Company apps are operational contracts

A company app is more than an app name and callback URL. It is a contract between a consumer and a platform: which products are authorized, which credentials are valid, which credentials are revoked, and which operational team is accountable. Migration failures happen when this contract is flattened into a default approved target state.

What to preserve

Carry app status, credential status, credential expiry, API product associations, product approval status, scopes, custom attributes, and consumer metadata. If Edge marks a credential revoked, it should not become valid in Apigee X. If a product association is pending or revoked, it should not quietly become approved.

Control pattern

  • Export app and credential records into a migration manifest.
  • Translate product references through an approved mapping table.
  • Apply target status explicitly after creation.
  • Run negative tests for revoked and pending credentials.

The safest migration is explicit about every authorization decision it carries forward.