Who calls your APIs, what they can send, and who changed the rules
Authentication, access rules, request validation and data masking for every API, with certificates and secrets in the same console. Roles and an audit record control who changes them. All of it runs in your own infrastructure.
Controls in every edition · directory roles and audit log in Enterprise
A control at the gateway for each risk to your APIs
Each control is a Plugin of the G8 engine with its own form in the G8 console. Attach it to a Route, a Service or a Consumer, or apply it to every request in an Environment.
Check who calls your APIs
Verify callers with OpenID Connect, LDAP, SAML, Keycloak, JWTs, API keys or signed requests, or ask them for a client certificate with mutual TLS. Accept more than one method on the same Route.
- Your identity providerG8 connects to the identity provider or directory you already run.
- Directories tooLDAP directories and SAML providers are Plugins like any other, attached to a Route.
- Mutual TLSA Certificate can require client certificates signed by the CA you provide, and skip the check for the paths you name.
Limit what each client can send
Limit requests, request rates and concurrent connections per client, Consumer or a key you choose. Charge GraphQL queries by their cost, and stop sending requests to a failing backend.
- GraphQL limitsA query is priced by its depth, its weighted complexity or its node quantifiers, and the price is counted against the limit.
- On each node or sharedCount on each gateway node, or share the count across nodes in Redis.
- Connections in flightlimit-conn caps how many requests one key may have open at once.
Decide which clients get through
Allow or deny clients by IP address, User-Agent or Referer, set CORS rules, protect browser sessions against cross-site request forgery and block requests by URI. Restrict a Route to the Consumers, Consumer groups or Consumer labels you name.
- Allow or deny by addressAn allow list refuses every address outside it; a deny list refuses the addresses on it.
- Labels from your identity provideracl allows or denies Consumers by their labels, including labels read from the claims an authentication Plugin identified.
- The status you chooseA refused address is answered with the code you set.
Refuse malformed requests at the gateway
Check request headers and bodies against a JSON schema, or check requests against your OpenAPI document, before they reach the backend.
- A schema for the bodyThe request body must match the JSON Schema you give.
- Headers tooA second schema checks request headers.
- Your status, your messageChoose the status and the message a refused request is answered with.
Keep sensitive data out of your logs
Mask or remove headers, query arguments and body fields in the lines your logger Plugins write. Traffic Explorer masks the values you name before a request record is stored.
- Masked before it’s storedTraffic Explorer masks headers such as authorization, cookie and apikey by default. Add the headers, query arguments and body fields you want masked.
- The logged copydata-mask changes what is logged. The backend receives the request as it was sent.
- Bodies behind their own permissionRecording bodies is a setting. Viewing one needs the permission for request bodies, and every view is written to the audit log.
Certificates and secrets, managed in the console
- TLS and mutual TLSCertificates terminate TLS for the server names they cover. Require client certificates signed by your CA, and present a client certificate to your backends.
- Expiry in the listG8 reads each Certificate’s validity dates and flags those close to expiry.
- Private keys not shown againWhen you paste a Certificate, G8 checks that the private key matches it. After you save, the key isn’t shown again.
Who can change security settings
Roles, Environments and the audit log are shared by every area of G8 and described on the API Gateway page. Here is what they mean for security settings.
- Roles per EnvironmentA role applies within an Environment, and a person can hold a different role in each one.
- Custom rolesChoose what a role can view and what it can manage, including certificates, secrets, Traffic Explorer and request bodies.
- Active Directory groupsMap Microsoft Active Directory groups to roles.
- Service accountsAutomation uses service account tokens that expire and can be revoked.
- Checked and recorded firstThe G8 engine checks each configuration change, and G8 records it before it’s applied.
- Refused attempts recordedWhen a role doesn’t allow a change, the change is refused and recorded with the permission it needed.
Security settings, request records and the audit log stay in your infrastructure
Nothing leaves it except what you configure, such as sign-ins checked by your identity provider and secrets read from your secret manager.
What the security controls connect to
API Security runs on the same G8 engine clusters as API Gateway. Each control needs only what it connects to, and only when you use it.
For authentication with OpenID Connect, SAML, LDAP or Keycloak: the one you already run.
Only if you keep secrets outside G8: Vault, AWS Secrets Manager or GCP Secret Manager.
Only for limits shared across gateway nodes.