India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Apigee API Management, Pub/Sub & Application Integration Services
Apigee is Google Cloud's API management platform for securing, publishing, metering and analysing APIs, available as Google-managed Apigee X or as Apigee hybrid with the runtime in your own Kubernetes clusters. NTSPL pairs Apigee with Pub/Sub event streams, Eventarc and Application Integration to connect partners, core systems and SaaS for Indian banks, mobility networks and retail chains.
Google Cloud services in scope
The Problem Apigee X and Apigee hybrid Solve
Integration estates in India usually grow as point-to-point links: each partner gets a custom VPN, a set of IP allowlists and an API built directly on the core system, often with a different authentication scheme each time. When a fintech partner or roaming network sends 30x normal traffic, the core banking or ERP system absorbs it directly. Meanwhile, batch files over SFTP still carry inventory and settlement data hours after the event. The engineering problem is to put one governed front door before every partner and one asynchronous backbone behind it.
NTSPL designs the API layer in Apigee as products, not proxies: each partner tier gets an API product with its own OAuth scopes, quotas and SpikeArrest limits, and every proxy shares security shared flows. Southbound, synchronous calls go to backends over Private Service Connect or Interconnect, while anything that can be asynchronous is published to Pub/Sub topics with schemas and dead-letter topics. Application Integration and Integration Connectors handle SaaS and ERP mapping without bespoke middleware.
When Apigee and Pub/Sub Fit Your Integration Problem (and When a Lighter Gateway Is Enough)
Signals that point to api & integration on Google Cloud
- You have more than 10 external partners each integrated through bespoke VPNs, IP allowlists or credentials.
- Partner or aggregator traffic spikes have caused core banking, ERP or charging management system outages in the last year.
- A regulator, auditor or partner has asked for per-partner API call logs, consent records or rate-limit evidence you cannot produce quickly.
- Inventory, settlement or status data still moves in hourly or nightly SFTP batches when partners expect near-real-time updates.
- You plan to monetize APIs or onboard partners through a self-service developer portal.
When a different approach is better
- A single internal API consumed only by your own front end rarely justifies Apigee; API Gateway or a load balancer with Cloud Armor is lighter and cheaper.
- Large-volume streaming analytics between your own services may be better on Managed Service for Apache Kafka if teams already depend on Kafka APIs and tooling.
- Complex long-running ETL and data warehouse loads belong in Dataflow or BigQuery pipelines rather than Application Integration flows.
API and Integration Building Blocks: Apigee X, Apigee Hybrid, Pub/Sub, Eventarc and Application Integration
| Service | Role in the architecture | Choose it when |
|---|---|---|
| Apigee X | Google-managed API runtime and management plane that applies policies such as OAuth, quotas, SpikeArrest, threat protection and transformation to API proxies, with analytics and developer portals. | You want a fully managed API gateway in a Google Cloud region such as asia-south1, with backends reachable over Private Service Connect or hybrid links. |
| Apigee hybrid | Apigee deployment in which the runtime plane runs on your own Kubernetes clusters on-premises or in other clouds, while the management plane runs in Google Cloud. | API traffic and payloads must stay inside your own data centre, or latency to on-premises cores rules out a cloud-hosted runtime. |
| Pub/Sub | Global, asynchronous messaging service with topics and pull, push, BigQuery and Cloud Storage subscriptions, supporting ordering keys, schemas, dead-letter topics and exactly-once delivery for pull subscriptions. | Systems must exchange events at high volume without the producer waiting for, or even knowing, each consumer. |
| Eventarc | Routes Google Cloud, audit-log, Pub/Sub and third-party events to Cloud Run, GKE and Workflows targets in CloudEvents format with attribute filters. | Integrations should react to platform events, such as files landing or resources changing, without custom subscribers. |
| Application Integration and Integration Connectors | Low-code integration platform with triggers, data mapping, loops and error handling, using managed connectors for SaaS, databases and ERPs such as SAP and Salesforce. | You need orchestrated business flows across SaaS and enterprise systems without building and hosting custom middleware. |
Governed partner API front door with event backbone
Governed partner API front door with event backbone
Partners call Apigee X through a global external Application Load Balancer with mTLS, where proxies authenticate, rate-limit and transform requests before reaching backends in Google Cloud or on-premises over Private Service Connect and Cloud Interconnect. Backends publish domain events to Pub/Sub, which fans out to partner webhooks, Application Integration flows for ERP and SaaS updates, and BigQuery for analytics.
