Integration

Gateway integration

Where this product stops and your API gateway starts — and exactly what crosses the boundary between them.

3 concern(s) APIMaster does not cover

APIMaster is a design-time product. It deploys nothing, proxies nothing, holds no gateway credentials, makes no management-API calls and observes no runtime traffic. The handoff to your gateway is a file in your own repository, applied by your own pipeline — deliberately, because a design tool with production deploy rights is a design tool with production blast radius.

Boundary

Who owns what

5 here6 at the gateway1 shared

Concern	Owned at runtime by	What APIMaster contributes	What crosses the boundary
The contract The OpenAPI description that both the consumer and the gateway are built against.	APIMaster	Authoring, dialect-aware validation, immutable versioned snapshots, and a style guide that decides whether the document is one your organization would publish. SwaggerMaster · Design view	A published OpenAPI 3.0/3.1 document.
Routing and backend abstraction Turning a stable public path into whatever the backend actually is — a monolith, a service, a legacy SOAP endpoint.	Your gateway	The server list and path structure the gateway configuration is derived from. SwaggerMaster · Design view APIMaster does not proxy traffic and never sits in the request path. The routing itself is entirely the gateway's.	The `servers` and `paths` sections of the published document.
Authentication and authorization Deciding who the caller is and what they may reach.	Your gateway	The declared security schemes and per-operation requirements, plus an assessment of whether they are declared coherently at all (OWASP API2:2023 and API5:2023). SwaggerMaster · Security tab A declared scheme is not an enforced one. APIMaster can see that an operation claims to require a scope; only the gateway can make that true.	`securitySchemes` and per-operation `security` in the document.
Rate limiting, quota and spike arrest Bounding what a single consumer can consume, and protecting the backend from bursts.	Your gateway	Detecting that an operation documents no 429 response, or that a collection has no pagination parameter, so consumers cannot implement back-off correctly (OWASP API4:2023). SwaggerMaster · Security tab The actual quota, its window and its enforcement live in gateway policy. APIMaster never holds a limit.	A documented 429 response and pagination parameters in the contract.
Request and response transformation Mediating between the shape the client wants and the shape the backend has.	Your gateway	APIMaster does not do this. APIMaster describes the contract the client sees. Any mediation between that and the backend is gateway policy and is invisible here.	—
Property-level exposure Whether a response returns fields the caller should never see.	Both	Response and request schemas are exactly where this lives, so the specification is the right evidence. APIMaster flags credential-shaped properties in responses and server-managed fields accepted in write bodies (OWASP API3:2023). SwaggerMaster · Security tab	Findings against the published schemas.
Mocking before the backend exists Letting consumers start integrating against the contract on day one.	APIMaster	A deterministic mock derived from the published snapshot, plus generated client code. SwaggerMaster · Mock & export The mock runs in this browser. It is a design-time aid, never a deployed environment — do not point a production client at it.	A local mock and generated client scaffolding.
Versioning and breaking-change control Knowing that a change breaks somebody before it ships.	APIMaster	Immutable snapshots, a structural diff that classifies each change, and a blast radius that names which registered consumers break and how badly. SwaggerMaster · Compare · Consumers	A diff report and a copyable consumer notification list.
Developer portal and onboarding How an external developer finds the API, gets a key, and starts calling it.	Your gateway	The rendered reference documentation and a try-it-out surface for the design-time reader. SwaggerMaster · Docs APIMaster issues no credentials, holds no developer accounts and runs no subscription flow. A production portal is the gateway's product.	The published documentation, exportable.
Analytics and runtime observability Traffic volumes, latency percentiles, error rates, per-consumer usage.	Your gateway	APIMaster does not do this. APIMaster is local-first and observes no traffic. Every runtime number a programme needs comes from the gateway's own pipeline.	—
Estate governance Who owns each API, how critical it is, what class of data it carries, when it was reviewed.	APIMaster	The portfolio register and its governance envelope, with attention flags for the APIs nobody owns. API Portfolio	The register itself, and the executive brief.
Compliance evidence Mapping what you hold to named control identifiers an auditor recognises.	APIMaster	DORA, NIS2, GDPR and PSD2 control mappings over the evidence the product already holds, exported as a dated, hash-sealed bundle. Compliance evidence Evidence assembly, not certification. Runtime controls — incident handling, resilience testing, availability statistics — are evidenced by the gateway and its operations, not here.	A sealed evidence bundle.
Deployment of the API to the gateway Getting the definition and its policies into the running platform.	Neither — your pipeline	APIMaster does not do this. APIMaster deploys nothing. It holds no gateway credentials, makes no management-API calls and has no pipeline into your platform. The handoff is a file in your Git repository, and your own CI does the rest.	The exported OpenAPI document, committed to your own repository.

