GLOSSARY

An intermediary that exposes, routes, secures, controls, and observes requests between API clients and backend services.

API gateways centralise cross-cutting controls, simplify client integration, and protect backend services. They support consistent policy enforcement and operational visibility across many APIs.

A company places a gateway before payment and account services to validate tokens, enforce per-client quotas, route versions, redact sensitive logs, and monitor latency and errors.

A gateway can become a bottleneck or high-impact failure point. Excessive logic at the gateway increases coupling, and it does not replace secure backend design, service identity, or API lifecycle governance.

A gateway can terminate TLS, authenticate clients, authorise requests, apply quotas and rate limits, transform messages, route by version or path, cache responses, aggregate services, and emit telemetry. It provides a managed entry point while hiding internal service topology.