Zuplo - API Management Platform

API management, but easy. Easy to learn, easy to customize, easy to deploy.

Zuplo is API Management reinvented. 10x your API productivity, 10x your conversion, and bring your API sprawl under control. Save time and $$$ on the alternatives.

Features

• 🚀 Routing Engine: Proxy to internal microservices with path-based rules
• 🔐 Authentication: API Key, OAuth2, JWT, and IP Whitelisting
• ⚡ Rate Limiting: Per-key, per-user, per-tenant (token bucket algorithm)
• 📋 OpenAPI Validation: Request/response validation with auto-generated docs
• 🏢 Multi-Tenant Support: Scoped rate limits, usage logs, and config
• 🌐 Developer Portal: Swagger UI with API Key generation and usage overview
• 🔒 Secret Management: Environment-based configuration with vault support
• 💰 Monetization Hooks: API usage metering with pricing plans
• 📊 Audit Logging: Comprehensive request/response logging
• 🔔 Webhooks: Event forwarding for errors, new users, over-usage
• 📈 Observability: Prometheus metrics with Grafana dashboards

Quick Start

1. Clone and setup:

   git clone <repo>
   cd enterprise-api-gateway
   cp .env.example .env

2. Start with Docker:

   docker-compose up -d

3. Access services:

   • API Gateway: http://localhost:3000
   • Developer Portal: http://localhost:3000/docs
   • Admin Dashboard: http://localhost:3001
   • Grafana: http://localhost:3002 (admin/admin)
   • Prometheus: http://localhost:9090

4. Test the API:

   # Public endpoint
   curl http://localhost:3000/hello
   
   # Protected endpoint (use demo API key)
   curl -H "X-API-Key: demo-key-123-hash" http://localhost:3000/secure-data
   
   # Admin endpoint
   curl -H "X-Admin-Key: admin-super-secret-key-change-in-production" http://localhost:3000/admin/stats

API Endpoints

Public Routes

• GET /hello - Public hello endpoint
• GET /docs - Developer portal (Swagger UI)
• GET /health - Health check

Protected Routes

• GET /secure-data - Requires API key
• POST /api/keys - Generate API key (admin)

Development

# Install dependencies
npm install

# Run in development mode
npm run dev

# Run tests
npm test

# Build for production
npm run build

Configuration

The gateway loads configuration from config/gateway.yaml. See the configuration section below for details.

Architecture

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   Client App    │───▶│  API Gateway    │───▶│  Microservice   │
└─────────────────┘    └─────────────────┘    └─────────────────┘
                              │
                              ▼
                       ┌─────────────────┐
                       │     Redis       │
                       │  (Rate Limit)   │
                       └─────────────────┘
                              │
                              ▼
                       ┌─────────────────┐
                       │   PostgreSQL    │
                       │ (Users, Logs)   │
                       └─────────────────┘

License

MIT

Configuration

The gateway uses a YAML configuration file at config/gateway.yaml. Key sections include:

Rate Limiting

rate_limiting:
  default_limit: 1000
  window_seconds: 60
  algorithm: "sliding_window"

Proxy Routes

proxy:
  routes:
    - path: "/api/users/*"
      target: "http://localhost:4001"
      auth_required: true
      rate_limit: 100

Monetization Plans

monetization:
  plans:
    free:
      requests_per_month: 10000
      rate_limit: 100
      price_cents: 0

API Documentation

Authentication

All protected endpoints require an API key in the X-API-Key header:

curl -H "X-API-Key: your-api-key" http://localhost:3000/secure-data

Rate Limiting

Rate limits are enforced per API key with the following headers returned:

• X-RateLimit-Limit: Maximum requests allowed
• X-RateLimit-Remaining: Requests remaining in current window
• X-RateLimit-Reset: Unix timestamp when the rate limit resets

Webhooks

Configure webhooks to receive notifications for events:

curl -X POST http://localhost:3000/webhooks \
  -H "X-API-Key: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/webhook",
    "events": ["rate_limit_exceeded", "auth_failure"]
  }'

Monitoring & Observability

Metrics

Prometheus metrics are available at /metrics endpoint:

• http_requests_total: Total HTTP requests
• http_request_duration_seconds: Request duration histogram
• rate_limit_hits_total: Rate limit violations
• auth_failures_total: Authentication failures

Grafana Dashboards

Pre-configured dashboards show:

• Request volume and latency
• Error rates by endpoint
• Rate limit violations
• Active API keys and tenants

Logging

Structured JSON logs include:

• Request/response details
• Authentication events
• Rate limit violations
• Proxy errors

Security Features

• API Key Authentication: Secure key-based access control
• Rate Limiting: Prevent abuse with configurable limits
• IP Whitelisting: Restrict access by IP address
• Request Validation: OpenAPI schema validation
• Audit Logging: Complete request/response logging
• Secure Headers: Security headers added to all responses

Deployment

Docker Production

# Build and deploy
docker-compose -f docker-compose.yml up -d

# Scale services
docker-compose up -d --scale api-gateway=3

Kubernetes

# Apply manifests
kubectl apply -f k8s/

# Check status
kubectl get pods -l app=api-gateway

Environment Variables

Key environment variables for production:

• DATABASE_URL: PostgreSQL connection string
• REDIS_URL: Redis connection string
• JWT_SECRET: JWT signing secret
• ADMIN_API_KEY: Admin access key

Testing

Run the test suite:

npm test

Load test with sample data:

# Import Postman collection
# Use the provided collection in postman/ directory

Troubleshooting

Common Issues

1. Database Connection Failed

   • Check PostgreSQL is running
   • Verify DATABASE_URL is correct
   • Ensure database exists and user has permissions

2. Redis Connection Failed

   • Check Redis is running
   • Verify REDIS_URL is correct
   • Check Redis memory usage

3. Rate Limiting Not Working

   • Verify Redis connection
   • Check rate limit configuration
   • Ensure API key is valid

4. Proxy Requests Failing

   • Check target service is running
   • Verify proxy configuration
   • Check network connectivity

Debug Mode

Enable debug logging:

LOG_LEVEL=debug npm start

Health Checks

Monitor service health:

curl http://localhost:3000/health
curl http://localhost:3000/status

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests
5. Run linting: npm run lint
6. Submit a pull request

Support

• Documentation: See /docs endpoint
• Issues: GitHub Issues
• Community: Discord/Slack channel

Roadmap

• GraphQL support
• gRPC proxy support
• Advanced analytics
• Multi-region deployment
• Custom middleware plugins
• OAuth2 provider integration