Path

From a contract to a running gateway

1.
Design and validate the contractSwaggerMaster · Design view
Author the OpenAPI document, clear every structural error, and get the style-guide score to where your organization accepts it. A document with errors is not ready to become a gateway configuration.
2.
Assess it before anyone depends on itSwaggerMaster · Security tab
Run the OWASP API Security Top 10 (2023) assessment. Resolve the errors; read the not-assessable categories and decide who evidences them, because the gateway will not do it for you.
3.
Publish an immutable snapshotSwaggerMaster · Versions
Publishing freezes the document and its resolved dependencies. Everything downstream — the gateway configuration, the generated clients, the diff you compare against next time — refers to that snapshot rather than to a moving draft.
4.
Export and commit itSwaggerMaster · Mock & export
Export the published document and commit it to your own repository beside the gateway-specific configuration. This is the handoff: a file under version control, reviewed like any other change.
5.
Let your own pipeline deploy itYour CI — not this product
Your CI or GitOps flow applies the definition and the gateway policies. APIMaster holds no credentials and makes no calls into your platform — deliberately, because a design tool with production deploy rights is a design tool with production blast radius.
6.
Check the blast radius before the next changeAPI Consumers · SwaggerMaster · Compare
Register the consumers, and every subsequent diff can name who breaks, how badly, and who to notify — before the change reaches the gateway rather than after.

Google Cloud

Apigee

Full guide Vendor documentation

An enterprise API management platform: a governed, securable, monetisable API layer in front of backend services, rather than a reverse proxy.

Choose it when

· You are running an enterprise API programme rather than routing a handful of internal services.
· You need a developer portal, API productisation, quota management and sophisticated analytics.
· The organization is Google Cloud-first and native integration is worth real money.
· The API's business value justifies the platform and operating cost.

Do not choose it when

· You only need routing for a few internal services, basic API-key checking, or a Kubernetes ingress.
· There is no developer-portal or monetisation requirement — a lighter gateway is usually the rational answer.
· The budget is tight and the API is not strategic.

Operating

Deployment models

Apigee managed

Google operates the runtime and the control plane.

Suits: You want platform capability without runtime operational responsibility.

Cost of entry: Highest licence cost, lowest operational cost.

Apigee hybrid

The management plane stays with Google; the runtime runs in your Kubernetes.

Suits: Data residency or on-premises runtime is a hard requirement.

Cost of entry: Requires genuine Kubernetes operating capability. Do not choose it to save money.

Decide

Decision matrix

Do external partners or developers consume the API?

Onboarding, API products and quota become necessary — Apigee is a strong candidate.

Does the API generate revenue or carry business-critical integration?

Strong governance and analytics are justified — Apigee is a strong candidate.

Is the organization GCP-first?

Native integration is genuinely valuable — Apigee gains an advantage.

Is an on-premises runtime mandatory?

Examine Apigee hybrid, but only with real Kubernetes operating capability.

Do you need only a few internal APIs and basic routing?

A lighter gateway is probably enough.

Is there dedicated platform ownership?

Governance is sustainable, so enterprise API management is realistic.

Is the budget tight and the API non-strategic?

Evaluate alternatives first — total cost of ownership will dominate.