Gravitee

Features

Core API Management

• API proxy between clients and backends
• Synchronous API support
• Asynchronous API support
• API lifecycle management
• API versioning
• API documentation
• Centralized API catalog
• API search and discovery
• API import/export
• v2 and v4 API definitions
• Federated APIs

Gateway

• Request/response processing
• Policy enforcement at request and response phases
• Traffic transformation
• Traffic securing
• Traffic monitoring
• Reverse proxy capabilities
• Bridge Gateway for hybrid deployments
• Sharding tags for Gateway deployment control

Protocol Support

• REST APIs
• SOAP APIs
• WebSocket
• gRPC
• HTTP/HTTPS
• Server-Sent Events (SSE)
• Webhooks
• Native Kafka protocol
• MQTT 5.x
• AMQP 0-9-1 (RabbitMQ)
• Agent-to-Agent (A2A) protocol
• Model Context Protocol (MCP)

Event Broker Integrations

• Apache Kafka
• Confluent (including Schema Registry)
• Solace
• HiveMQ
• Mosquitto
• RabbitMQ
• Azure Service Bus
• MQTT 5.x brokers

Authentication & Security Plans

• Keyless (public) plans
• API Key authentication
• OAuth 2.0 token introspection
• JWT (JSON Web Token) authentication
• mTLS (mutual TLS/client certificates)
• Push plans for async APIs
• Dynamic Client Registration (DCR)

Identity Provider Integrations

• Gravitee Access Management
• Keycloak
• Generic OAuth2 authorization servers
• LDAP authentication
• HTTP authentication provider
• Inline authentication (bring your own users)
• OpenID Connect SSO (Enterprise)

Policies

• Traffic transformation policies
• Security policies
• Rate limiting
• Caching
• Request/response header manipulation
• Script execution
• HTTP callout policies
• TLS enforcement
• Assign Metrics (Enterprise)
• Cloud Events transformation (Enterprise)
• Data Cache (Enterprise)
• Data Logging Masking (Enterprise)
• GeoIP Filtering (Enterprise)
• WS Security Authentication (Enterprise)
• XSLT transformation (Enterprise)

Kafka-Specific Policies (Enterprise)

• Kafka ACL
• Kafka Offloading
• Kafka Quota
• Kafka Topic Mapping
• Kafka Transform Key

Data Transformation Policies (Enterprise)

• AVRO to JSON
• AVRO to Protobuf
• Protobuf to JSON

Applications & Subscriptions

• Application registration
• Client ID management
• OAuth integration for dynamic credentials
• Subscription management
• Subscription validation workflows
• Automatic subscription approval
• Subscription transfer
• Credential generation

Developer Portal

• API discovery and exploration
• Interactive API testing
• Subscription management
• Application management
• Usage analytics dashboard
• API logs access
• Full customization (branding, logos, colors, fonts, layout)
• White labeling support
• Classic Developer Portal (stable)
• New Developer Portal (modern UX, Tech Preview)

Management Console

• Web-based UI for API producers
• API publishing
• Global platform settings
• Portal settings configuration
• User management
• Role management
• Custom roles (Enterprise)
• Audit trail (Enterprise)

Management API

• RESTful API for programmatic management
• Management component for core functionality
• Portal component for Developer Portal operations
• v2 subcomponent for v4 and Federated APIs

Observability & Analytics

• Real-time metrics
• API analytics dashboards
• API logs
• Access logging
• Request/response logging
• OpenTelemetry support
• Debug mode (Enterprise)

Reporters

• Elasticsearch reporter
• File reporter
• Datadog reporter (Enterprise)
• TCP reporter (Enterprise)
• Cloud reporter (Enterprise)

APM Integrations

• Splunk
• Datadog
• Dynatrace

Caching

• Redis cache resource
• In-memory cache
• Cache policy

Service Discovery

• HashiCorp Consul integration
• Dynamic backend endpoint binding

Documentation Fetchers

• Bitbucket
• Git
• GitHub
• GitLab
• HTTP

Secret Management

• Kubernetes secret provider
• HashiCorp Vault (Enterprise)
• AWS Secret Manager (Enterprise)
• Sensitive data management
• TLS certificate management

Agent Mesh (AI Capabilities)

• Agent Gateway
• A2A (Agent-to-Agent) Proxy
• LLM Proxy
• Agent Catalog
• Agent Tool Server
• MCP Server support
• AI agent discovery and governance
• Token-based rate limiting for LLMs
• Prompt Guard Rails
• AI agent analytics and cost optimization

Kafka Gateway

• Native Kafka protocol support
• Kafka topic exposure as APIs
• Topic access control
• mTLS for Kafka clients
• Virtual topics and partitions
• Self-service topic subscriptions
• Kafka topic documentation

Governance

• Federation
• API Score
• Integrations discovery
• Federated APIs
• Federation Agent Service Account
• Rulesets and Functions
• API quality metrics

Enterprise Features

• Audit Trail
• Bridge Gateway
• Custom roles
• Dynamic Client Registration (DCR)
• Debug mode
• Enterprise OpenID Connect SSO
• Sharding tags
• Alert Engine
• API Designer (drag-and-drop)

Alert Engine (Enterprise)

• API platform monitoring
• Flexible alerting configurations
• Email notifications
• Slack notifications
• Webhook notifications
• Pre-configured upstream conditions

Gravitee Cloud

• Multi-environment management
• Multi-organization management
• Environment hierarchies
• API promotion across environments
• Centralized control plane

Deployment Options

• Self-hosted (on-premises/private cloud)
• Gravitee-managed (SaaS)
• Hybrid deployment
• Multi-tenancy support

