Skip to content

API Enforcement Point

The API Enforcement Point provides real-time, policy-based data protection for RESTful APIs and microservices. It intercepts API traffic—either as an API gateway plugin (e.g., Envoy or Kong) or as a lightweight middleware—to dynamically inspect, mask, or decrypt JSON and XML payloads.

Key Capabilities

  • Dynamic Masking: Masks or redacts sensitive JSON fields in API responses before they reach unauthorised consumers.
  • Tokenisation & Decryption: Dynamically tokenises incoming sensitive data or decrypts stored tokens on the fly based on user claims and country context.
  • Schema Validation: Validates payloads against OpenAPI specifications to ensure consistent schema classification.
  • Low Latency: Built for high-performance microservice environments, ensuring policy evaluation takes only a fraction of a millisecond.

How It Works

sequenceDiagram
    autonumber
    Client->>API Gateway (Enforcement Point): Send REST Request
    API Gateway (Enforcement Point)->>eXate Engine: Evaluate Policy & Claims
    eXate Engine-->>API Gateway (Enforcement Point): Return Masking/PET Rules
    API Gateway (Enforcement Point)->>Backend Service: Forward Sanitised Request
    Backend Service-->>API Gateway (Enforcement Point): Return Sensitive JSON Response
    API Gateway (Enforcement Point)->>API Gateway (Enforcement Point): Apply Masking/PETs to Response
    API Gateway (Enforcement Point)-->>Client: Send Protected JSON Response
  1. Request Interception: An API client initiates a request to a protected endpoint.
  2. Policy Evaluation: The enforcement point checks the user's claims, geographic region, and purpose against active eXate Policies.
  3. Upstream Request: The request is sanitised (e.g., sensitive parameters masked or tokenised) before being forwarded to the backend service.
  4. Dynamic Transformation: When the backend returns a response, the enforcement point parses the JSON structure, flattens the keys, and applies the designated Privacy Enhancing Technologies (PETs) to sensitive attributes.
  5. Secure Delivery: The final, protected response is delivered to the client.

Technical Guides & API References

For detailed task-specific guidance on calling the API and integrating microservices, see the following guides:

  • Protect Endpoint — The core /api/protect endpoint REST reference for JSON, XML, or SQL payloads.
  • Dataset Protection — Defining sensitive field paths within JSON, XML, and SWIFT message formats.
  • File Protect Endpoints — REST API references for protecting entire files.
  • gRPC Examples — Protecting data streams natively via high-performance gRPC.
  • API Gateway Integration — Architectural guidance for deploying at the gateway layer (Apigee, Kong, NGINX) or embedding at the application level.