| title | API Gateway User Manual |
|---|---|
| sidebar_position | 0 |
| slug | / |
A high-performance, feature-rich API gateway supporting HTTP, TCP, and UDP proxying with extensive middleware capabilities.
- Getting Started — Installation, CLI flags, minimal config
- Core Concepts — Listeners, routes, backends, request pipeline
- Examples — Full worked configurations
- Benchmarks — Performance benchmarks and tuning
- Load Balancing — Round-robin, least-conn, consistent-hash, least-response-time
- Traffic Management — Traffic splits, A/B testing, sticky sessions
- Canary Deployments — Progressive rollouts with metrics-based promotion
- API Versioning — Path, header, accept, query-based version routing
- URL Rewriting — Prefix stripping, regex rewrite, host override
- Service Discovery — Consul, etcd, Kubernetes, memory registry
- Sequential Proxy — Multi-step sequential backend calls with data piping
- Response Aggregation — Parallel multi-backend calls with JSON merge
- Follow Redirects — Backend redirect following
- Passthrough — Raw body passthrough mode
- Protocol Translation — HTTP-to-gRPC, HTTP-to-Thrift, REST mappings, WebSocket proxy
- GraphQL Protection — Depth/complexity limits, introspection, operation rate limits
- GraphQL Federation — Schema stitching across multiple GraphQL backends
- gRPC Proxy — gRPC-aware proxying with deadline propagation, metadata transforms, reflection
- HTTP/3 & QUIC — HTTP/3 listener and upstream support
- SSE Proxy — Server-Sent Events proxy with heartbeat, event injection, and streaming
- Resilience — Retries, budget, hedging, circuit breakers, timeouts
- Adaptive Concurrency — AIMD-based concurrency control
- Graceful Shutdown — Shutdown timeout, connection draining
- Transport — HTTP transport pool configuration
- Rate Limiting & Throttling — Rate limits, throttle, bandwidth, priority, fault injection
- Service Rate Limiting — Global service-level throughput cap
- Spike Arrest — Per-second burst protection
- Quota — Daily/hourly quota enforcement
- Security — IP filtering, CORS, WAF, body limits, DNS resolver
- Authentication — API key, JWT/JWKS, OAuth/OIDC, mTLS
- External Auth — Delegated auth via HTTP/gRPC service
- CSRF Protection — Cross-site request forgery prevention
- Idempotency — Idempotency key support for safe retries
- Replay Prevention — Nonce-based replay attack prevention
- Bot Detection — User-Agent regex deny/allow lists
- SSRF Protection — Block outbound connections to private IPs
- Request Deduplication — Content-hash dedup for duplicate webhook deliveries
- Dynamic IP Blocklist — Subscribe to external threat feeds for auto-blocking
- Caching — Response caching, GraphQL-aware cache keys
- Shared Cache Buckets — Cross-route cache sharing
- CDN Cache Headers — Cache-Control and Surrogate-Control injection
- Transformations — Headers, body, variables, path rewrite, validation, compression
- Response Body Generator — Go template-based response rewriting
- Response Flatmap — Array manipulation and data extraction
- Content Negotiation — Accept-based JSON/XML/YAML conversion
- Content Replacer — String/regex replacement in response bodies
- Parameter Forwarding — Zero-trust header/query/cookie forwarding
- Body Generator — Request body generation from templates
- Backend Encoding — Backend response re-encoding
- Status Mapping — Response status code remapping
- Response Limits — Response size limiting
- Validation — Request/response JSON schema validation
- Static Files — Static file serving
- FastCGI Proxy — PHP-FPM and FastCGI backend proxying
- Mock Responses — Static mock response configuration
- Error Pages — Custom error page templates
- Observability — Logging, Prometheus metrics, OpenTelemetry tracing
- Webhooks — Event notification via HTTP webhooks
- Debug Endpoint — Runtime debug information
- Traffic Mirroring — Shadow traffic, conditions, comparison
- Developer Portal — Browsable API catalog with OpenAPI spec viewer
- Admin API Reference — Health, feature endpoints, dashboard, reload
- Configuration Reference — Complete YAML schema
- Rules Engine — Expression syntax, request/response rules, actions
- Template Functions — Sprig and custom template function reference