# Architecture

API7 Enterprise is a suite of API management components, including API7 Gateway as its traffic processing layer. API7 Gateway uses a decoupled architecture that separates the management logic (Control Plane) from the request processing logic (Data Plane). This design ensures high availability, security isolation, and independent scalability.

## Decoupled architecture[​](#decoupled-architecture "Direct link to Decoupled architecture")

Data Plane deployments generated by the Dashboard connect to the Control Plane over mTLS on port `7943`. The DP Manager also accepts HTTP connections without transport encryption on port `7900` for compatibility, so restrict that path to trusted networks. The decoupled architecture allows the Control Plane and Data Plane to run in different environments or regions.

<!-- -->

## Control plane (CP)[​](#control-plane-cp "Direct link to Control plane (CP)")

The control plane is the management hub for API7 Gateway. It is a Go-based service that provides the following components:

* **Dashboard and Admin API**: Provides a web-based interface and a RESTful API for managing all gateway configurations. Default port is `7443` (HTTPS).
* **PostgreSQL Database**: Stores all persistent configurations, including services, routes, consumers, and audit logs. PostgreSQL is the primary and recommended storage backend; the Control Plane also supports MySQL and Microsoft SQL Server as alternative backends — see [Supported Versions and Interoperability](https://docs.api7.ai/api7-gateway/install/supported-versions-and-interoperability.md#database-support) for details.
* **DP Manager**: Exposes an **etcd v3–compatible API** on port `7943` with mTLS. It also accepts HTTP connections on port `7900` for compatibility, using an instance token for authentication. Internally, the DP Manager serves this API through an embedded [kine](https://github.com/k3s-io/kine) shim backed by the Control Plane database, so data plane nodes can use the standard Apache APISIX etcd client to watch configuration without requiring an etcd cluster.

## Data plane (DP)[​](#data-plane-dp "Direct link to Data plane (DP)")

The data plane is the high-performance proxy engine that processes incoming API requests. It is built on OpenResty and Lua.

### Core components[​](#core-components "Direct link to Core components")

* **Proxy Engine**: Handles HTTP, HTTPS, gRPC, and TCP/UDP traffic. Default ports are `9080` (HTTP) and `9443` (HTTPS).
* **Stateless Operation**: Data plane nodes are stateless. They receive configuration from the control plane and store it in memory for fast access.
* **EE Agent**: A specialized component (`agent/hook.lua`) that handles communication with the control plane, manages shared dictionaries for discovery data, and merges configuration updates.

### Health and observability[​](#health-and-observability "Direct link to Health and observability")

* **Health Endpoints**: When the status listener is enabled, each DP node provides `/status` (liveness) and `/status/ready` (readiness) on the configured address and port. The gateway Helm chart enables this listener through `api7ee.status_endpoint.enabled`; `api7ee.status_endpoint.port` selects the port and defaults to `7085`. The listener is disabled by default.
* **Prometheus Metrics**: Metrics are exposed on port `9091` at `/apisix/prometheus/metrics`.

## CP–DP communication[​](#cpdp-communication "Direct link to CP–DP communication")

API7 Gateway uses the same **pull/watch model** as open-source Apache APISIX for configuration synchronization. Each data plane node runs the standard APISIX etcd client and connects outbound to the DP Manager. Dashboard-generated deployments use port `7943` over mTLS. The DP Manager also accepts HTTP connections on port `7900` with instance-token authentication, but those connections are not encrypted. Once connected, the data plane watches the etcd-compatible key space for configuration changes and applies them to its in-memory cache as soon as they arrive.

The only difference from upstream APISIX is the storage backend: instead of a real etcd cluster, the DP Manager uses [kine](https://github.com/k3s-io/kine) to translate the etcd v3 API to PostgreSQL reads and writes. From the data plane's perspective, the DP Manager behaves exactly like an etcd cluster.

### Secure communication[​](#secure-communication "Direct link to Secure communication")

On port `7943`, the data plane presents a client certificate issued by API7's internal CA. The DP Manager validates that certificate before serving configuration data, and the data plane validates the server certificate against its configured CA. Use this mTLS listener for production deployments. Restrict HTTP port `7900` with firewall rules or network policies, and never expose it to the public internet.

### Fault tolerance[​](#fault-tolerance "Direct link to Fault tolerance")

Running gateway nodes can continue serving traffic from their last known configuration while the control plane is unreachable. Configuration updates and administrative tasks such as publishing routes pause until the connection returns. A request can still fail when it must look up a consumer or developer through the control plane and that result is not already cached. [Fallback storage](https://docs.api7.ai/api7-gateway/configure-and-manage/data-plane-resilience.md) lets a gateway start from a saved snapshot if it must restart during an outage.

## Comparison: Open-Source vs. Enterprise[​](#comparison-open-source-vs-enterprise "Direct link to Comparison: Open-Source vs. Enterprise")

| Feature                      | Open-Source APISIX                      | API7 Enterprise                                                                                                                                                   |
| ---------------------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Primary storage**          | Standalone etcd cluster                 | PostgreSQL (via kine etcd shim)                                                                                                                                   |
| **Config API exposed to DP** | etcd v3 (native)                        | etcd v3 (compatible, backed by PostgreSQL)                                                                                                                        |
| **Config sync model**        | Pull / watch                            | Pull / watch (identical semantics)                                                                                                                                |
| **CP–DP transport**          | Plain etcd client over gRPC or HTTP     | Dashboard-generated deployments use mTLS on port `7943`. Port `7900` accepts HTTP with instance-token authentication and should be restricted to trusted networks |
| **Management surface**       | Admin API                               | Dashboard + Admin API + ADC                                                                                                                                       |
| **Scaling**                  | Scale etcd cluster and DP independently | Scale PostgreSQL, CP, and DP independently                                                                                                                        |

## Next steps[​](#next-steps "Direct link to Next steps")

* [Deploy on Kubernetes](https://docs.api7.ai/api7-gateway/install/deploy-on-kubernetes.md) — deploy the gateway in a Kubernetes cluster.
* [Configure Control Plane](https://docs.api7.ai/api7-gateway/configure-and-manage/configure-control-plane.md) — tune CP settings for your environment.
* [Configure Data Plane](https://docs.api7.ai/api7-gateway/configure-and-manage/configure-data-plane.md) — customize DP proxy behavior.