Glossary

Short definitions, usage first. Where a term causes confusion on a project, the confusion is flagged.

A

AsyncAPI. The OpenAPI equivalent for event-driven APIs: describes the channels, the messages and their schemas. Useful as soon as there are webhooks or a message queue.

API product. A grouping of one or more APIs, with terms of use attached (quotas, pricing, service level). This is the unit a customer consumes, not the technical unit.

APIOps. GitOps principles applied to API configuration: contract and policies under version control, applied by an automated pipeline. See the dedicated page.

AI gateway. A gateway specialised in traffic towards language models: quotas counted in tokens consumed, cost attribution per team, semantic caching, switching between providers. Provided by general-purpose gateways or by dedicated products.

B

BFF (Backend for Frontend). An API dedicated to a given client experience, which composes the domain services. It is not a platform function: see mediation.

Breaking change. A change that breaks a consumer conforming to the contract. Forces a new version. See the life cycle.

C

Contract-first. Writing the API contract before the implementation, and generating the rest from it. The acid test: can a consumer develop before the service exists?

Circuit breaker. A mechanism that, past a failure threshold, stops calling a dependency and fails immediately. Turns saturation into degradation.

CORS. A browser mechanism that allows or refuses a call to another origin. Concerns browsers only: it is not API protection, and a permissive configuration is a defect, not a convenience.

D

Deprecation. The state of an API that still works but must no longer be adopted. Must always come with a retirement date. Without a date, it is a wish.

Data plane / control plane. The data plane handles traffic, the control plane holds the configuration, the contracts and the administration. Separating them allows several enforcement points to be deployed under a single governance. See internal and external.

Developer portal. The place where a consumer discovers the API, obtains credentials and tries it. See the dedicated page.

Distributed trace. Following a request through every component it crosses, with the time spent in each. This is the signal that is almost always missing, and the only one that answers "where is the problem". See observability.

E

ESB. Enterprise service bus, the previous generation of centralised integration. Its main flaw, business logic concentrated in a cross-cutting component, is exactly what an overloaded gateway reproduces.

F

Federation. Unified governance of heterogeneous gateways, several vendors or several clouds, without replacing them: inventory, common minimum policies, visibility. The answer to gateway sprawl, to be distinguished from the hybrid topology.

G

Gateway API (Kubernetes). The standard Kubernetes object that succeeds Ingress and separates the roles: the platform team defines the entry points, the application teams declare their routes. Not to be confused with "an API gateway".

H

Hybrid (gateway). A topology with a single control plane and multiple data planes, deployed in different network zones.

J

JWT. A signed token format, readable by its bearer. A JWT is not encrypted: everything it contains is readable by the client. Never put sensitive data in one.

JWKS. The set of public keys published by the identity provider, used to verify signatures. Its cache must refresh automatically, otherwise the platform stops during a key rotation.

M

MCP (Model Context Protocol). The protocol by which an agent discovers and invokes tools. Gateways on the market can expose an existing OpenAPI contract as an MCP tool, which puts agents under the same governance as other consumers. See the three gateways.

mTLS. Mutual TLS: the client presents a certificate too. Identifies the channel, where OAuth2 identifies the application. The standard for partner flows. Its difficulty is the life cycle of certificates, not cryptography.

N

North-south / east-west. Incoming traffic that crosses a trust boundary (north-south, the gateway's home ground). Traffic between services of the same domain (east-west, the service mesh's home ground).

O

OAuth2. A framework for delegating authorisation. It does not authenticate a user: that is the role of OIDC.

OIDC. An identification layer on top of OAuth2. Produces an identity token, meant for the client application, never for the API.

OpenAPI. The standard format for describing an HTTP API. The source from which to generate documentation, mocks, tests and configuration.

P

PKCE. An OAuth2 extension that protects the authorization code flow when the client cannot keep a secret (mobile, single-page application). Now recommended for all clients.

Q

Quota. A consumption limit over a long period (day, month), to be distinguished from rate limiting, which protects over a short window (per second). The quota is contractual, rate limiting is technical.

S

Service mesh. An infrastructure layer that handles traffic between services: mTLS, retries, fine-grained load balancing, telemetry, without modifying the applications.

SSRF. A flaw where the API is made to call a URL supplied by the attacker. Handled in the service, not at the gateway.

Strangler fig. Replacing a system progressively by diverting its traffic piece by piece.

Scope. The extent of authorisation attached to a token. Too broad, it protects nothing, too fine-grained it becomes unmanageable.

T

Token exchange. Obtaining a new token, with a reduced scope and meant for another service, by presenting an existing token. The right answer to identity propagation between services.

V

Versioning. A convention that lets several contracts coexist. The choice of location (path, header, negotiation) matters less than its consistency.

Virtualisation (mock). Simulating an API from its contract, so that a consumer can develop before the service exists. The main benefit of contract-first.