Every rule your APIs need, on a gateway you run yourself
Rate limits, identity with OpenID Connect, JWT or LDAP, access rules and traffic management for every API, managed in one place. Analytics and request records stay in your own data stores.
Plugins in every edition · Environments, observability, audit log in Enterprise
Limits, identity and traffic rules for every API
G8 API Gateway runs every Plugin of the G8 engine and manages them from the G8 console. Attach them to a Route, a Service or a Consumer, or apply them across the gateway.
Limit what each client can send
Limit requests, request rates and concurrent connections by client, Consumer or a key you choose.
- Per Route or across the gatewayAttach a limit to a Route, a Service or a Consumer, or apply it to every request.
- Limits from the requestSet the count and the window as numbers, or read them from each request, such as from a header.
- Settings in the formCount, Time window, Key type, Key, Policy, Window type and Rejected code.
Check who calls your APIs
Verify callers with OpenID Connect, LDAP, SAML, Keycloak, JWTs, API keys or signed requests, and accept more than one method on the same Route.
- Your identity providerG8 connects to the identity systems you already run.
- Secrets masked by roleA client secret is shown only to roles that manage the object it belongs to.
- Settings in the formDiscovery, Client ID, Client secret, Bearer only and Unauth action.
Decide which clients get through
Allow or deny clients by IP address or User-Agent, set CORS rules and block requests by URI. Restrict a Route to the Consumers or groups you name.
- Where each rule runsThe catalog shows the Routes that use each Plugin in the Environment.
- One Plugin per ruleAllow by address, block by URI, restrict to Consumers: each rule is a Plugin on the Route.
Change requests and responses in flight
Rewrite requests and responses on their way through the gateway, including gRPC transcoding.
- Headers and HostSet the Host sent to the upstream, and add, set or remove request headers.
- Three header listsHeaders to append, headers to write over and headers to drop.
- Settings in the formURI, Regex URI, Host, Method and Headers.
Answer repeated requests from the gateway
Cache upstream responses on disk or in memory, keyed on the parts of the request you choose.
- Settings in the formCache strategy, Cache zone, Cache key, Cached request methods, Cached response statuses and more.
- Memory or diskA zone the gateway declares for the strategy: memory_cache or disk_cache_one, as shipped.
- Keyed on the requestHost and URI by default, or the parts of the request you choose.
Release backends gradually
Split traffic between upstream versions for canary releases, and stop sending requests to a failing backend.
- Canary splitsSplit traffic between upstream versions by weight and match rules.
- Circuit breakerWhile the breaker is open, clients get the response you set and the upstream isn’t asked.
- Settings in the formBreak response code, Unhealthy and Healthy HTTP statuses and Break response body.
Refuse malformed requests at the gateway
Check requests against a JSON schema or against your OpenAPI document before they reach the backend.
- Settings in the formDocument URL, Rejection status code and Skip body, header, query or path parameter validation.
- Only what the document allowsA request the document does not describe is refused, naming the parameter or property that failed if you choose.
- The status you chooseA refused request is answered with the code you set.
The systems around your gateway
Identity
- OpenID Connect
- LDAP
- SAML
- Keycloak
- JWT
- API keys
- Signed requestsHMAC
Also basic authentication, Open Policy Agent and forward authentication. Accept more than one method on the same Route.
Logs
- HTTP endpoints
- Kafka
- Elasticsearch
- syslog
Access logs go to the systems you already run.
Metrics and traces
- Prometheusmetrics
- Zipkintraces
Expose request metrics and export traces from the gateway.
Secrets
- Vault
- AWS Secrets Manager
- GCP Secret Manager
Keep secrets in the secret manager you run and refer to them from G8.
Analytics, request records and alerts from your own data stores
Each Environment reads its request counts from your Prometheus and its request records from your Elasticsearch or OpenSearch. Records and counts stay in the stores you run.
Traffic Explorer: the gateway’s own request records
Search request records by path, client IP, request ID, Route, Service or Consumer, follow new requests live, and open a record to see its headers, timing and the gateway node that served it. Copy a request as cURL or export the list as CSV.
- Masked before it’s storedHeaders such as authorization, cookie and apikey are masked by default. Add the headers, query arguments and body fields you want masked.
- Bodies behind their own permissionRequest and response bodies can be recorded. Viewing one takes its own permission and is written to the audit log.
- Kept as long as you decideYou set how many days records are kept.
Analytics: requests, errors and response times, beside the changes
Request counts beside last week’s, response time percentiles as the client, the backend and the gateway see them, status shares by source, and the Routes, Services and Upstreams with the most requests, the most 5xx and the slowest responses. Routes, Services, Upstreams and Consumers each have an Analytics tab.
- Changes in this windowThe changes made in the selected window come from the audit log and sit beside the charts.
- Gateway nodesSee which nodes receive traffic, which are up with no requests and which can’t be reached, with the reason.
Alerts that G8 evaluates itself
Rules on response share, response time or request count, for an Environment, a Route, a Service, an Upstream or a Consumer. System alerts tell you when the engine or Prometheus can’t be reached, or when a gateway node stops reporting or runs a configuration behind the others.
