API Gateway provides the following features:

  • API lifecycle management
    • Provides a full range of lifecycle management functions and productivity tools for each phase of the API lifecycle. The lifecycle management functions include API design, development, testing, publishing, O&M and monitoring, security control, and unpublishing.
  • Protocol processing
    • Supports HTTPS offloading, SSL offloading, client access based on HTTP/2 or WebSocket, and bidirectional communication.
    • Uses wildcard domain names to call APIs.
  • Request forwarding
    • Supports parameter cleansing and the verification of parameter types and values (range, enumerated value, and regular expression). Requests with invalid parameter types or values are denied by API Gateway.
    • Sets up mappings between request and response parameters.
  • Multiple authentication methods for security protection
    • Supports HMAC (SHA-1 and SHA-256) algorithms.
    • Supports mutual TLS authentication, full-link CA certificate verification, and full-link signature verification.
    • Supports IP address-based access control and access control on parameters.
    • Provides multiple security mechanisms for protection against request replay and request tampering. API Gateway is efficiently integrated with WAF and Anti-DDoS Pro to build a full-link API security protection system.
  • Integration
    • Supports multiple types of backend services and can interconnect with existing business systems. The supported backend services include HTTP and HTTPS services, Mock-based simulation services, resources in VPCs, and Function Compute.
    • Seamlessly interconnects with both the database and big data services of Alibaba Cloud, such as DataWorks, Dataphin, and Data Management (DMS). Furthermore, API Gateway provides various data sources. It helps you use APIs to provide data services.
    • Supports access over VPCs.
    • Supports centralized management of the APIs of both cloud and on-premises resources.
  • Publishing and routing
    • Manages API publishing and supports one-click online version switching.
    • Supports multi-environment management to meet the requirements of concurrent use in routine R&D, staging, testing, and production environments.
    • Supports canary release.
    • Supports parameter routing. Different routing rules can be created based on specific HTTP request content to improve system flexibility.
  • API availability
    • Caches API response data to improve access efficiency and mitigate the pressure on backend services.
    • Provides default breakers and custom degradation policies to avoid avalanche effects in extreme cases.
    • Supports refined throttling, which allows you to control the API access frequency and app-initiated request frequency. It also helps you logically judge the parameters obtained from HTTP requests and system context for parameter throttling.
  • Monitoring and alerting
    • Delivers API calling logs to Log Service for full log query and analysis.
    • Provides dashboards to monitor metrics and understand the API calling status. The metrics include the number of calls, response time, and error rate.
    • Supports the configuration of different alerting conditions. If an exception occurs during an API call, the system sends notifications to the administrator in a timely manner by using text messages or other means.
  • Debugging and calling
    • Provides GUI-based debugging tools.
    • Tracks the API calling process to quickly identify faults and troubleshoot issues.
    • Supports automatic generation of SDKs in multiple languages and generation of API instructions. This facilitates API calling.
  • Continuous integration
    • Supports both Swagger file importing and exporting, and supports Swagger 2.0 standards. API Gateway can efficiently interconnect with your O&M system and CI/CD system for API management and control.
    • Supports Terraform orchestration.
  • API Marketplace
    • Allows you to publish APIs to Alibaba Cloud API Marketplace and offers multiple billing methods.