An API gateway is a reverse proxy specialised for APIs. Clients call the gateway; it decides which backend service handles the request and applies the cross-cutting rules every service would otherwise implement for itself — authentication, quotas, request size limits, CORS, request IDs, caching and metrics.
Routes map paths and methods to upstream services. Policies run before and after the upstream call: verify the token, check the rate limit, forward, then add headers and log. Because the gateway sits in the path, many errors a client sees — 401, 413, 429, 502, 504 — come from the gateway rather than from the service the client meant to call.
That a 502 or 504 is the application's fault, or that it is not. Both are produced by the gateway about its upstream: 502 means the service answered with something invalid or dropped the connection, 504 that it did not answer in time. The gateway's logs and the request ID are where to start.
GET /protocol/v1/gateway-timeout behaves like a gateway in front of a slow upstream, answering 504 after about three seconds; GET /faults/v1/status/502 returns the bad-gateway case on demand.
All glossary terms · Testing techniques · All 39 mock REST APIs
Last updated