APOC Core: Procedures vs Functions, Installation/Availability, Configuration, and Security Boundaries

Learning outcomes

AtlasMart has reached the point where developers want helpers for data cleanup, path expansion and JSON exchange. The risk is to treat “APOC” as one magic capability. In reality a function, a procedure, a server plugin, a filesystem permission and an outbound HTTP permission have different execution and security boundaries.

1. Function, procedure and plugin are three different concepts

APOC Core is implemented as a server-side Java extension. Installing it changes the server process, not merely the client query text. That is why version matching, restart behavior and security configuration belong in the same lesson as syntax.

2. Current support and compatibility contract

Patch numbers do not have to match in the general compatibility rule, but this lab pins both server and Core to 2026.07.1 so the evidence is unambiguous.

3. Recreate the disposable container with APOC Core while preserving named data volumes

If your existing atlasmart-neo4j container was created without APOC, stop and recreate the container rather than editing a running server ad hoc. The Docker NEO4J_PLUGINS helper is documented as a development convenience, not a production deployment recommendation.

docker stop atlasmart-neo4jdocker rm atlasmart-neo4jdocker run -d `  --name atlasmart-neo4j `  -p 127.0.0.1:7474:7474 `  -p 127.0.0.1:7687:7687 `  -v atlasmart-neo4j-data:/data `  -v atlasmart-neo4j-logs:/logs `  -e NEO4J_AUTH=neo4j/atlasmart-course-2026 `  -e 'NEO4J_PLUGINS=["apoc"]' `  neo4j:2026.07.1

CYPHER 25RETURN apoc.version() AS apocVersion;SHOW PROCEDURES YIELD name, descriptionWHERE name STARTS WITH 'apoc.'RETURN name, descriptionORDER BY nameLIMIT 20;SHOW FUNCTIONS YIELD name, descriptionWHERE name STARTS WITH 'apoc.'RETURN name, descriptionORDER BY nameLIMIT 20;

4. Load only what the workload needs

“Unrestricted” is not a synonym for “installed.” It lets designated extensions bypass normal sandbox restrictions and is therefore a much stronger security decision. Likewise, boosted procedure execution in Enterprise can bypass ordinary user privileges; it should never be granted broadly to convenience procedure families.

5. Deliberately wrong: apoc.* unrestricted because “APOC is trusted”

Trusting the publisher does not mean every procedure should run with elevated server powers. Some APOC procedures can execute dynamically supplied Cypher or access URLs/files. A broad unrestricted/boosted grant converts a small application requirement into a large attack surface. The repair is to identify the exact operation, prefer native Cypher where equivalent, load only the necessary extension set, and grant the minimum execution/filesystem/network capability.

CYPHER 25CALL apoc.help('path') YIELD name, type, textRETURN name, type, textORDER BY name;SHOW PROCEDURES YIELD name, mode, adminWHERE name STARTS WITH 'apoc.'RETURN name, mode, adminORDER BY name;

6. Reproducible AtlasMart baseline

CYPHER 25MERGE (c:Customer {customerId:'C-1001'})SET c.name='Mina Rahimi'MERGE (p1:Product {productId:'P-1001'})SET p1.name='Trail Camera', p1.category='Cameras', p1.price=129.90MERGE (p2:Product {productId:'P-2001'})SET p2.name='Smart Shelf Sensor', p2.category='Store IoT', p2.price=79.50MERGE (o:Order {orderId:'O-5001'})SET o.status='PAID', o.orderedAt=datetime('2026-09-08T16:30:00Z')MERGE (c)-[:PLACED]->(o)MERGE (o)-[:CONTAINS {quantity:1}]->(p1)MERGE (o)-[:CONTAINS {quantity:2}]->(p2);

CYPHER 25RETURN apoc.version() AS apocVersion;SHOW PROCEDURES YIELD name, descriptionWHERE name STARTS WITH 'apoc.'RETURN name, descriptionORDER BY nameLIMIT 20;SHOW FUNCTIONS YIELD name, descriptionWHERE name STARTS WITH 'apoc.'RETURN name, descriptionORDER BY nameLIMIT 20;

Expected evidence: apoc.version() should report the installed Core version and the filtered SHOW commands should reveal the functions/procedures actually available. Do not infer Extended, file access or unrestricted execution from the presence of one APOC function.

7. Production judgment

Summary and next step

APOC is an extension mechanism with a deployment and privilege boundary. Lesson 2 compares native Cypher with Core utilities for maps, collections, text cleanup and bounded path expansion.

Authoritative references

• Current Neo4j versions — Release/LTS snapshot used for this chapter.
• APOC Core 2026.07 documentation — Current officially supported APOC Core manual.
• APOC installation and compatibility — Matching Neo4j/APOC year-month lines, deployment and restart requirements.
• APOC introduction: Core vs Extended — Support boundary between officially supported Core and community-maintained Extended.
• APOC security guidelines — Allowlist/unrestricted execution, file/network and SSRF guidance.
• APOC configuration — apoc.conf location, file/HTTP/trigger-related settings and defaults.
• APOC procedures and functions — Current procedure/function catalog and Cypher 25 status.
• Neo4j Java Reference: extending Neo4j — Custom procedures, functions and server extension boundaries.