app_keyupdate app group app key
ArgumentTypeDescription
action?any
apiProducts?any
appGroupAppKey?any
sharedflows_revisions_deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
dnszones.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
description?stringRequired. Description of the resource. String of at most 1024 characters associated with this resource for the user's convenience.
domain?stringRequired. The domain name for hosts in this private zone, for instance "example.com.".
name?stringIdentifier. Unique name for the resource. Defined by the server Format: "organizations/{organization}/dnsZones/{dns_zone}".
peeringConfig?objectRequired. The VPC network where the records for that private DNS zone's namespace are available. Apigee will be performing DNS peering with this VPC network.
dnsZoneId?stringRequired. User assigned ID for this resource. Must be unique within the organization. The name must be 1-63 characters long, must begin with a letter, end with a letter or digit, and only contain lowercase letters, digits or dashes.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a dnsZones
ArgumentTypeDescription
waitForReady?booleanWait for the resource to reach a ready state after creation (default: true)
getGet a dnsZones
ArgumentTypeDescription
identifierstringThe name of the dnsZones
deleteDelete the dnsZones
ArgumentTypeDescription
identifierstringThe name of the dnsZones
syncSync dnsZones state from GCP
environments_flowhooks.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a flowhooks
ArgumentTypeDescription
identifierstringThe name of the flowhooks
syncSync flowhooks state from GCP
attach_shared_flow_to_flow_hookattach shared flow to flow hook
ArgumentTypeDescription
continueOnError?any
description?any
flowHookPoint?any
sharedFlow?any
detach_shared_flow_from_flow_hookdetach shared flow from flow hook
apiproducts.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
apiResources?arrayComma-separated list of API resources to be bundled in the API product. By default, the resource paths are mapped from the `proxy.pathsuffix` variable. The proxy path suffix is defined as the URI fragment following the ProxyEndpoint base path. For example, if the `apiResources` element is defined to be `/forecastrss` and the base path defined for the API proxy is `/weather`, then only requests to `/weather/forecastrss` are permitted by the API product. You can select a specific path, or you can select all subpaths with the following wildcard: - `/**`: Indicates that all sub-URIs are included. - `/*`: Indicates that only URIs one level down are included. By default, / supports the same resources as /** as well as the base path defined by the API proxy. For example, if the base path of the API proxy is `/v1/weatherapikey`, then the API product supports requests to `/v1/weatherapikey` and to any sub-URIs, such as `/v1/weatherapikey/forecastrss`, `/v1/weatherapikey/region/CA`, and so on. For more information, see Managing API products.
approvalType?stringFlag that specifies how API keys are approved to access the APIs defined by the API product. If set to `manual`, the consumer key is generated and returned in "pending" state. In this case, the API keys won\'t work until they have been explicitly approved. If set to `auto`, the consumer key is generated and returned in "approved" state and can be used immediately. **Note:** Typically, `auto` is used to provide access to free or trial API products that provide limited quota or capabilities.
attributes?arrayAPI key of the attribute.
createdAt?stringResponse only. Creation time of this environment as milliseconds since epoch.
description?stringDescription of the API product. Include key information about the API product that is not captured by other fields.
displayName?stringName displayed in the UI or developer portal to developers registering for API access.
environments?arrayComma-separated list of environment names to which the API product is bound. Requests to environments that are not listed are rejected. By specifying one or more environments, you can bind the resources listed in the API product to a specific environment, preventing developers from accessing those resources through API proxies deployed in another environment. This setting is used, for example, to prevent resources associated with API proxies in `prod` from being accessed by API proxies deployed in `test`.
graphqlOperationGroup?objectFlag that specifies whether the configuration is for Apigee API proxy or a remote service. Valid values include `proxy` or `remoteservice`. Defaults to `proxy`. Set to `proxy` when Apigee API proxies are associated with the API product. Set to `remoteservice` when non-Apigee proxies like Istio-Envoy are associated with the API product.
grpcOperationGroup?objectRequired. Name of the API proxy with which the gRPC operation and quota are associated.
lastModifiedAt?stringResponse only. Modified time of this environment as milliseconds since epoch.
llmOperationGroup?objectRequired. Name of the API proxy or remote service with which the resources, methods, and quota are associated.
llmQuota?stringOptional. Number of LLM tokens permitted per app by this API product for the specified `llm_quota_interval` and `llm_quota_time_unit`. For example, an `llm_quota` of 50,000, for an `llm_quota_interval` of 12 and an `llm_quota_time_unit` of hours means 50,000 llm tokens are allowed to be used every 12 hours.
llmQuotaInterval?stringOptional. Time interval over which the number of tokens from LLM responses is calculated.
llmQuotaTimeUnit?stringOptional. Time unit defined for the `llm_quota_interval`. Valid values include `minute`, `hour`, `day`, or `month`.
