Apigee Security Review
An Apigee key belongs to a product, not one proxy, so a broad product widens what every app reaches. We test what each product bundles and what a leaked key can reach. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Every Apigee API proxy splits into a ProxyEndpoint and a TargetEndpoint, and Apigee’s own documentation says each side takes its own policies, so where a policy is attached decides which half of the request it actually checks.
Why Apigee security comes down to which endpoint a policy sits on, what a product bundles and where the runtime actually lives
An Apigee API proxy is built from two endpoints, and Apigee’s own API proxy documentation is explicit that policies attached to the ProxyEndpoint enforce security, quota checks and access control on the client-facing side, while policies on the TargetEndpoint govern the connection to your backend, including its protocol and other connection settings. A policy attached to the wrong endpoint still runs, it just checks the wrong side of the request. We test which endpoint every security-relevant policy is actually attached to.
Apigee provisions API keys to API products, not to individual proxies: a product bundles one or more operations, each an API proxy plus the resource paths and HTTP methods an app may call, and the VerifyAPIKey policy only confirms that a key is valid, unrevoked and approved for the product it was issued against. The APIKey element decides which flow variable carries the key, so the same key can arrive in a header, a query parameter or a form field depending on how the proxy was built. We test what every product actually bundles against what an app was meant to reach, and where each key travels.
Every environment group has one or more hostnames attached to it, and Apigee’s documentation confirms that any hostname on a group can reach any environment deployed within that group, so a proxy meant for one hostname is often reachable through every other hostname bound to the same group. If you run Apigee hybrid rather than the fully managed service, that traffic is then processed inside a Kubernetes runtime plane you operate yourself, which we test as infrastructure in the same way we test client configuration on Google Cloud environments rather than Google’s platform.
SCOPE
What we review on an Apigee estate
ProxyEndpoint and TargetEndpoint Policy Placement
Every Apigee proxy is built from a ProxyEndpoint, which faces the calling app, and a TargetEndpoint, which faces your backend, and each takes its own set of policies. We test which endpoint every security, quota and access-control policy is actually attached to, not just whether it exists somewhere in the proxy.
API Product Boundaries and Key Scope
An API key is provisioned against an API product, a bundle of API proxies, resource paths and HTTP methods, not against a single proxy, so a product built too broadly hands every app holding its key more reach than intended. We test what each product actually bundles against what its apps are meant to call.
VerifyAPIKey, Revocation and Key Transport
VerifyAPIKey confirms a key is valid, unrevoked and approved for the product it belongs to, and the policy’s APIKey element decides whether the key is read from a header, a query parameter or a form field. We test where each key travels and whether a query-parameter key ends up logged or cached upstream.
OAuthV2 Grant Type Configuration
The OAuthV2 policy performs a different operation, generating a token, verifying one, or refreshing one, depending entirely on how it is configured, and a GenerateAccessToken operation only accepts the grant types listed in its SupportedGrantTypes element. We test which grant types are actually enabled against which ones your apps use.
Bearer Token Handling and Token Storage
Apigee’s OAuthV2 VerifyAccessToken operation supports only Bearer tokens, extracted from the Authorization header by default, and Apigee’s documentation confirms access and refresh tokens are hashed by default when stored in the runtime Cassandra database. We test how a token is validated and what happens once it expires, is revoked or is replayed.
Environment Groups and Hostname Routing
An environment group can carry more than one hostname, and any hostname on that group can reach any environment deployed within it, so a proxy intended for one hostname is often reachable through every other hostname on the same group. We test which hostnames actually reach which environments.
Cloud IAM Roles: Organization, Environment and API Admin
Apigee access is granted through Cloud IAM roles such as Organization Admin, Environment Admin, API Admin and Developer Admin, each carrying a different set of apigee.* permissions, plus any custom roles built from those permissions. We test which principals hold which role and whether any role is broader than the job it was given for.
Shared Flows Reused Across Proxies
A shared flow bundles policies once and can be called from any API proxy, or any other shared flow, in the same Apigee organisation, so a control placed there is only as strong as every FlowCallout that actually invokes it. We check which security-relevant policies live in a shared flow and whether every proxy that needs it actually calls it.
TargetEndpoint Backend Connection Security
The TargetEndpoint decides how Apigee reaches your backend, including whether the connection runs over HTTP or HTTPS and what other connection settings apply. We test the protocol and settings actually configured against what your backend expects.
Apigee Hybrid vs the Managed Service: What Changes
Apigee hybrid splits into a management plane Google runs and a runtime plane you install and operate yourself on Kubernetes, so every API request is processed inside infrastructure your team controls; the fully managed service does not carry that runtime. We confirm during scoping which model is in use and test the runtime plane as infrastructure where it applies.
OUR PROCESS
Apigee Security Review: From Scope to Attestation
Scope and Access
We agree which API proxies, products, environments and roles are in scope, plus a developer app and key for each product tested.
Proxy and Policy Mapping
We map every ProxyEndpoint, TargetEndpoint, API product, shared flow and IAM role against what each is actually configured to check.
Manual Testing
A CREST-certified tester manually tests key and token handling, product boundaries, environment group routing and shared flow reuse.
Attestation and Retest
You get a technical report with CVSS scores, a walkthrough call, a free retest, and an attestation letter.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Apigee pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Apigee Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Apigee For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Apigee Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Apigee estate?
We need a developer app and an active API key or OAuth client for each API product in scope, plus read access to the proxy, product and environment configuration for the organisation being tested.
Will testing touch our live data?
We test the proxies, products and environments you nominate using accounts and apps you provide, and agree any exclusions, such as environments carrying production traffic, before testing starts.
How long does an Apigee security review take?
A single estate sits in our 3-day single-estate scope, with a report typically landing around 5 working days after kickoff.
Do you test Apigee hybrid differently to the fully managed service?
The API proxy, product and policy model is the same either way, but Apigee hybrid also has a customer-operated Kubernetes runtime plane, so we confirm during scoping which model you run and scope the runtime plane in if it applies.
What is out of scope for an Apigee estate review?
We test the proxies, products, policies and IAM roles in your organisation; we never test Google’s own management plane or the infrastructure underneath Apigee.
Does Google have a policy on customer penetration testing?
Google’s Cloud Security FAQ states that you are not required to notify Google before testing your own Cloud Platform resources, provided testing stays within the Acceptable Use Policy and Terms of Service and only affects your own projects; we confirm current terms during scoping.
Do you need our source code or shared flow repository?
No. Testing is black-box by default; a grey-box option covering your proxy bundles and shared flow source is available if you want deeper coverage.
Is the Apigee developer portal included by default?
No, the developer portal is a separate surface from the runtime API proxies; tell us during scoping if you want it included.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Apigee estate
An Apigee key belongs to a product, not one proxy, so a broad product widens what every app reaches. We test what each product bundles and what a leaked key can reach. CREST-certified testers, fixed price from £3,350 for a 3-day single-estate scope, quoted within 24 hours.
