Security and Compliance Overview

API7 Gateway sits between API clients and upstream services, while its Control Plane manages routes, credentials, plugins, and operator access across the deployment. Securing this architecture requires controls for authenticating clients and administrators, authorizing access, protecting traffic, restricting management interfaces, and reviewing supported administrative activity. These controls apply at different trust boundaries and should be configured for your deployment topology, security policies, and compliance requirements.

Authentication and Access Management

Verifying the identity of every client, user, and system component is the foundation of a zero-trust security posture. API7 supports a wide range of industry-standard authentication mechanisms to ensure that only legitimate traffic can access your APIs and management interfaces.

• Mutual TLS (mTLS): Data Plane deployments generated by the Dashboard use certificate-based authentication on DP Manager port 7943. Port 7900 also accepts HTTP connections with instance-token authentication; traffic on this port is not encrypted, so restrict it to trusted networks.
• OAuth 2.0 / OIDC: Integrates with external identity providers (IdPs) like Okta, Keycloak, and others to enable modern, token-based authentication for your APIs.
• Single Sign-On (SSO): Centralizes user access to the API7 Dashboard through your corporate identity provider, streamlining user management and improving security.
• Role-Based Access Control (RBAC): Provides granular control over user permissions within the API7 Dashboard, allowing you to define roles that align with your organizational structure.

Authorization and Access Control

Once a client is authenticated, authorization determines what actions they are permitted to perform. API7 provides powerful, flexible tools to enforce fine-grained access control policies, ensuring that clients can only access the resources they are explicitly granted permission to use.

• Access Control Lists: Restrict API access to specific consumers, services, or routes, often in conjunction with API keys or other authentication methods.
• Role-Based Access Control (RBAC): Extends beyond the dashboard to the API traffic itself, allowing you to define complex authorization logic based on user roles and permissions.
• Permission Policies and Boundaries: Implement sophisticated, attribute-based access control (ABAC) by defining policies that can evaluate context from JWTs, request headers, and other sources to make dynamic authorization decisions.

API Threat Protection

Protecting APIs also requires controls that inspect request content and behavior, not just client identity and permissions.

• Web Application Firewall (WAF): Integrate a WAF with API7 Gateway to inspect requests for common web attacks such as SQL injection and XSS. See Web Application Firewall (WAF).

Data Protection and Encryption

Protecting the confidentiality and integrity of your data, both in transit and at rest, is a critical compliance requirement. API7 provides robust encryption capabilities and secure credential management to safeguard sensitive information.

• Secure Credentials Management: Securely stores and manages sensitive values like SSL certificates, passwords, and API tokens. Integration with external secret managers like HashiCorp Vault and AWS Secrets Manager is supported for centralized control.
• End-to-End Encryption: Utilizes TLS to encrypt data in transit from the client to the gateway and from the gateway to upstream services, preventing eavesdropping and man-in-the-middle attacks.

Infrastructure Security

Securing the gateway infrastructure itself is as important as securing the API traffic it manages. API7 includes features designed to harden the control and data planes against direct attacks and unauthorized configuration changes.

• Secure the Control Plane with IP Restrictions: Limits access to the Admin API and Dashboard to a trusted list of IP addresses, significantly reducing the attack surface.
• Verify Signature of Signed Images: Ensures the integrity and authenticity of the API7 Gateway container images you deploy, guaranteeing that they have not been tampered with and originate from a trusted source.

Monitoring and Auditing

Visibility into administrative activity is essential for threat detection, incident response, and compliance. API7 records covered administrative operations to support investigations and compliance reviews.

• Audit Logs: Records covered changes to routes, plugins, security policies, and other resources with operator and request context. See Audit Logs for coverage limitations and sensitive-data handling.
• Integration with SIEM: Logs can be exported to external Security Information and Event Management (SIEM) platforms like Splunk or Elastic for advanced analysis, correlation, and alerting.

Compliance and Governance

Meeting industry and regulatory compliance standards is a key function of an enterprise-grade API gateway. API7 is designed with compliance in mind, providing the features and transparency needed to pass security audits.

• Licenses for open-source software: Provides clear documentation on the open-source components used within API7 and their respective licenses, simplifying license compliance efforts.
• Vulnerability Scanning: Separate weekly workflows scan Control Plane and Gateway development images and open tracking issues for fixable high- and critical-severity findings. The workflows support monitoring and triage but do not block releases.
• Trust Center: A centralized resource for all security and compliance-related information, including certifications, security reports, and best practice guides.