name?stringInternal name of the API product. Characters you can use in the name are restricted to: `A-Z0-9._\\-$ %`. **Note:** The internal name cannot be edited when updating the API product.
operationGroup?objectFlag that specifes whether the configuration is for Apigee API proxy or a remote service. Valid values include `proxy` or `remoteservice`. Defaults to `proxy`. Set to `proxy` when Apigee API proxies are associated with the API product. Set to `remoteservice` when non-Apigee proxies like Istio-Envoy are associated with the API product.
proxies?arrayComma-separated list of API proxy names to which this API product is bound. By specifying API proxies, you can associate resources in the API product with specific API proxies, preventing developers from accessing those resources through other API proxies. Apigee rejects requests to API proxies that are not listed. **Note:** The API proxy names must already exist in the specified environment as they will be validated upon creation.
quota?stringNumber of request messages permitted per app by this API product for the specified `quotaInterval` and `quotaTimeUnit`. For example, a `quota` of 50, for a `quotaInterval` of 12 and a `quotaTimeUnit` of hours means 50 requests are allowed every 12 hours.
quotaCounterScope?enumScope of the quota decides how the quota counter gets applied and evaluate for quota violation. If the Scope is set as PROXY, then all the operations defined for the APIproduct that are associated with the same proxy will share the same quota counter set at the APIproduct level, making it a global counter at a proxy level. If the Scope is set as OPERATION, then each operations get the counter set at the API product dedicated, making it a local counter. Note that, the QuotaCounterScope applies only when an operation does not have dedicated quota set for itself.
quotaInterval?stringTime interval over which the number of request messages is calculated.
quotaTimeUnit?stringTime unit defined for the `quotaInterval`. Valid values include `minute`, `hour`, `day`, or `month`.
scopes?arrayComma-separated list of OAuth scopes that are validated at runtime. Apigee validates that the scopes in any access token presented match the scopes defined in the OAuth policy associated with the API product.
space?stringOptional. The resource ID of the parent Space. If not set, the parent resource will be the Organization. To learn how Spaces can be used to manage resources, read the [Apigee Spaces Overview](https://cloud.google.com/apigee/docs/api-platform/system-administration/spaces/apigee-spaces-overview).
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a apiproducts
getGet a apiproducts
ArgumentTypeDescription
identifierstringThe name of the apiproducts
updateUpdate apiproducts attributes
deleteDelete the apiproducts
ArgumentTypeDescription
identifierstringThe name of the apiproducts
syncSync apiproducts state from GCP
attributesattributes
ArgumentTypeDescription
attribute?any
movemove
ArgumentTypeDescription
space?any
developers_apps.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
apiProducts?arrayList of API products associated with the developer app.
appFamily?stringDeveloper app family.
appId?stringID of the developer app. This ID is not user specified but is automatically generated on app creation. appId is a UUID.
attributes?arrayAPI key of the attribute.
callbackUrl?stringCallback URL used by OAuth 2.0 authorization servers to communicate authorization codes back to developer apps.
developerId?stringID of the developer.
keyExpiresIn?stringExpiration time, in milliseconds, for the consumer key that is generated for the developer app. If not set or left to the default value of `-1`, the API key never expires. The expiration time can't be updated after it is set.
name?stringName of the developer app.
scopes?arrayScopes to apply to the developer app. The specified scopes must already exist for the API product that you associate with the developer app.
status?stringStatus of the credential. Valid values include `approved` or `revoked`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a apps
getGet a apps
ArgumentTypeDescription
identifierstringThe name of the apps
updateUpdate apps attributes
deleteDelete the apps
ArgumentTypeDescription
identifierstringThe name of the apps
syncSync apps state from GCP
attributesattributes
ArgumentTypeDescription
attribute?any
generate_key_pair_or_update_developer_app_statusgenerate key pair or update developer app status
ArgumentTypeDescription
apiProducts?any
appFamily?any
appId?any
attributes?any
callbackUrl?any
createdAt?any
credentials?any
developerId?any
keyExpiresIn?any
lastModifiedAt?any
name?any
scopes?any
status?any
apis_keyvaluemaps_entries.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
name?stringResource URI that can be used to identify the scope of the key value map entries.
value?stringRequired. Data or payload that is being retrieved and associated with the unique key.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a entries
getGet a entries
ArgumentTypeDescription
identifierstringThe name of the entries
updateUpdate entries attributes
deleteDelete the entries
ArgumentTypeDescription
identifierstringThe name of the entries
syncSync entries state from GCP
sharedflows_revisions.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
getGet a revisions
ArgumentTypeDescription
identifierstringThe name of the revisions
deleteDelete the revisions
ArgumentTypeDescription
identifierstringThe name of the revisions
syncSync revisions state from GCP
update_shared_flow_revisionupdate shared flow revision
ArgumentTypeDescription
contentType?any
data?any
extensions?any
environments_securityincidents.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
detectionTypes?arrayOutput only. Detection types which are part of the incident. Examples: Flooder, OAuth Abuser, Static Content Scraper, Anomaly Detection.