Select any component
Governed partner API front door with event backbone: click any of its 10 components to see its role and the design choice NTSPL makes for it, or trace the 6-step primary path.
API Programme Engineering Decisions: Deployment Model, Product Design, Event Contracts and Backend Protection
Apigee X or Apigee hybrid
Apigee X is the default: Google runs the runtime, it deploys in asia-south1 and reaches on-premises cores over Interconnect. Choose hybrid only when payloads must never leave your data centre, when the core is latency-sensitive to round trips through the cloud, or when a regulator's outsourcing review prefers the runtime inside your premises. Hybrid means you operate Kubernetes clusters, Cassandra-backed runtime data and upgrades, so budget for that operational load.
API product and quota design
Products, not proxies, carry commercial and security policy. We define products per partner tier, such as sandbox, standard and premium, each with OAuth scopes, a Quota in calls per minute or day, and SpikeArrest on proxies to smooth bursts at, say, 50 requests per second. Backend protection is sized from what the core can safely handle, not from partner requests. Proxies stay thin and reuse shared flows for authentication, logging and masking.
Event contracts and delivery semantics
Every Pub/Sub topic has an Avro or Protocol Buffer schema, versioned with backward-compatible changes only. Ordering keys are used where per-entity sequence matters, such as one charging session or one account, because ordering reduces per-key throughput. Exactly-once delivery is enabled for pull subscriptions handling money movements; other consumers are designed to be idempotent using event IDs. Dead-letter topics trigger alerts after five failed delivery attempts.
Synchronous API or asynchronous event
If the partner needs an answer to continue, such as a balance check or a charger authorization, it is a synchronous API through Apigee with a strict target timeout of 2-5 seconds. If the partner just needs to know something happened, such as a settlement completed or stock changed, it is an event delivered by Pub/Sub push or a partner webhook. Mixing these, for example polling APIs for status, is the most common cause of core-system overload.
Application Integration versus custom code
Application Integration fits flows that are mostly mapping and orchestration across systems with connectors, such as SAP stock updates or Salesforce case creation, where business analysts benefit from visual flows. When logic involves heavy computation, complex domain rules or very high throughput, we write a Cloud Run service subscribed to Pub/Sub instead. Each flow has explicit error branches and a suspension path for manual review.
How NTSPL Launches a Partner API Programme on Apigee with an Event Backbone
API and partner inventory
Catalogue every partner integration, authentication method, call volume and backend dependency, and group them into candidate API products.
Apigee organization and environment build
Provision Apigee X in asia-south1 or hybrid runtimes, set up environments and groups for sandbox and production, and connect backends through PSC or Interconnect.
Security and shared flows
Implement mTLS at the load balancer, OAuth client credentials, threat protection, masking and logging as shared flows reused by every proxy.
Event backbone
Create Pub/Sub topics with schemas, ordering and dead-letter policies, and move batch file exchanges to event publishing from backends.
Integration flows and connectors
Build Application Integration flows for ERP, CRM and payment updates, with connectors authenticated through Secret Manager.
Partner migration and portal launch
Move partners in waves to the new endpoints with parallel running, then open the developer portal for self-service onboarding.
What you receive
Securing Partner APIs and Event Streams: mTLS, OAuth Scopes, Advanced API Security and Topic IAM
API programmes fail on broken object-level authorization, leaked partner credentials, excessive data exposure and unthrottled endpoints that let one compromised key scrape everything. NTSPL combines mTLS at the edge with OAuth client-credential tokens scoped per API product, masks sensitive fields in Apigee debug and logs, uses Advanced API Security to flag risky proxy configurations and abuse, and restricts who can publish to or subscribe from each Pub/Sub topic.
- mTLS with partner client certificates validated at the load balancer, plus certificate rotation runbooks
- OAuthV2 client-credentials with short-lived tokens and scopes per API product
- Apigee data masking for account numbers, Aadhaar-linked fields and card data in traces and logs
- Advanced API Security risk assessment and abuse detection on production proxies
- Pub/Sub topic-level IAM, CMEK and VPC Service Controls perimeters around event projects
Apigee and Pub/Sub Pricing Levers: Environments, API Call Volumes, Message Throughput and Retention
Apigee is priced either by subscription tier or pay-as-you-go, where you pay for deployed environments per hour, API call volume and proxy deployment units, with add-ons such as Advanced API Security billed separately. Pub/Sub bills message throughput per TiB for publish and delivery, plus retained message storage and snapshot storage. Application Integration bills per execution and data processed, and Integration Connectors per connection node.
