Plugin Hub

The ai-aliyun-content-moderation plugin uses Aliyun to evaluate selected request roles and LLM responses, including streaming responses, against a risk threshold.

The ai-aws-content-moderation plugin uses Amazon Comprehend to detect toxicity in selected request roles and LLM responses, including streaming responses.

The ai-cache plugin stores exact and semantically similar LLM responses in Redis, reducing response latency and repeated upstream model usage.

The ai-lakera-guard plugin screens AI traffic through the Lakera Guard API to detect prompt injection and other unsafe content in requests and LLM responses.

The ai-prompt-decorator plugin decorates user prompts to LLMs by prefixing and appending pre-engineered prompts, streamlining API operation and content generation.

The ai-prompt-template plugin supports pre-configured templates for user inputs to LLMs in a "fill in the blank" fashion, streamlining API management.

The ai-rag plugin retrieves context with Azure OpenAI embeddings and Azure AI Search before an LLM request is proxied.

The ai-proxy plugin simplifies access to LLM and embedding models providers by converting plugin configurations into the required request format for OpenAI, DeepSeek, Anthropic, and other OpenAI-compatible APIs.

The ai-prompt-guard plugin safeguards prompts to LLM using allow/deny patterns, ensuring only approved inputs pass. It can check the latest message or full history.

The ai-proxy-multi plugin extends the capabilities of ai-proxy with load balancing, retries, fallbacks, and health checks, simplifying the integration with OpenAI, DeepSeek, and other OpenAI-compatible APIs.

The ai-rate-limiting plugin enforces token-based rate limiting for LLM service requests, preventing overuse, optimizing API consumption, and ensuring efficient resource allocation.

The ai-request-rewrite plugin forwards client requests to LLM services for processing before sending them upstream, enabling AI-driven redaction, enrichment, and reformatting.

The openapi-to-mcp plugin lets API7 expose OpenAPI services through MCP, proxy requests with custom headers, and support real-time SSE streaming.

The graphql-limit-count plugin uses fixed windows to limit accumulated GraphQL document cost, with selection depth as the default measure.

The graphql-proxy-cache plugin enables caching of responses for GraphQL queries, improving API performance.

The limit-count-advanced plugin enforces API rate limiting with a fixed window or sliding window algorithm, restricting requests within a time window. Requests over the quota are rejected.

The limit-req plugin enforces API rate limiting with a leaky bucket algorithm to rate limit requests, enabling effective throttling to manage traffic flow.

The limit-conn plugin restricts the rate of requests by managing concurrent connections. Requests exceeding the threshold may be delayed or rejected, ensuring controlled API usage and preventing overload.

The limit-count plugin enforces API rate limiting with a fixed window algorithm, restricting requests within a time interval. Requests over the quota are rejected.

The oas-validator plugin checks incoming HTTP requests against an OpenAPI specification before they are forwarded to upstream services.

The proxy-buffering plugin dynamically disables NGINX proxy buffering, optimizing performance with SSE and other streaming upstream services in API gateway.

The proxy-cache plugin caches responses based on keys, supporting disk and memory caching for GET, POST, and HEAD requests, enhancing API performance.

The proxy-mirror plugin duplicates ingress traffic to API gateway, forwarding it to a designated upstream while keeping regular services uninterrupted.

The request-id plugin adds a unique ID to each request proxied through the API gateway, facilitating effective tracking of API requests for better API management.

The request-validation plugin checks requests for compliance before forwarding them to upstream services, enhancing security in API operations.

The traffic-label plugin labels traffic based on user-defined rules, enabling actions based on labels and associated weights for improved API traffic management.

The workflow plugin enables conditional execution of user-defined actions on client traffic based on specific rules, allowing granular API traffic management.

The traffic-split plugin directs traffic to multiple upstream services based on conditions or weights, providing a flexible approach for API release strategies and traffic management.

The attach-consumer-label plugin attaches custom consumer labels to authenticated requests, for upstream services to implement additional business logics.

The body-transformer plugin converts request and response bodies between formats, such as JSON to XML, facilitating seamless data exchange.

The degraphql plugin enables communication with upstream GraphQL services through standard HTTP requests by mapping GraphQL queries to HTTP endpoints, simplifying API integration.

The exit-transformer plugin customizes responses generated by gateway plugins or missing routes before APISIX sends them to clients.

The fault-injection plugin tests application resiliency by simulating controlled faults or delays, making it ideal for chaos engineering and failure condition analysis.

The grpc-transcode plugin converts between HTTP and gRPC requests and responses, facilitating seamless communication between different API protocols.

The grpc-web plugin enables the gateway to handle gRPC-Web requests from browsers and JavaScript clients by translating them into standard gRPC calls and forwarding them to upstream gRPC services.

The mocking plugin simulates API responses without forwarding requests to upstream services, offering customization of status codes, response bodies, headers, and more for API testing and development.

The proxy-rewrite plugin offers flexible options to rewrite requests that API gateway forwards to upstream services, enhancing API management.

The response-rewrite plugin allows rewriting of responses from API gateway and upstream services, providing flexibility in API responses.

The soap plugin simplifies transformation between RESTful HTTP requests and SOAP requests, including their corresponding responses, for better API interoperability.

The authz-keycloak plugin integrates with Keycloak for user authentication and authorization, enhancing API security and management.

The basic-auth plugin provides basic access authentication, requiring clients to authenticate before accessing upstream resources, enhancing API security.

