API Gateway
The front door for every request
A managed, globally distributed API gateway that adds less than 3 ms of latency — and removes entire categories of production incidents. Routing, throttling, transformation and resilience, enforced at 31 edge locations.
Gateway Core
Everything a gateway should do. Nothing it shouldn't.
The gateway is a purpose-built Rust data plane running at the edge — no sidecars, no plugins of unknown provenance, no request path you cannot explain to your CISO.
Route Matching
Prefix, exact, regex and header-based matching with deterministic precedence. Thousands of routes, one lookup pass.
Request Transforms
Rewrite paths, inject headers, map query parameters and reshape payloads between consumers and upstreams.
Protocol Bridging
Expose REST to the world while your services speak gRPC, GraphQL or AMQP internally. Transcoded at the edge.
Retries & Timeouts
Per-route retry budgets, jittered backoff and hard timeout ceilings so a slow upstream never cascades.
Circuit Breakers
Upstreams that trip their error threshold are shed automatically and probed back into rotation.
Canary & Blue/Green
Shift traffic between upstream versions by percentage, header or consumer segment — instantly reversible.
Rate Limiting
Fair use, enforced globally
Limits are synchronised across the entire edge fleet in under a second, so a consumer cannot multiply their allowance by hitting different regions. Token-bucket, sliding-window and burst-aware algorithms, applied per key, per plan, per endpoint — or any combination.
- Standard
429responses withRetry-Afterand quota headers - Grace-mode limits that log without blocking during rollout
- Cost-aware limits: throttle by payload weight, not just request count
| Plan | Window limit | Burst | Scope |
|---|---|---|---|
| Free tier | 1,000 req / hour | 50 req / sec | Per API key |
| Standard | 100,000 req / hour | 500 req / sec | Per key or consumer |
| Business | Unmetered | 5,000 req / sec | Per endpoint + plan matrix |
| Enterprise | Custom | Custom | Arbitrary policy dimensions |
# apiflow.route.yaml — declarative, version-controlled
route: orders-api
match: prefix=/v1/orders
upstream: grpc://orders.internal:9000
auth: [jwt, mtls]
rate_limit:
window: 100000/hour
burst: 500/sec
retries: 2 (budget 10%)
canary: orders-v2 @ 5%
Configuration
Routes are code, not console clicks
Every route, policy and limit is a declarative file in your repository — reviewed in pull requests, promoted through environments by CI and rolled back in seconds. The gateway reloads configuration without dropping a single in-flight request.
Put a serious gateway in front of your services
Import your OpenAPI spec, generate routes automatically and cut over with canary traffic. Our engineers will help you plan the migration.