Apigee roles

This section describes the Apigee-specific roles that you commonly assign to your users. These are not the same roles that you assign to service accounts, which are described in Create service accounts.

Apigee-specific roles

Apigee provides a set of pre-defined (or curated) roles called Apigee roles. In general, all pre-defined Apigee roles can:

  • Get and list organizations
  • Get and list environments (most but not all roles)
  • Get and list projects

The following table describes the general set of permissions that the curated roles have:

Pre-Defined Role Name Description Permissions
Analytics Editor Creates and analyzes reports on API proxy traffic for an Apigee organization. Can edit the following:
  • Queries
  • Reports
Analytics Viewer Views analytics data for an organization. Can get environment stats.
API Creator A developer that creates and tests API proxies. Has read access to the following:
  • API products
  • Apps

Can edit:

  • API proxies
  • Shared flows
  • Key Value Maps (KVMs)
Deployer Deploys and undeploys API proxies to the runtime. Has read access to the following:
  • API products
  • Apps
  • API proxies

Can edit:

  • Flow hooks
  • Keystores
  • KVMs
  • Shared flows
  • Target servers

Can also deploy and undeploy API proxy revisions.
Developer Admin. Manages developer access to apps. Has read access to the following:
  • API products

Can edit:

  • App keys
  • Companies
  • Company apps
  • Developer apps
  • Developers
Org Admin. A super user that has full access to all Apigee resources in the Apigee organization. Can access all available actions for all APIs. This is the only role that can create, delete, or update organizations, as described in Step 3: Enable APIs.
Read Only Admin. An administrator who can run reports and view everything in the Apigee organization without the ability to create or change anything. Has read access to all Apigee resources within the Apigee organization.

Your GCP project’s service account is assigned this role during setup and installation.

The next section shows specific permissions for each of these roles per API.

Apigee role permissions

The following table lists the specific permissions for each role:

Apigee Role ("Apigee ...")
Apigee API
(apigee.*) 		Org Admin. Read Only Admin. API Creator Deployer Developer Admin. Analytics Viewer Analytics Editor
apiproducts * G,L G,L G,L G,L - -
apiproductsattributes * G,L G,L G,L G,L - -
appkeys * G,L - - G,C,M,D - -
apps * G,L G,L G,L - - -
companies * G,L - - G,L,C,U - -
companyapps * G,L - - G,L,C,U - -
deployments * G,L - * - - -
developerappattributes * G,L - - * - -
developerapps * G,L - - * - -
developerattributes * G,L - - * - -
developers * G,L - - * - -
environments * G,L,GS,GIP,GDL G,L,GS G,L,GS,GIP,SIP G,GS GS G,GS
flowhooks * G,L,GSF - * - - -
keystorealiases * G,L - * - - -
keystores * G,L * - - -
keyvaluemaps * G,L L,C,D * - - -
oauth2accesstokens * G,L - - - - -
oauth2authorizationcodes * G,L - - - - -
oauth2refreshtokens * G,L - - - - -
organizations * G,L G,L G,L G,L G,L G,L
proxies * G,L G,L,C,D G,L - - -
proxyrevisions * G,L G,L,U,D G,L,DP,UN - - -
queries * G,L - - - - G,L,C
reports * G,L - - - - G,L,C,U,D
sharedflowrevisions * G,L * * - - -
sharedflows * G,L G,L,C,D * - - -
targetservers * G,L - * - - -
resourcemanager.projects G,L,GIP G,L,GIP G,L G,L,GIP G,L,GIP G,L G,L
KEY:
C: Create          GDL: getDataLocation          M: Manage
D: Delete          GSF: getSharedFlow            DP: Deploy
G: Get             GIP: getIamPolicy             UN: Undeploy
L: List            SIP: setIamPolicy             *: All
U: Update          GS:  getStats                 -: Not available/none

In addition to the Apigee roles, you also apply GCP roles such as Logs Writer and Storage Object Admin to your users. For example, Apigee recommends that you assign these roles to service accounts, as described in Create service accounts.