Features

API lifecycle management

• Manage every phase of the API lifecycle—design, development, testing, publishing, O&M, monitoring, security control, and unpublishing—from a single platform.

Protocol support

• Supports HTTPS offloading, SSL offloading, and HTTP/2 for client connections, so you can modernize legacy backends without changing client-side code.

• Uses wildcard domain names to route requests across multiple APIs under a single domain.

Request validation and forwarding

• Validates and cleanses request parameters—covering ranges, enumerated values, and regular expressions—before forwarding to backends. Requests with invalid parameter types or values are rejected at the gateway, keeping malformed traffic away from your services.

• Maps request parameters to response parameters, giving you fine-grained control over the data contract between clients and backends.

Security and access control

• Supports HMAC-SHA-1 and HMAC-SHA-256 signature algorithms for request authentication.

• Supports mutual TLS (mTLS), full-link CA certificate verification, and full-link signature verification for scenarios that require strict identity assurance on both sides of a connection.

• Enforces IP address-based and parameter-based access control. Custom expressions let you restrict access based on system parameters or any field in HTTP requests and responses.

• Guards against replay attacks and request tampering. API Gateway integrates with Web Application Firewall (WAF) and Anti-DDoS Pro to build a full-link API security protection system.

Backend integration

• Connects to multiple backend service types—HTTP/HTTPS services, mock services, Virtual Private Cloud (VPC) resources, and Function Compute—so you can expose existing systems as APIs without rewriting them.

• Integrates with Alibaba Cloud data services including DataWorks, Dataphin, and Data Management (DMS), enabling API-based access to large-scale data pipelines.

• Supports private connectivity over VPCs, keeping traffic within your network boundary.

• Manages APIs for both cloud and on-premises resources from a central control plane.

Publishing and routing

• Publishes APIs with one-click version switching, so you can roll out new versions without downtime.

• Manages APIs across separate environments—development, staging, and production—supporting parallel release workflows in routine R&D cycles.

• Supports canary release, letting you direct a controlled percentage of traffic to a new version before full rollout.

• Routes requests based on parameters in HTTP requests, giving you the flexibility to implement A/B testing and traffic-splitting strategies.

Availability and traffic management

• Caches API response data to reduce latency and relieve pressure on backend services during traffic spikes.

• Provides circuit breakers and custom degradation policies to prevent avalanche effects when backend services degrade or become unavailable.

• Supports fine-grained throttling at multiple levels: API call frequency, app request frequency, and parameter-based throttling that inspects HTTP request parameters and system context values.

Monitoring and alerting

• Delivers API call logs to Simple Log Service (SLS) for full-log querying and analysis.

• Provides dashboards that track key metrics—call volume, response time, and error rate—so you can spot issues at a glance.

• Sends instant alerts via SMS or other channels when an exception occurs during an API call, so your team can respond before users are affected.

Developer experience

• Provides a GUI-based debugging console for interactive API testing without writing client code.

• Traces the full API call chain to help you identify and resolve faults quickly.

• Automatically generates SDKs in multiple programming languages and produces matching API documentation, reducing the time to integrate for API consumers.

CI/CD and infrastructure as code

• Exposes all gateway-managed APIs for programmatic access, enabling automation in your O&M and release pipelines.

• Imports and exports Swagger 2.0 files and integrates with your CI/CD system for API management and lifecycle control.

• Supports Terraform orchestration for infrastructure-as-code workflows.

API Marketplace

• Publish your APIs to Alibaba Cloud API Marketplace with multiple billing methods. This feature is available only on the China site (aliyun.com).