API Gateway

API Gateway Concept

High Performance

Low latency and high throughput

Security

Authentication, Authorization, mTLS

Traffic Management

Load balancing, rate limiting, failover

Scalability

Horizontal scaling support

API Gateway Components

Request Handling

• Handling client requests
• TLS/SSL termination
• Request parsing and validation

Policy Enforcement

• Applying pre-flow policies
• Evaluating conditional policies
• Applying post-flow policies

Routing

• Upstream Target selection
• Load balancing application
• Failover mechanism

Worker Modules

Environment Isolation

Each Worker belongs to an environment

Horizontal Scaling

Scaling with multiple Workers

High Availability

Load balancing among Workers

Independent Operation

Workers operate independently

Local Cache

Configuration Cache

Configurations loaded via Management API

API Proxy configurations and settings.

Policy Cache

Policy definitions

All policy definitions and configurations.

Token Cache

OAuth2/JWT tokens

Token validation results and token information.

Metadata Cache

API Proxy metadata information

API Proxy information and routing metadata.

bilgi

Distributed Cache Access:

API Gateway uses Distributed Cache (Hazelcast) for shared data such as throttling, quota, and OAuth2 tokens. Cache Servers can run in different Kubernetes namespaces from Gateway pods. Gateway pods can access cache servers in other namespaces using Kubernetes service discovery (e.g., http://cache-http-service.apinizer-cache.svc.cluster.local:8090). This provides more flexible infrastructure management. For more information about Distributed Cache, see the Cache Component page.

Token Provider API

Token Generation

Access token and refresh token generation

Creation of OAuth2 and JWT tokens.

Token Validation

Token validation

Checking token validity.

Token Revocation

Token revocation

Revoking and invalidating tokens.

API Gateway Features

Security

Authentication

• OAuth2 / OIDC
• JWT
• Basic / Digest Authentication
• mTLS

Authorization

• IP Whitelist/Blacklist
• API Key control
• Role-based Access Control

TLS/SSL

• TLS/SSL termination
• SNI support
• Certificate management

Data Protection

• Data masking
• Encryption
• PII protection

Traffic Management

Load Balancing

• Round Robin
• Least Connections
• Weighted Round Robin

ipucu

For detailed information about load balancing strategies, see the Routing and Upstream page.

Rate Limiting

• API-based rate limiting
• User-based rate limiting
• IP-based rate limiting
• Quota management

Failover

• Automatic failover
• Health check
• Circuit breaker

Message Processing

Transformation

• JSON ↔ XML conversion
• Message enrichment
• Field mapping

Validation

• JSON Schema validation
• XML Schema validation
• Message size validation

Routing

• Conditional routing
• Content-based routing
• Version-based routing

Logging

• Request/Response logging
• Audit logging
• Error logging

API Gateway and API Manager Relationship

API Gateway receives configuration from API Manager and processes traffic. Workflow:

API Manager (Control Plane)
   │
   │ 1. Configuration Management
   │ 2. Deployment
   │
   ▼
API Gateway (Data Plane)
   │
   │ 3. Loading into Local Cache
   │ 4. Request Handling
   │ 5. Traffic Processing
   │ 6. Sending Metrics
   │
   ▼
Backend API / Client

1. Configuration

API Proxy configuration is done in API Manager

All configurations are managed centrally.

2. Deployment

Configuration is deployed to API Gateways

Configurations are distributed to all gateways.

3. Cache

API Gateway loads configuration into Local Cache

Cached locally for performance.

4. Request

Client requests come to API Gateway

Client requests are routed to gateway.

5. Processing

API Gateway processes traffic using configuration

Policies are applied and routing is done.

6. Metrics

Metrics are sent to API Manager

Performance and usage metrics are collected.

bilgi

This collaboration between API Manager and API Gateway balances central management and high-performance traffic processing.

API Gateway Performance Features

Low Latency

• Optimized request handling
• Local cache usage
• Async processing

High Throughput

• Non-blocking I/O
• Connection pooling
• Efficient resource usage

Scalability

• Horizontal scaling
• Auto-scaling
• Load balancing

High Availability

• Failover mechanism
• Health check
• Redundancy

Next Steps

API Manager

Learn about API Manager component

Technical Architecture

Learn about Technical Architecture structure

Routing and Upstream

Learn about routing and upstream concepts

Message Processing and Policy Application

Learn about message processing flow