Deployment and Specification Information

Deployment Information

The deployment information section displays which environments the API Proxy is deployed to and the access address in that environment. An API Proxy can be deployed to multiple environments at the same time.

If an API Proxy Group has been created from the API Proxy, information about that group is also displayed in this area.

Deployment Information Fields

Field	Description
Environment	The Environment information where the API Proxy is deployed.
Access Type	The access type information of the API Proxy.
URL	The access address of the API Proxy. It is automatically generated using the Gateway Address and the access address of the deployed Environment.
Specification Files	The Specification files of the API Proxy. Specification files in Swagger and OpenAPI formats are generated for each API Proxy. If the API Proxy type is SOAP, WSDL and XSD specification files will also be generated. When the Show link is clicked for any environment, the API Specification Files valid for that environment for the API Proxy are displayed.

Viewing Specification Files

When the Show button is clicked, a dialog showing API Proxy definitions in different types and formats opens:

Warning

If the related API Proxy is part of a Group and the Block Direct Access to API Proxies option is selected from the API Proxy Group screen, a warning box is displayed in this section.

Accessing Specification Files Through API Proxy

The content of specification files opens as shown above when the Show link is clicked and can be copied from there. However, this method is for users with roles such as API Developer, API Tester working on the Apinizer platform. Clients cannot access these interfaces.

Clients can use the access address of the Environment where the API Proxy is deployed in the following way to access specification files:

For example, let the API Proxy's access address in Production Environment be https://demo.apinizer.com/apigateway/petstoreProxy.

Requests can be sent to the following addresses to access specification files:

Swagger 2.x (JSON)

• https://demo.apinizer.com/apigateway/petstoreProxy?swagger
• https://demo.apinizer.com/apigateway/petstoreProxy?swagger&format=json
• https://demo.apinizer.com/apigateway/petstoreProxy?swagger.json

Swagger 2.x (YAML)

• https://demo.apinizer.com/apigateway/petstoreProxy?swagger&format=yaml
• https://demo.apinizer.com/apigateway/petstoreProxy?swagger.yaml

OpenAPI 3.x (JSON)

• https://demo.apinizer.com/apigateway/petstoreProxy?openapi
• https://demo.apinizer.com/apigateway/petstoreProxy?openapi&format=json
• https://demo.apinizer.com/apigateway/petstoreProxy?openapi.json

OpenAPI 3.x (YAML)

• https://demo.apinizer.com/apigateway/petstoreProxy?openapi&format=yaml
• https://demo.apinizer.com/apigateway/petstoreProxy?openapi.yaml

WSDL (If API Proxy is SOAP)

• https://demo.apinizer.com/apigateway/calc?wsdl

JWK Set (signing and encryption keys)

The gateway publishes the public keys used by an API Proxy's JOSE policies as a JSON Web Key Set (JWKS). Clients can use the keys from these addresses to verify signed responses or to encrypt content they send to the API Proxy.

These addresses are not API specification documents; a ?swagger or ?openapi request does not return JWK content.

Example base address: https://demo.apinizer.com/apigateway/petstoreProxy

Address	Content
https://demo.apinizer.com/apigateway/petstoreProxy?jwk-sign.json	Signing / signature verification (JWS) keys
https://demo.apinizer.com/apigateway/petstoreProxy?jwk-enc.json	Encryption / decryption (JWE) keys

Which keys are in the set?

The set is built from the JWKs selected in the JOSE Verification and JOSE Application policies attached to the API Proxy (at API Proxy, endpoint, and error flow level):

• ?jwk-sign.json → JWKs selected for signing and verification in those policies
• ?jwk-enc.json → JWKs selected for encryption and decryption in those policies

Each key is returned with fields from its JWK definition, such as kid, alg, and use.

Response

• The response always has status 200 and content type application/json.
• The response contains public key material only (RFC 7517 keys array). Private keys and secret key material are never returned.
• If the API Proxy has no JOSE policy with a key of that kind selected, the response is an empty set: {"keys":[]}.

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "petstore-sign-key",
      "use": "sig",
      "alg": "RS256",
      "n": "0vx7agoebGcQSuu...",
      "e": "AQAB"
    }
  ]
}

Warning

API specification access control applies only to ?wsdl, ?wadl, ?swagger, ?openapi, and ?xsd requests. JWK Set addresses do not go through this check; even if you restrict access to specification files, ?jwk-sign.json and ?jwk-enc.json stay reachable. Since these addresses return public keys only, this is not a security gap, but keep in mind that the key list is visible from outside.

Next Steps

General Information Tab

API Proxy general information

Settings

API Proxy settings

Design

API Proxy design tab