You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/reference/policies/jwt-policies-overview). info

Edge's out-of-the-box policies augment your APIs to control
traffic, enhance performance, enforce security, and increase the utility of your APIs, without
requiring you to write any code or modify any backend services.

In addition, Apigee provides extension policies that let you implement custom logic in the
form of JavaScript, Python, Java, and XSLT stylesheets.

## Policy categories

Following are the categories of policies that Apigee provides:

| Traffic management policies | Mediation policies | Security policies | Extension policies |
|---|---|---|---|
| Let you configure caching, control quotas, mitigate the effects of spikes, set concurrent rate limits, and perform other functions related to your API traffic. - Caching policies: - [InvalidateCache policy](https://docs.apigee.com/api-platform/reference/policies/invalidate-cache-policy) - [LookupCache policy](https://docs.apigee.com/api-platform/reference/policies/lookup-cache-policy) - [PopulateCache policy](https://docs.apigee.com/api-platform/reference/policies/populate-cache-policy) - [ResponseCache policy](https://docs.apigee.com/api-platform/reference/policies/response-cache-policy) - [ConcurrentRateLimit policy](https://docs.apigee.com/api-platform/reference/policies/concurrent-rate-limit-policy) - [Quota policy](https://docs.apigee.com/api-platform/reference/policies/quota-policy) - [ResetQuota policy](https://docs.apigee.com/api-platform/reference/policies/reset-quota-policy) - [SpikeArrest policy](https://docs.apigee.com/api-platform/reference/policies/spike-arrest-policy) | Let you perform message transformation, parsing, and validation, as well as raise faults and alerts. - [AccessEntity policy](https://docs.apigee.com/api-platform/reference/policies/access-entity-policy) - [AssignMessage policy](https://docs.apigee.com/api-platform/reference/policies/assign-message-policy) - [ExtractVariables policy](https://docs.apigee.com/api-platform/reference/policies/extract-variables-policy) - [JSONtoXML policy](https://docs.apigee.com/api-platform/reference/policies/json-xml-policy) - [KeyValueMapOperations policy](https://docs.apigee.com/api-platform/reference/policies/key-value-map-operations-policy) - [MonetizationLimitsCheck policy](https://docs.apigee.com/api-platform/reference/policies/monetization-limits-check-policy) - [OASValidation policy](https://docs.apigee.com/api-platform/reference/policies/oas-validation-policy) - [RaiseFault policy](https://docs.apigee.com/api-platform/reference/policies/raise-fault-policy) - [SOAPMessageValidation policy](https://docs.apigee.com/api-platform/reference/policies/message-validation-policy) - [XMLtoJSON policy](https://docs.apigee.com/api-platform/reference/policies/xml-json-policy) - [XSLTransform policy](https://docs.apigee.com/api-platform/reference/policies/xsl-transform-policy) | Let you control access to your APIs with OAuth, API key validation, and other threat protection features. - [AccessControl policy](https://docs.apigee.com/api-platform/reference/policies/access-control-policy) - [BasicAuthentication policy](https://docs.apigee.com/api-platform/reference/policies/basic-authentication-policy) - [HMAC policy](https://docs.apigee.com/api-platform/reference/policies/hmac-policy) - [JSONThreatProtection policy](https://docs.apigee.com/api-platform/reference/policies/json-threat-protection-policy) - JWS policies: - [DecodeJWS policy](https://docs.apigee.com/api-platform/reference/policies/decode-jws-policy) - [GenerateJWS policy](https://docs.apigee.com/api-platform/reference/policies/generate-jws-policy) - [VerifyJWS policy](https://docs.apigee.com/api-platform/reference/policies/verify-jws-policy) - JWT policies: - [DecodeJWT policy](https://docs.apigee.com/api-platform/reference/policies/decode-jwt-policy) - [GenerateJWT policy](https://docs.apigee.com/api-platform/reference/policies/generate-jwt-policy) - [VerifyJWT policy](https://docs.apigee.com/api-platform/reference/policies/verify-jwt-policy) - [LDAP policy](https://docs.apigee.com/api-platform/reference/policies/ldap-policy)\*† - OAuth v2 policies: - [DeleteOAuthv2Info policy](https://docs.apigee.com/api-platform/reference/policies/delete-oauth-v2-info) - [GetOAuthv2Info policy](https://docs.apigee.com/api-platform/reference/policies/get-oauth-v2-info-policy) - [OAuthv2 policy](https://docs.apigee.com/api-platform/reference/policies/oauthv2-policy) - [RevokeOAuthV2 policy](https://docs.apigee.com/api-platform/reference/policies/revoke-oauth-v2-policy) - [SetOAuth v2 Info policy](https://docs.apigee.com/api-platform/reference/policies/set-oauth-v2-info-policy) - [RegularExpressionProtection policy](https://docs.apigee.com/api-platform/reference/policies/regular-expression-protection) - [SAMLAssertion policy](https://docs.apigee.com/api-platform/reference/policies/saml-assertion-policy) - [VerifyAPIKey policy](https://docs.apigee.com/api-platform/reference/policies/verify-api-key-policy) - [XMLThreatProtection policy](https://docs.apigee.com/api-platform/reference/policies/xml-threat-protection-policy) | Let you define custom policy functionality, such as service callout, message data collection, and calling Java, JavaScript, and Python scripts. - [ExtensionCallout policy](https://docs.apigee.com/api-platform/reference/policies/extension-callout-policy) - [FlowCallout policy](https://docs.apigee.com/api-platform/reference/policies/flow-callout-policy) - [JavaCallout policy](https://docs.apigee.com/api-platform/reference/policies/java-callout-policy) - [JavaScript policy](https://docs.apigee.com/api-platform/reference/policies/javascript-policy) - [MessageLogging policy](https://docs.apigee.com/api-platform/reference/policies/message-logging-policy) - [PythonScript policy](https://docs.apigee.com/api-platform/reference/policies/python-script-policy) - [ServiceCallout policy](https://docs.apigee.com/api-platform/reference/policies/service-callout-policy) - [StatisticsCollector policy](https://docs.apigee.com/api-platform/reference/policies/statistics-collector-policy) |
| ^\* Available only with select [Edge plans](https://apigee.com/api-management/#/pricing)^ ^† On-premises installations only^ ||||