Introduction
Apiway is an API lifecycle platform that takes your OpenAPI specifications from design through governance, deployment, and runtime — across any gateway.
What Apiway Does
Section titled “What Apiway Does”Most API management tools focus on the gateway. Apiway manages everything around it:
| Concern | Without Apiway | With Apiway |
|---|---|---|
| Design | Manual OAS authoring, no standards | Automated recommendations, compliance scoring |
| Governance | Email threads, spreadsheets | Configurable approval workflows with audit trails |
| Deployment | Gateway-specific scripts | One-click deploy with blue-green revisions |
| Security | Manual policy configuration | Secure-by-default with scoped entitlements |
| Metering | Custom logging, no billing | Per-operation RU tracking with cost centre P&L |
| Consumer onboarding | Manual key provisioning | Self-service subscriptions with automatic credentials |
Who Uses Apiway
Section titled “Who Uses Apiway”API Producers — Teams that build and publish APIs. Apiway handles their governance, deployment, versioning, and monitoring.
API Consumers — Internal teams or external partners that subscribe to APIs. Apiway manages their credentials, rate limits, and budget controls.
API Programme Leads — People responsible for the organisation’s API strategy. Apiway gives them governance oversight, risk dashboards, and portfolio-level economics.
Core Principles
Section titled “Core Principles”Gateway-agnostic. Apiway deploys to Alpha Gateway, Kong, Azure API Management, Apigee, Tyk, and Zuplo. Your governance, security, and metering rules follow your APIs — regardless of which gateway runs them.
API-first. Every capability in Apiway is available through its own platform APIs. The management UI, CLI, and MCP integrations all consume the same API surface. You can automate anything.
Secure by default. APIs deployed through Apiway get OAuth 2.0 client credentials and per-operation scope enforcement out of the box — even if your OAS defines no security.
Opinionated but extensible. Apiway ships with sensible defaults for governance templates, compliance rules, and security policies. Override any of them when your organisation needs something different.
Architecture at a Glance
Section titled “Architecture at a Glance”The Core Service orchestrates everything. Workers are gateway-specific translators — they convert Apiway’s deployment model into the proxy and policy documents each gateway understands. The gateway then enforces those policies at runtime.
| Layer | Components |
|---|---|
| Clients | Management UI, CLI, MCP, Platform API |
| Platform Services | Core, Governance, Operations, Compliance, Recommendations, Entitlements, RU, Risk |
| Workers | Alpha, Kong, Azure, Apigee, Tyk, Zuplo |
| Gateways | Alpha Gateway, Kong, Azure APIM, Apigee, Tyk, Zuplo |
Built-In Guidance
Section titled “Built-In Guidance”Apiway is designed so you never get stuck. The management UI includes a contextual help assistant on every page — click the ? button to see guidance for exactly what you’re looking at, along with links to the relevant documentation. Between the in-app help, this documentation, and the platform API, nothing should be hard to find or figure out.