API Management

REST channels are the gateway entry points, security definitions and groups decide who may call them, quota tiers cap how much, the OpenAPI console documents them per caller, analytics and the audit log record the traffic, and enmasse keeps the whole configuration in one YAML file.

Get started

Build a REST API in Python, secure it with per-client credentials and read its generated OpenAPI document - the same channels every page below configures further.

REST tutorial

Gateway

REST channels Each channel maps a URL path to a service, with its own security, limits, caching and audit settings. HTTP verbs How channels handle GET, POST and the other HTTP methods. Response caching Serve repeated REST and SOAP requests from the cache, with per-caller keys, coalescing and ETags. Third-party API gateways Run Azure API Management, AWS API Gateway or Kong in front of one gateway channel that dispatches to your services by name.

Security

REST channel authentication Basic Auth, API keys and Bearer tokens on channels, assigned in the Dashboard or YAML. Security groups Grant many API clients access to one channel and manage their credentials as a group. Bearer tokens and OAuth Static tokens, JWT, OAuth2 client credentials and JWKS-based verification. mTLS Client certificates for outgoing connections and certificate-based authentication of API clients. Custom authentication Implement your own authentication logic when the built-in types are not enough. PII (GDPR, HIPAA, PDPA) Handling Personally Identifiable Information in compliance with data protection regulations.

Rate limiting and quotas

Rate limiting and firewall Burst control, request caps, IP filtering, time-based rules and silent drops. Quota tiers Named, reusable usage plans assigned to security definitions and groups, with X-RateLimit headers.

Lifecycle and versioning

API versioning URL path versioning, channel deprecation with Sunset and successor headers, and usage-based retirement. REST error catalog Every status code the platform returns, what triggers it and what to check.

Documentation and portal

OpenAPI OpenAPI 3.1 documents generated from the typed input and output of deployed services. The OpenAPI console A browsable console with per-caller documents, a try-it client and your own branding. OpenAPI administration Which channels are documented, auto-created channels, branding and ports.

Analytics and observability

Traffic analytics Built-in screens with top channels and consumers, trends, drill-down and CSV exports. Monitoring with Prometheus The /metrics endpoint, RED metrics, scraping configuration and PromQL queries. Audit log Record API traffic across REST, SOAP, IMAP and pub/sub, with database storage. Logging Log streaming and aggregation, log-level environment variables and per-run scheduler logs.

Automation and GitOps

Enmasse overview Export and import environment configuration as YAML across dev, test and production. Enmasse reference The full reference of all options available in enmasse YAML configuration files. Deploying projects A DevOps tutorial on how to deploy your Python code and configuration to Zato environments.

AI and MCP

MCP tutorial Expose services as tools to AI agents through MCP gateways, with audit and safeguards. AI integrations MCP gateways, LLM connections and AI pipelines that call your enterprise systems.

Testing

API testing Write API tests in plain English and run them in any CI/CD pipeline.