# API Management

REST channels are the gateway entry points, security definitions and groups decide who may call them, quota tiers cap how much, the OpenAPI console documents them per caller, analytics and the audit log record the traffic, and enmasse keeps the whole configuration in one YAML file.

## Get started

Build a REST API in Python, secure it with per-client credentials and read its generated OpenAPI document - the same channels every page below configures further.

[REST tutorial](https://zato.io/tutorials/rest-api/python.html)

```yaml
name: Request lifecycle
actors:
  - id: client
    label: API client
  - id: channel
    label: REST channel
  - id: service
    label: Your service
  - id: records
    label: Analytics and audit
steps:
  - from: client
    to: channel
    label: A client calls your endpoint
    align: left
    items:
      - Security definitions and groups check the caller
      - Rate limits and quota tiers apply next
      - A cached response returns immediately
  - from: channel
    to: service
    label: The channel invokes the service
  - from: service
    to: client
    kind: return
    label: The client receives the response
    align: left
    items:
      - X-RateLimit headers report the remaining quota
      - Deprecated versions include Sunset headers
  - from: channel
    to: records
    label: Every exchange leaves a trace
    align: left
    items:
      - The audit log records the request
      - Analytics aggregates it per channel and consumer
```

```yaml
name: Enmasse (GitOps)
actors:
  - id: repository
    label: Git repository
  - id: enmasse
    label: Enmasse import
  - id: server
    label: Zato server
steps:
  - from: repository
    to: enmasse
    label: The pipeline runs the import
    align: left
    items:
      - Channels, security and quota tiers are YAML in git
      - Environment variables supply secrets
  - from: enmasse
    to: server
    label: Enmasse applies the configuration
  - from: server
    to: enmasse
    kind: return
    label: The server confirms each object
  - from: enmasse
    to: repository
    kind: return
    label: The pipeline reports the outcome
    align: left
    items:
      - The same file deploys every environment
```

## Gateway

[REST channels Each channel maps a URL path to a service, with its own security, limits, caching and audit settings.](https://zato.io/docs/dev/rest/channels.html) [HTTP verbs How channels handle GET, POST and the other HTTP methods.](https://zato.io/docs/dev/rest/verbs.html) [Response caching Serve repeated REST and SOAP requests from the cache, with per-caller keys, coalescing and ETags.](https://zato.io/docs/dev/api-management/response-caching.html) [Third-party API gateways Run Azure API Management, AWS API Gateway or Kong in front of one gateway channel that dispatches to your services by name.](https://zato.io/docs/dev/rest/api-gateways.html)

## Security

[REST channel authentication Basic Auth, API keys and Bearer tokens on channels, assigned in the Dashboard or YAML.](https://zato.io/docs/dev/rest/authentication.html) [Security groups Grant many API clients access to one channel and manage their credentials as a group.](https://zato.io/docs/dev/rest/security-groups.html) [Bearer tokens and OAuth Static tokens, JWT, OAuth2 client credentials and JWKS-based verification.](https://zato.io/docs/security/bearer-tokens/index.html) [mTLS Client certificates for outgoing connections and certificate-based authentication of API clients.](https://zato.io/docs/security/mtls/index.html) [Custom authentication Implement your own authentication logic when the built-in types are not enough.](https://zato.io/docs/dev/rest/custom-auth.html) [PII (GDPR, HIPAA, PDPA) Handling Personally Identifiable Information in compliance with data protection regulations.](https://zato.io/docs/admin/security/pii.html)

## Rate limiting and quotas

[Rate limiting and firewall Burst control, request caps, IP filtering, time-based rules and silent drops.](https://zato.io/docs/admin/guide/rate-limit.html) [Quota tiers Named, reusable usage plans assigned to security definitions and groups, with X-RateLimit headers.](https://zato.io/docs/admin/guide/quota-tiers.html)

## Lifecycle and versioning

[API versioning URL path versioning, channel deprecation with Sunset and successor headers, and usage-based retirement.](https://zato.io/docs/dev/rest/versioning.html) [REST error catalog Every status code the platform returns, what triggers it and what to check.](https://zato.io/docs/dev/rest/error-catalog.html)

## Documentation and portal

[OpenAPI OpenAPI 3.1 documents generated from the typed input and output of deployed services.](https://zato.io/docs/dev/rest/openapi.html) [The OpenAPI console A browsable console with per-caller documents, a try-it client and your own branding.](https://zato.io/docs/dev/rest/openapi-console.html) [OpenAPI administration Which channels are documented, branding and ports.](https://zato.io/docs/dev/api-management/openapi.html)

## Analytics and observability

[Monitoring with Prometheus The /metrics endpoint, RED metrics, scraping configuration and PromQL queries.](https://zato.io/docs/monitoring/index.html) [Audit log Record API traffic across REST, SOAP, IMAP and pub/sub, with database storage.](https://zato.io/docs/admin/audit-log/index.html) [Logging Log streaming and aggregation, log-level environment variables and per-run scheduler logs.](https://zato.io/docs/admin/logging.html)

## Automation and GitOps

[Enmasse overview Export and import environment configuration as YAML across dev, test and production.](https://zato.io/docs/admin/enmasse.html) [Enmasse reference The full reference of all options available in enmasse YAML configuration files.](https://zato.io/docs/admin/enmasse-reference.html) [Deploying projects A DevOps tutorial on how to deploy your Python code and configuration to Zato environments.](https://zato.io/tutorials/devops/deployment.html)

## AI and MCP

[MCP tutorial Expose services as tools to AI agents through MCP gateways, with audit and safeguards.](https://zato.io/tutorials/mcp/01.html) [AI integrations MCP gateways, LLM connections and AI pipelines that call your enterprise systems.](https://zato.io/docs/ai/index.html)

## Testing

[API testing Write API tests in plain English and run them in any CI/CD pipeline.](https://zato.io/docs/api-testing/index.html)