displayName?stringOptional. Display name of the security incident.
firstDetectedTime?stringOutput only. The time when events associated with the incident were first detected.
lastDetectedTime?stringOutput only. The time when events associated with the incident were last detected.
lastObservabilityChangeTime?stringOutput only. The time when the incident observability was last changed.
name?stringImmutable. Name of the security incident resource. Format: organizations/{org}/environments/{environment}/securityIncidents/{incident} Example: organizations/apigee-org/environments/dev/securityIncidents/1234-5678-9101-1111
observability?enumOptional. Indicates if the user archived this incident.
riskLevel?enumOutput only. Risk level of the incident.
trafficCount?stringTotal traffic detected as part of the incident.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a securityIncidents
ArgumentTypeDescription
identifierstringThe name of the securityIncidents
updateUpdate securityIncidents attributes
syncSync securityIncidents state from GCP
batch_updatebatch update
ArgumentTypeDescription
requests?any
developers_attributes.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a attributes
ArgumentTypeDescription
identifierstringThe name of the attributes
deleteDelete the attributes
ArgumentTypeDescription
identifierstringThe name of the attributes
syncSync attributes state from GCP
update_developer_attributeupdate developer attribute
ArgumentTypeDescription
name?any
value?any
environments_deployments.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a deployments
ArgumentTypeDescription
identifierstringThe name of the deployments
syncSync deployments state from GCP
reports.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
chartType?stringThis field contains the chart type for the report
comments?arrayLegacy field: not used. This field contains a list of comments associated with custom report
dimensions?arrayThis contains the list of dimensions for the report
displayName?stringThis is the display name for the report
filter?stringThis field contains the filter expression
fromTime?stringLegacy field: not used. Contains the from time for the report
limit?stringLegacy field: not used This field contains the limit for the result retrieved
metrics?arrayaggregate function
name?stringRequired. Unique identifier for the report T his is a legacy field used to encode custom report unique id
offset?stringLegacy field: not used. This field contains the offset for the data
properties?arrayname of the property
sortByCols?arrayLegacy field: not used much. Contains the list of sort by columns
sortOrder?stringLegacy field: not used much. Contains the sort order for the sort columns
tags?arrayLegacy field: not used. This field contains a list of tags associated with custom report
timeUnit?stringThis field contains the time unit of aggregation for the report
toTime?stringLegacy field: not used. Contains the end time for the report
topk?stringLegacy field: not used. This field contains the top k parameter value for restricting the result
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a reports
getGet a reports
ArgumentTypeDescription
identifierstringThe name of the reports
updateUpdate reports attributes
deleteDelete the reports
ArgumentTypeDescription
identifierstringThe name of the reports
syncSync reports state from GCP
environments_keystores_aliases.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
contentType?stringThe HTTP Content-Type header value specifying the content type of the body.
data?stringThe HTTP request/response body as raw binary.
extensions?arrayApplication specific response metadata. Must be set in the first response for streaming APIs.
_password?stringDEPRECATED: For improved security, specify the password in the request body instead of using the query parameter. To specify the password in the request body, set `Content-type: multipart/form-data` part with name `password`. Password for the private key file, if required.
alias?stringAlias for the key/certificate pair. Values must match the regular expression `[\\w\\s-.]{1,255}`. This must be provided for all formats except `selfsignedcert`; self-signed certs may specify the alias in either this parameter or the JSON body.
format?stringRequired. Format of the data. Valid values include: `selfsignedcert`, `keycertfile`, or `pkcs12`
ignoreExpiryValidation?stringFlag that specifies whether to ignore expiry validation. If set to `true`, no expiry validation will be performed.
ignoreNewlineValidation?stringFlag that specifies whether to ignore newline validation. If set to `true`, no error is thrown when the file contains a certificate chain with no newline between each certificate. Defaults to `false`.
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
createCreate a aliases
getGet a aliases
ArgumentTypeDescription
identifierstringThe name of the aliases
updateUpdate aliases attributes
deleteDelete the aliases
ArgumentTypeDescription
identifierstringThe name of the aliases
syncSync aliases state from GCP
csrcsr
get_certificateget certificate
apiproducts_attributes.tsv2026.04.23.1

Global Arguments

ArgumentTypeDescription
namestringInstance name for this resource (used as the unique identifier in the factory pattern)
parent?stringThe parent resource name (e.g., projects/my-project/locations/us-central1, organizations/123, folders/456)
getGet a attributes
ArgumentTypeDescription
identifierstringThe name of the attributes
deleteDelete the attributes
ArgumentTypeDescription
identifierstringThe name of the attributes
syncSync attributes state from GCP
update_api_product_attributeupdate api product attribute
ArgumentTypeDescription
name?any
value?any