Deployment Methods

• Docker (Compose and CLI)
• Kubernetes (vanilla, EKS, AKS, GKE, OpenShift)
• RPM packages
• ZIP packages
• Linux and Windows support

Infrastructure as Code

• Terraform provider (Tech Preview)
• Gravitee Kubernetes Operator (GKO)
• GitOps support
• API versioning and automation

Repositories

• MongoDB
• Redis
• Elasticsearch
• Bridge HTTP (for hybrid)

Extensibility

• Plugin system
• Custom policy development
• Custom reporter development
• Connector plugins
• Fetcher plugins
• Identity provider plugins
• Notifier plugins
• Resource plugins
• Secret provider plugins
• Service plugins

High Availability & Scalability

• Horizontal scaling
• Rate limit synchronization (Redis)
• Distributed caching
• Load balancing support
• Failover capabilities
• Health checks

Response Templates

• Custom error responses
• Response customization

CORS Configuration

• Cross-Origin Resource Sharing support

Quality of Service

• QoS configuration for async APIs

Version History

• API version tracking
• Audit logs per API

MCP Server Exposure

• Expose APIM as MCP Server
• AI assistant integration
• Natural language API management

Use Cases

API Gateway & Proxy

• Centralized API entry point for all services
• Request/response transformation
• Traffic routing and load balancing
• Protocol mediation between clients and backends
• Reverse proxy for backend services
• API aggregation from multiple sources

API Security

• Centralized authentication and authorization
• API key management and validation
• OAuth 2.0 token validation
• JWT verification and enforcement
• mTLS (mutual TLS) for client certificate authentication
• Rate limiting and throttle protection
• DDoS mitigation through traffic policies
• IP-based access control and GeoIP filtering
• Data masking for sensitive information

API Lifecycle Management

• API design and documentation
• API versioning and deprecation
• API publishing and retirement
• Environment promotion (dev → staging → production)
• API governance and compliance
• Quality scoring and standards enforcement

Developer Experience

• Self-service API discovery portal
• Interactive API documentation and testing
• Application registration and management
• Subscription workflows
• API key and credential provisioning
• Usage analytics and monitoring

Event-Driven Architecture

• Kafka topic exposure as managed APIs
• MQTT broker integration
• RabbitMQ message routing
• Solace event API management
• Azure Service Bus integration
• Real-time event streaming
• Webhook management
• Server-Sent Events (SSE) support

Kafka Gateway

• Native Kafka protocol proxying
• Kafka topic access control
• Multi-tenant Kafka environments
• Kafka client authentication (mTLS, API keys)
• Topic-level rate limiting and quotas
• Kafka topic discovery and documentation
• Self-service topic subscriptions

AI & Agent Mesh

• LLM proxy and governance
• AI agent communication management (A2A protocol)
• Model Context Protocol (MCP) server exposure
• AI agent discovery and cataloging
• Token-based rate limiting for LLMs
• Prompt guard rails and content filtering
• AI cost optimization and analytics
• Centralized AI credential management

Microservices Architecture

• Service-to-service communication management
• API gateway for microservices
• Service discovery integration (Consul)
• Traffic splitting and canary releases
• Circuit breaking and failover
• Health checking and monitoring

Hybrid & Multi-Cloud Deployments

• Unified API management across environments
• Data residency and compliance
• Reduced latency with local gateways
• Centralized control with distributed data planes
• Multi-region API deployment
• Cloud-agnostic API management

Enterprise Integration

• Legacy system modernization
• SOAP to REST transformation
• Protocol bridging (HTTP to Kafka, etc.)
• Backend service abstraction
• Third-party API aggregation
• B2B API exposure

IoT & Edge Computing

• Device API management
• MQTT protocol support for IoT
• Edge gateway deployments
• Low-latency local processing
• Device authentication and authorization

Partner & Third-Party API Programs

• External API monetization
• Partner onboarding workflows
• Tiered access plans
• Usage-based billing support
• API consumption analytics
• Developer community management

Internal API Governance

• Shadow IT prevention
• API standardization
• Centralized API catalog
• API reuse and discovery
• Compliance enforcement
• Audit trail and logging

Real-Time Applications

• WebSocket API management
• Server-Sent Events (SSE) support
• Streaming data APIs
• Low-latency communication
• Bidirectional communication support

Analytics & Monitoring

• API usage analytics
• Performance monitoring
• Error tracking and debugging
• Custom metrics and dashboards
• Integration with APM tools (Datadog, Splunk, Dynatrace)
• OpenTelemetry observability

Security & Compliance

• PCI-DSS compliance support
• GDPR data handling
• Audit logging and trail
• Access control enforcement
• Sensitive data masking
• Certificate management

API Monetization

• Usage tracking per consumer
• Tiered subscription plans
• Rate limiting by plan tier
• Analytics for billing
• Developer application management

DevOps & CI/CD Integration

• Infrastructure as Code (Terraform)
• Kubernetes-native deployment (GKO)
• GitOps workflows
• Automated API deployment
• Environment configuration management
• Version control for API definitions

Federation & Multi-Gateway

• Federated API management
• Third-party gateway integration
• Distributed API governance
• Centralized policy management
• Cross-organization API sharing

Testing & Development

• API mocking and simulation
• Debug mode for policy testing
• Interactive API testing
• Sandbox environments
• API Designer for rapid prototyping

Custom Backend Integrations

• Salesforce integration
• CRM system connections
• ERP system APIs
• Database API exposure
• Custom protocol support
• Serverless function integration (via HTTP)