If you have a restricted VPC environment where external domains need to be allowed, here is a
list of Google Cloud urls that Apigee hybrid may need to connect with during install
and runtime.
Google Cloud URLs for all Apigee hybrid installations
These URLs are used by all Apigee hybrid installations:
URL
Description
apigee.googleapis.com
The runtime uses these APIs to learn which proxies, shared flows,
etc., it should deploy, and to report its current configuration and health.
apigeeconnect.googleapis.com
This APIs is needed for apigee-mart-server and apigee-connect
communication when you have vpc-sc enabled to talk to the control plane.
Contanier images are hosted in Google Container Registry.
iamcredentials.googleapis.com
Required for generating access tokens used
by other gcp calls. For example, for runtime to make calls to download runtime
contracts from
apigee.googleapis.com, the permission is granted by a service account. So the runtime
needs to get an access token before making the call to apigee.googleapis.com.
logging.googleapis.com
This API is needed for the logging agent to send logs
to Cloud Logging.
monitoring.googleapis.com
Cloud Monitoring service endpoint to export metrics.
oauth2.googleapis.com
Authentication and authorization
pubsub.googleapis.com
The runtime subscribes to a pubsub topic to learn when to
initialize debug sessions.
serviceusage.googleapis.com
Inspect and manage quota for service consumers on Google Cloud
Platform. Required by Anthos Service Mesh
storage.googleapis.com
The runtime downloads proxies, shared flows, resource files, and
keystore aliases from Google Cloud Storage in tenant project.
sts.googleapis.com
The Security Token Server providers API method for third party developers
to exchange third party credentials to Google Cloud Platform tokens.
www.googleapis.com
Needed for installing Apigee hybrid on Anthos.
Google Cloud URLs for Anthos installations
All Apigee hybrid installations on Anthos (on-prem and multi-cloud) use additional Google
Cloud URLs. For more information, see:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis documentation outlines the Google Cloud URLs that Apigee hybrid installations may need to access, particularly in restricted VPC environments.\u003c/p\u003e\n"],["\u003cp\u003eSeveral core Google Cloud URLs are essential for all Apigee hybrid setups, including those for API communication, container registry, access token generation, logging, and runtime operations.\u003c/p\u003e\n"],["\u003cp\u003eAnthos installations require additional Google Cloud URLs, which are detailed in separate documentation on proxy and firewall rules for Anthos on-prem and multi-cloud environments.\u003c/p\u003e\n"],["\u003cp\u003eThe runtime uses the URLs to deploy proxies, shared flows, report configuration and health, and to manage security related features.\u003c/p\u003e\n"]]],[],null,["# GCP URLs to allow for Hybrid\n\n| You are currently viewing version 1.9 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nIf you have a restricted VPC environment where external domains need to be allowed, here is a\nlist of Google Cloud urls that Apigee hybrid may need to connect with during install\nand runtime.\n\nGoogle Cloud URLs for all Apigee hybrid installations\n-----------------------------------------------------\n\nThese URLs are used by all Apigee hybrid installations:\n\nGoogle Cloud URLs for Anthos installations\n------------------------------------------\n\nAll Apigee hybrid installations on Anthos (on-prem and multi-cloud) use additional Google\nCloud URLs. For more information, see:\n\n- [Proxy and firewall rules\n for Anthos on-prem](/anthos/clusters/docs/on-prem/how-to/firewall-rules)\n- [Proxy\n allowlist for Anthos multi-cloud](/anthos/clusters/docs/multi-cloud/aws/how-to/use-a-proxy#proxy_allowlist_2)"]]
