Security and Compliance Overview

API7 Gateway carries the data flows between a distributed landscape of applications and services, so securing it matters. The security and compliance features in this section protect your APIs from threats, enforce granular access control, and meet regulatory standards. The security model has several layers, which you can tailor to your organization's needs.

Authentication and access management

Verifying the identity of every client, user, and system component is the foundation of a zero-trust security posture. API7 supports industry-standard authentication mechanisms, including the following, so that only legitimate traffic reaches your APIs and management interfaces.

• Mutual TLS (mTLS): Enforces strong, certificate-based authentication between the control plane and data plane, ensuring all management traffic is encrypted and verified.
• OAuth 2.0 / OIDC: Integrates with external identity providers (IdPs) like Okta, Keycloak, and others to enable modern, token-based authentication for your APIs.
• Single Sign-On (SSO): Centralizes user access to the API7 Dashboard through your corporate identity provider, which keeps user management in one place and improves security.
• Role-Based Access Control (RBAC): Provides granular control over user permissions within the API7 Dashboard, allowing you to define roles that align with your organizational structure.

Authorization and access control

Once a client is authenticated, authorization determines what actions they are permitted to perform. API7 enforces fine-grained access control policies, so that a client reaches only the resources it has been granted permission to use.

• Access Control Lists (ACLs): Restrict API access to specific consumer groups, often used in conjunction with API keys or other authentication methods.
• Role-Based Access Control (RBAC): Governs what administrators and operators can do in the control plane — the Dashboard and the Admin API. It does not apply to proxied API traffic; authorization for that is configured per route with plugins such as acl (opens in Plugin Hub docs) and consumer-restriction (opens in Plugin Hub docs).
• Permission Policies and Boundaries: Narrow a role's grants with policies whose conditions match on resource labels (MatchLabel) or on a user's permission boundaries (AllOfStrings). These are control-plane IAM policies; they do not read JWT claims or request headers.

API threat protection

Protecting APIs also requires controls that inspect request content and behavior, not just client identity and permissions.

• Web Application Firewall (WAF): Integrate a WAF with API7 Gateway to inspect requests for common web attacks such as SQL injection and XSS. See Web Application Firewall (WAF).

Data protection and encryption

Protecting the confidentiality and integrity of your data, both in transit and at rest, is a critical compliance requirement. API7 provides encryption capabilities and secure credential management to safeguard sensitive information.

• Secure Credentials Management: Securely stores and manages sensitive values like SSL certificates, passwords, and API tokens. Integration with external secret managers like HashiCorp Vault and AWS Secrets Manager is supported for centralized control.
• End-to-End Encryption: Uses TLS to encrypt data in transit from the client to the gateway and from the gateway to upstream services, preventing eavesdropping and man-in-the-middle attacks.

Infrastructure security

Securing the gateway infrastructure itself is as important as securing the API traffic it manages. API7 includes features designed to harden the control and data planes against direct attacks and unauthorized configuration changes.

• Secure the control plane with IP restrictions: Limits access to the Admin API and Dashboard to a trusted list of IP addresses, which reduces the attack surface.
• Verify Signature of Signed Images: Ensures the integrity and authenticity of the API7 Gateway container images you deploy, guaranteeing that they have not been tampered with and originate from a trusted source.

Monitoring and auditing

Visibility into system activity supports threat detection, incident response, and compliance. API7 generates detailed logs for all critical operations, providing a complete audit trail of administrative actions and security events.

• Audit Logs: Records all changes made through the control plane, including modifications to routes, plugins, and security policies. This provides a clear, chronological record of who did what, and when.
• Integration with SIEM: Logs can be exported to external Security Information and Event Management (SIEM) platforms like Splunk or Elastic for advanced analysis, correlation, and alerting.

Compliance and governance

Meeting industry and regulatory compliance standards is a key function of an API gateway in a regulated environment. API7 is designed with compliance in mind, providing the features and transparency needed to pass security audits.

• Licenses for Open Source Software: Provides clear documentation on the open-source components used within API7 and their respective licenses, simplifying license compliance efforts.
• Vulnerability Scanning: API7 undergoes continuous security testing and vulnerability scanning. API7.ai is committed to transparently reporting and promptly patching any identified vulnerabilities.
• Trust Center: A centralized resource for all security and compliance-related information, including certifications, security reports, and best practice guides.