- Email and signed webhooksAlerts go to mail lists through your mail relay and to webhooks signed with HMAC-SHA256.
- Mute and historyMute a rule until a time you choose. The History tab keeps past alerts.
Analytics and Alerts need a Prometheus for the Environment. Traffic Explorer needs Elasticsearch or OpenSearch. Without one, its page in the console says Not connected.
Every resource type and Plugin, in forms or raw JSON
Plugins with settings get a form, and each object can also be edited as raw JSON. The G8 engine checks each change, and G8 records it before it’s applied.
Forms and raw JSON
The form and raw JSON show the same configuration. Fields the form doesn’t cover are kept as stored.
The console covers every resource type of the G8 engine:
- Routes
- Services
- Upstreams
- Consumers
- Consumer groups
- Credentials
- Certificates
- Secrets
- Global rules
- Plugin configs
- Plugin metadata
- Protos
- Stream routes
Stream routes appear when the G8 engine runs in stream mode.
Checked by the G8 engine before it’s applied
The G8 engine checks each configuration change. If it refuses one, nothing is applied.
If the engine objects to a create or an edit, its message appears under the field.
If a gateway object changes after you open it, G8 stops your save and shows the conflict. You then choose whether to reload the current version or overwrite it.
Certificates and secrets
- When you paste a Certificate, G8 shows its domain names and validity dates and checks that the private key matches it.
- Certificates close to expiry are flagged. After you save, the private key isn’t shown again.
- Keep secrets in Vault, AWS Secrets Manager or GCP Secret Manager and refer to them from G8.
The Plugin catalog and the request path
The catalog is grouped by category and shows where each Plugin is used in the Environment. On a Route, the request path view shows which Plugins apply and in what order.
Automation through the management API
The management API is documented with OpenAPI, and the console uses the same API. Automate gateway configuration from your CI/CD pipelines with service account tokens. Service accounts hold Environment roles only: they can work with gateway configuration, but not with users, roles or Environments.
Control from one console
The console, Environments, roles and the audit log are shared by API Gateway, AI Gateway, API Security and Developer Portal. They are described once, here.
One console for every gateway cluster
API and AI traffic are managed from the same console, for every Environment.
Gateway: Routes, Services, Upstreams, Consumers, Certificates and Plugins. Observe: Analytics, Traffic Explorer, Alerts and the audit log. Administration: Environments, users and access.
The console hides the menus and buttons your role doesn’t allow.
When an Environment has no Prometheus or log store connected, its Observe pages say Not connected.
The console is in English.
Every Environment from your G8 installation
An Environment is a gateway cluster, such as Development, Staging or Production. Add a cluster you already run: adding or removing an Environment doesn’t touch the G8 engine. Test the connection before you save. If the test fails, it names the problem, such as a wrong key, a wrong address, a timeout, a DNS failure or a certificate problem.
A role granted for Staging gives no access to Production. An Environment’s objects, roles and audit records don’t appear in another Environment.
Before you copy a Route, Service or Upstream to another Environment, G8 shows what the copy will change there and which dependencies are missing. You choose whether secrets are copied, and nothing is written to the target until you save.
Mark an Environment as protected. In a protected Environment, deleting an object requires typing its name, and the Environment itself can’t be deleted.
Access by role and Environment
The built-in roles are Platform administrator, Environment administrator, Editor and Viewer. Platform administrator manages users, roles and Environments, and has full control of every Environment. The other roles apply to the Environments they’re granted for: an Environment, or all Environments.
When a built-in role doesn’t fit, build a custom role in the permission grid by choosing what it can view and what it can manage.
Map Microsoft Active Directory groups to roles.
If you change someone’s role in G8 or disable their account, the change takes effect on their next request.
Service accounts handle automation. Their tokens expire, are shown only when created and can be revoked.
Roles that can’t manage a resource see its secret fields masked. If a save contains a masked value, G8 refuses it and the real secret stays as it was.
Recorded before it’s applied
If the audit record can’t be written, the change isn’t applied.
- When someone changes gateway configuration through G8, the change passes a role check, and an audit record is opened before it’s applied.
- Changes to users, roles and Environments are saved together with their audit record.
- The G8 engine checks each configuration change. If it refuses a change, nothing is applied.
- Change attempts that a role doesn’t allow are recorded too.
- A record shows who acted, when, and the outcome. For a gateway change, it also shows the Environment and the values before and after the change, with secret fields masked.
- Filter the records and export them as CSV. You decide how long they’re kept.
- Every audit record is also written as a structured log line that your log collector can take to your SIEM.
- From within the application, a completed record can’t be changed or deleted, and it’s removed only when the retention period you set runs out.
What API Gateway needs from your infrastructure
Every part of G8, including its console, runs in your infrastructure. This is what it needs there.
One for each Environment, such as Development, Staging and Production. Add clusters you already run.
G8 keeps its data in a database you provide.
For Analytics and Alerts, in each Environment where you want them.
For the request records of Traffic Explorer, in each Environment where you want them.