The forward-auth plugin integrates with external authorization services, enhancing API security and access control.

The jwt-auth plugin supports the use of JSON Web Token (JWT) for client authentication before accessing upstream resources, enhancing API security measures.

The jwe-decrypt plugin decrypts its supported five-part compact token format and forwards the plaintext in a configured request header.

The key-auth plugin allows clients to authenticate using an authentication key before accessing upstream resources, enhancing API security measures.

The hmac-auth plugin supports HMAC authentication to ensure request integrity, preventing modifications during transmission and enhancing API security.

The ldap-auth-advanced plugin authenticates clients against an LDAP directory and maps the authenticated user onto a consumer, so directory identities can be used with per-consumer plugins, rate limits, and analytics.

The multi-auth plugin enables consumers using diverse authentication methods to share the same route or service, streamlining API lifecycle management.

The openid-connect plugin integrates with OIDC providers like Keycloak and Auth0, simplifying user authentication in API management.

The saml-auth plugin enables user authentication via SAML 2.0 in the API gateway by interacting with identity providers (IdP), enhancing API security.

The opa plugin integrates with Open Policy Agent, enabling unified policy definition and enforcement for authorization in API operations.

The acl plugin controls access to upstream resources by verifying if the user is on the access control lists, enhancing API management.

The chaitin-waf plugin integrates with Chaitin WAF (SafeLine) to detect and block web threats, strengthening application security and protecting user data.

The cors plugin enables cross-origin resource sharing, allowing servers to specify permitted origins and instructing browsers to load resources from those origins, enhancing API accessibility.

The data-mask plugin removes or replaces sensitive information in request headers, bodies, and URL queries for logging purposes, enhancing data privacy and security.

The consumer-restriction plugin implements access controls based on consumer name, route ID, service ID, or consumer group ID, enhancing API security.

The ip-restriction plugin restricts access to upstream resources based on an IP address whitelist or blacklist, improving API security.

The mcp-tools-acl plugin provides per-consumer access control for MCP tool calls on routes powered by openapi-to-mcp, supporting rule-based allowlist and denylist modes with optional expression conditions.

The ua-restriction plugin restricts access to upstream resources using an allowlist or denylist of user agents, preventing overload from web crawlers and enhancing API security.

The clickhouse-logger plugin pushes request and response logs to ClickHouse databases in batches, allowing for customizable log formats to enhance data management.

The datadog plugin integrates with Datadog, sending metrics to DogStatsD in batches to improve API monitoring and API performance tracking.

The elasticsearch-logger plugin pushes request and response logs in batches to Elasticsearch, allowing for customizable log formats to enhance data management.

The error-log-collect plugin captures the error logs produced while processing selected requests, including lower-severity entries that the configured log level would otherwise discard, and writes them to the gateway error log for targeted debugging.

The error-log-logger plugin pushes APISIX's error logs to TCP, Apache SkyWalking, Apache Kafka, or ClickHouse servers, in batches. You can specify the severity level of which the plugin should send the corresponding logs.

The google-cloud-logging plugin pushes request and response logs in batches to Google Cloud Logging Service and supports the customization of log formats.

The http-logger plugin pushes request and response logs as JSON objects to HTTP(S) servers in batches, allowing for customizable log formats to enhance data management.

The kafka-logger plugin pushes request and response logs as JSON objects to Apache Kafka clusters in batches, allowing for customizable log formats to enhance data management.

The loki-logger plugin sends request and response logs as JSON objects to Grafana Loki in batches via the Loki HTTP API, allowing for customizable log formats to enhance data management.

The Prometheus plugin integrates with Prometheus for metric collection and continuous monitoring, enhancing API observability.

The opentelemetry plugin instruments the API gateway, sending traces to the OpenTelemetry collector for monitoring API operations per OpenTelemetry specs.

The rocketmq-logger plugin pushes request and response logs as JSON objects to RocketMQ clusters in batches, allowing for customizable log formats to enhance data management.

The skywalking-logger pushes request and response logs as JSON objects to SkyWalking OAP server in batches, allowing for customizable log formats to enhance data management.

The syslog plugin pushes request and response logs as JSON objects to syslog servers in batches, allowing for customizable log formats to enhance data management.

The skywalking plugin integrates with Apache SkyWalking for effective request tracing, enhancing API observability.

The splunk-hec-logging plugin serializes request and response context information to Splunk Event Data format and push to your Splunk HTTP Event Collector (HEC) in batches, allowing for customizable log formats to enhance data management.

The zipkin plugin instruments the API gateway to send traces to Zipkin or compatible collectors like Jaeger and Apache SkyWalking, enhancing request tracing capabilities.

The error-page plugin customizes gateway-generated 404, 500, 502, and 503 responses without modifying responses returned by upstream services.

The public-api plugin exposes internal API endpoints, allowing external access while maintaining control over API management and security.

The real-ip plugin enables the API gateway to fetch the client's real IP using the IP address from the HTTP header or query string, improving data quality.

The aws-lambda plugin simplifies APISIX integration with AWS Lambda and Amazon API gateway, supporting authentication via IAM user credentials and API keys.

The serverless function plugins (pre-function and post-function) allow execution of user-defined logic at the start or end of specified execution phases in API gateway.

The mqtt-proxy plugin supports proxying and load balancing MQTT requests to MQTT servers, enhancing API operation and management.