16 docs tagged with "API7 Whitepaper"

Data Plane

API7 has built-in authentication authentication plugins such as key-auth, basic-auth, jwt-auth, etc. Taking HMAC plugin as an example, API7 can work with AK/SK to encrypt the request parameters to ensure that the request has not been tampered with.

Routing is the core function of the API gateway, which is used to route and match requests passing through the API gateway and forward them to the corresponding upstream service. When the upstream service finishes processing, the result is returned to the client. If a request does not match a route, the gateway will return a 404 status code because the route has not been published to the gateway or the route is not configured.

API Management

API and Service Governance

API7 Highlights

API7 has a built-in log auditing module, which collects system security events, administrator operation records, system operation logs, system operation status and other kinds of information in the information system centrally, and then stores and manages them centrally in the form of logs in a unified format after normalization, filtering and consolidation, combining with rich log statistical summary and correlation analysis functions to realize comprehensive auditing of information system logs. Through post-event analysis and reporting system, administrators can easily and efficiently conduct targeted security audits on information systems; when encountering special security events or configuration failures, the log auditing system can help administrators conduct rapid configuration positioning and rollback. Only administrators with authority can perform operation rollback.

API7 mainly contains the following functional modules:

API7 records the basic information and status of each request. With the help of the statistical report page in the dashboard control panel, administrators can see the status of each service call, status code distribution, number of successes, number of failures, top 95 values, top 99 values and other information. It is convenient for administrators to understand the health of the system. In addition, the data plane will regularly report the traffic processing situation, and the administrator can view the gateway operation status and other indicators, such as error rate, number of requests, status code distribution, etc., within a certain time period through the control panel. When the administrator presets the alarm rules through the control panel, if the traffic reported by the gateway matches the rules, it will trigger the preset policies, such as sending station letters, email alerts, SMS and Webhook notifications, etc.

API7 has a built-in workspace module, super administrators need to create multiple workspaces, then create ordinary users and assign different permissions (in the configuration of permissions, you can bind workspace and resource permissions), so that the combination of the user system and permission management can achieve different users in different workspaces, different permissions for different resources, in order to achieve fine-grained control of resources permissions.

API7.ai's API Gateway product (hereinafter referred to as API7) is built based on Apache APISIX, a top-level project of the Apache Software Foundation. API7 consists of 3 components: API Gateway, ManagerAPI and Dashboard Control Panel.

API7 adopts excellent performance solutions in all aspects from route matching, JSONSchema validation, and plugin operation.

API7 has more than 60 built-in common plugins, covering authentication, security protection, traffic control, analysis and monitoring, request/response conversion and many other categories. Some popular plugins are listed in the chart below.

API7 exposes RESTful APIs uniformly to the outside world, which can be set by administrators in the control panel. These APIs correspond to microservices/upstream services in the enterprise and support proxies for protocols such as Dubbo, gRPC, WebServices, MQTT, etc., in addition to common HTTP services.

API7 will triage the matched requests according to the preset weights and parameters.

API7 has built-in service governance features such as flow and rate limiting, service meltdown, IP blacklist and whitelist, and fault isolation.