- Choose pay-as-you-go Apigee for early programmes under a few million calls a month; move to subscription once volumes stabilise
- Consolidate proxies into fewer environments and use environment groups instead of an environment per partner
- Cache reference data in Apigee ResponseCache to cut backend calls by 30-60% for lookups
- Batch small Pub/Sub messages and keep retention to what replay needs, not the maximum
- Use BigQuery subscriptions instead of a custom Dataflow job for straight event-to-table loads
Apigee vs API Gateway vs a self-managed gateway on GKE: which should front our APIs?
Decide on audience, policy depth and operations. Apigee is built for external and partner API programmes: API products, developer portals, quotas, monetization, advanced security and analytics per partner, with Apigee hybrid where runtime residency matters. Google Cloud API Gateway is a lightweight managed gateway for serverless backends with API keys or JWT validation, suited to internal or simple public APIs with modest policy needs and low cost. A self-managed gateway such as an open-source proxy on GKE gives full control and no per-call fees, but your team owns scaling, patching, high availability and building analytics and portals. For regulated partner ecosystems in banking, mobility or healthcare, Apigee usually wins on governance; for internal APIs, Gateway API on GKE or API Gateway is enough.
Key facts about api & integration on Google Cloud
API & Integration on Google Cloud in Practice
3 api & integration scenarios from Banking (small finance bank), EV charging network, Retail pharmacy: the starting position, the services chosen, the architecture, the rollout and the measured outcome.
Small finance bank onboards fintech partners in 3 weeks instead of 4 months
EV charging network connects 9 roaming partners and settles sessions in near real time
Pharmacy chain exposes e-prescription APIs and live stock across 720 stores
Clinical research organization connects 48 trial sites to a private EDC platform
Tyre manufacturer links four plants to cloud MES and IIoT analytics at 99.99%
Live-scoring app scales 25x for match days with zero pending pods at toss
Insurtech aggregator passes IRDAI-aligned audit with signed, policy-checked GKE deploys
QSR chain processes 6x lunch-hour orders with zero dropped POS pushes
API & Integration on Google Cloud: Frequently Asked Questions
How is Apigee priced?
Apigee offers subscription plans and a pay-as-you-go model. Pay-as-you-go charges for each deployed environment by the hour, for API calls by volume, and for proxy deployment units, with add-ons such as Advanced API Security charged separately. Subscriptions bundle capacity at committed levels. We usually start partner programmes on pay-as-you-go and switch when monthly call volume becomes predictable.
Can Apigee meet RBI expectations for open banking and partner APIs?
Apigee provides the controls auditors look for: mTLS and OAuth per partner, quotas, full API call analytics, masking of sensitive fields and audit logs of configuration changes. Apigee X runs in Mumbai (asia-south1), and Apigee hybrid keeps runtime traffic in your own data centre. Payment data storage requirements and RBI IT outsourcing directions still need your own governance, contracts and logging retention policies.
How do we migrate from an existing API gateway or ESB?
We inventory existing APIs and flows, import OpenAPI specifications or reverse-engineer them, and rebuild policies as Apigee proxies with shared flows. ESB mediation logic is split: routing and transformation move to Apigee or Application Integration, long-running orchestration to Workflows or Cloud Run, and batch exchanges to Pub/Sub. Partners migrate in waves with both endpoints live until traffic on the old one reaches zero.
Does Pub/Sub guarantee message ordering and exactly-once delivery?
Pub/Sub delivers messages with the same ordering key in publish order when ordering is enabled on the subscription and messages are published to the same region. Exactly-once delivery is available for pull subscriptions, preventing redelivery of acknowledged messages within the region. Push subscriptions remain at-least-once, so consumers should be idempotent using a unique event identifier.
When should we use Eventarc instead of subscribing to Pub/Sub directly?
Use Eventarc when you want Google Cloud events, such as Cloud Storage object changes or audit-logged API calls, delivered to Cloud Run, GKE or Workflows with filtering and no subscription code. Subscribe to Pub/Sub directly for your own domain events where you need control over acknowledgement deadlines, ordering, exactly-once delivery or BigQuery subscriptions.
Can partners self-onboard to our APIs?
Yes. Apigee's integrated developer portal, or a Drupal-based portal for more customisation, lets partners register, read documentation, try sandbox APIs and request access to API products. Approvals can stay manual for production products, which matters when contractual or KYC checks apply, while sandbox access is automatic. Credentials are issued per developer app, so revocation is clean and per partner.