APIs define how applications communicate and exchange data with each other, enabling structured requests and responses between systems. An API gateway acts as a secure, centralized entry point that manages, authenticates, and controls that traffic.
APIs and API Gateways
Many times when we have something like a web server that's up and running, we have just users that are connecting to 443 and then just viewing a web page. But other times that connection is much more in-depth. For instance, maybe we have a server on the other side that needs to access this for some sort of services that it's retrieving, some sort of services that it's accessing. In those cases we need a deeper connection, something that's going to transfer much different information and be much more secure. In those scenarios, maybe we use some sort of API.
Let's develop a little scenario here. Let's say we are a SaaS company, a software as a service company, and we have a bunch of contact info that's being housed on our server. We want users to be able to connect into our services — in fact it's not just users, we want other servers to connect into our services. That's what we're selling: we're selling these contact lists, and we want our clients' servers to be able to connect into our servers.
It needs to come through the firewall, make a connection to our device right here, and then access those services. It needs to make requests, it needs to grab information, it needs to submit information, it needs to change information. So we want to interconnect these applications: the applications that are running on our side, that we're selling those services with, and the application on our client side, which is making the connection into our service.
In this scenario and many other scenarios, we would create an application programming interface, or API. What we do is we would set up our application so that other applications can plug into it, and we'd even release, hey, this is how to connect to our application. You have to use these credentials, then you have to make these types of calls, and then you'll receive this in this format. So however the client's machine is asking or requesting for certain information, it has to have a certain format. It makes a request into our servers, our server goes and gathers the information and then responds back, and then this server can log and record that information. So we do all of this with an application programming interface, or API.
Another example of this is maybe we have a bastion host out front and connections come into here. Maybe it's even 443, but it's offloading some stuff and it needs to make calls to these servers on the back end. This would be another example where it would make the calls using some sort of APIs. We would create the format in which this call would be made, how it would be requested, and then this server would respond in a certain way so that the server knew what the response actually meant.
So this is the API. We would use APIs to add information, retrieve information, change information, delete information, or really anything that you can think of, and how these interactions are going to take place. Here are just some examples of some common APIs that are out there. There are actually a lot of APIs — if you create an application, you can create your own API — so there are really lots of them out there. These are just to name a few examples of APIs that are common.
When something's connecting into our services, we want to make sure that we're going to remain secure with this. So what do we want to do?
We probably want to set up some sort of authorization. We don't want just anybody to connect into the API. Sometimes that's the case — sometimes we just have an API and that's open to anybody who wants to connect to it — but most of the time we're going to want to do some sort of authorization.
We're probably going to want to do logging and log that activity, so that if there are ever any issues we can go back and see what happened.
And then we could also do some sort of rate limiting. That is, if a machine is connecting in and just dumping all of the contents, that could fill up our bandwidth, it could tap our resources, the CPU could spike, it could fill up our memory. There could be lots of problems with just dumping too much information all at once. In that case, maybe we want to do some sort of rate limiting so they can only download a certain amount of information at any given time.
One last thing that we'll take a look at is the API gateway. What is a gateway? That's essentially a reverse proxy server that's sitting out front. Maybe it's like our bastion host that's hardened, that's out front, and that's what the people are connecting into. That's the gateway that the API is making a connection into, and then this gateway goes and retrieves the information needed in order to answer back and send a response back to that client.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →