How to find an developer and their app with the Edge APIs using only the API key?

[#1]

Our security team has found some API keys to our system on Github, and we would like to contact the key's owners so that they can change their API keys.

In the Edge UI, you can find the app (and thus the developer) responsible for each key using the search function. However, we'd like to automate the lookup, so that we don't end up having to copy and paste the app name, developer's name and email address for each key.

I can't seem to find any Edge API that does this key-lookup function. I thought it was Get App By App ID, but this seems to take a UUID as input, not an API key. Presumably since there's a UI function to do this, there's some way to do it over the API too.

What Edge API (or APIs) can give me a developers name, email address and app name when provided with the API key?

[zubermohammad]

Hi @tpearson,

Looks like there is no management API available which gives developer details by API key.

An easy solution would be to create a proxy with Verify API key policy which takes input as API key. This policy will populate all the information about the developer app i.e. App UUID, developer details, product details and other information as flow variables. Use these variables and you can get other information from Management APIs.

Hope this solves your problem!

[#3]

I guess that would work, but it's pretty tricky... there's no easier way?

[#4 · Accepted solution]

So, inspired by @Mohammed Zuber's response, I went ahead and created an API proxy to do this, using Access Entity + Extract Variables to grab detailed user information. You can find it on my github at

https://github.com/tadhgpearson/check-key-policy

Honestly, it's kind of embarrassingly tricky and fiddly to do this. I have 2 years of Edge experience, and it still took me 2 hours to do this. It should be simple and it's not. You guys at Apigee present conferences on how APIs should be customer friendly, why not apply them to your own APIs and policies?!

[anilsr]

@tpearson , Thank you for the great feedback. Agree, An API for same will be helpful. I will pass on the information to Engineering team. MGMT-3655 . Also , Check out an article here that explains quick & easy way to get the details by leveraging existing Management APIs get details by list of all apps.

Thank you again for the API proxy, I am sure it will help many others. Way to go!!