API Gateway is a powerful tool for managing and securing your APIs. It acts as a reverse proxy that sits between your clients and your backend services, routing requests to the appropriate service and providing features such as authentication, authorization, rate limiting, and caching. In this article, we will explore the basics of API Gateway, how it works, and why you, as a QA need to know about it.

What is API Gateway?

API Gateway is a service that allows you to create, manage, and secure APIs for your applications. It provides a single entry point for your APIs, allowing you to control and monitor traffic to your backend services. It supports RESTful APIs, WebSocket APIs, and HTTP APIs, and integrates with various AWS services such as AWS Lambda, AWS Elastic Beanstalk, and AWS Elastic Container Service (ECS).

An API gateway takes all API calls from clients, then routes them to the appropriate microservice with request routing, composition, and protocol translation. Typically it handles a request by invoking multiple microservices and aggregating the results, to determine the best path. It can translate between web protocols and web‑unfriendly protocols that are used internally.

An e‑commerce site might use an API gateway to provide mobile clients with an endpoint for retrieving all product details with a single request. It invokes various services, like product info and reviews, and combines the results.

AWS defines an API Gateway as

API Gateway acts as a “front door” for applications to access data, business logic, or functionality from your backend services, such as workloads running on Amazon Elastic Compute Cloud (Amazon EC2), code running on AWS Lambda, any web application, or real-time communication applications.

A simple representation of an API Gateway may be like this

Why do we need to use an API Gateway?

At its most basic, an API service accepts a remote request and returns a response. But real life is never that simple. Consider your various concerns when you host large-scale APIs.

  • Centralized management: With API Gateway, you can manage all your APIs in one place. This makes it easy to monitor and control traffic to your backend services, as well as to manage authentication and authorization for your APIs.

  • Monetisation: If you have monetizied API’s, then you’ll want to connect to a billing system. API Gateway comes pretty handy in that scenarios.

  • Scalability: API Gateway scales automatically to handle any amount of traffic, so you don’t have to worry about managing the infrastructure to handle spikes in traffic.

  • Security: API Gateway provides built-in security features such as HTTPS support, authentication and authorization, and rate limiting. This helps you protect your APIs from attacks and unauthorised access.

  • Analytics : You would want to understand how people are using your API’s. So API Gateway can give you added functionality of analytics and monitoring tools to understand that.

  • API Versioning : Over time, there are high chances that you’ll add some new API services and retire others, but your clients still want to connect your services without any major changes at the same place- so API Gateway can help you in this regard.

Benefits

Using an API gateway has the following benefits:

  • Insulates the clients from how the application is partitioned into microservices.

  • Insulates the clients from the problem of determining the locations of service instances.

  • Provides the optimal API for each client.

  • Reduces the number of requests/roundtrips- For example, the API gateway enables clients to retrieve data from multiple services with a single round-trip. Fewer requests also means less overhead and improves the user experience. An API gateway is essential for mobile applications.

  • Simplifies the client by moving logic for calling multiple services from the client to API gateway.

  • Translates from a “standard” public web-friendly API protocol to whatever protocols are used internally

Why should QA know about API Gateway?

Gone are the days when the API’s were merely exposed from the BE to the FE. In the times of enterprise API’s and micro services, more often then not, you will find an API Gateway implementation for the communication between a single or multiple micro service and even between multiple micro-services.

  • Testing API Endpoints: API gateways are an essential part of the API architecture as they act as a single entry point for all the API calls. Hence, it becomes crucial for the QA team to understand the working of an API gateway and test API endpoints to ensure that the API functions as expected.

  • Monitoring API Traffic: API gateways enable monitoring of API traffic, which helps in identifying and analyzing the performance and functionality issues. The QA team can leverage this feature to perform load testing and stress testing to ensure that the API can handle the expected traffic.

  • Security Testing: API gateways act as a security layer between the API and external clients. Hence, understanding the security features of an API gateway is crucial for the QA team to ensure that the API is protected against security threats such as SQL injection attacks, cross-site scripting attacks, and so on.

  • Troubleshooting and Debugging: When an API fails to function as expected, the QA team can leverage the API gateway logs to identify the root cause of the issue. Hence, having knowledge about API gateways is crucial for the QA team to troubleshoot and debug API issues.

  • Understanding API Usage and Analytics: Most of the API Gateways are equipped with analytics and monitoring techniques and tools. As a QA, we can do a deep dive in the analytics, and try to understand the usage and the patterns of use of the services under the API gateway. API gateways also provide a sort of APM for the micro-services so they can also be used to understand any underlying performance issue with the API’s.

Naveen from Naveen Automation Labs had posted a very good video on the concept of API Gateways some time ago. I am linking that below so that people can go through it and understand why do we need API Gateways and why it is important for QA to know about this.