Contract-first onboarding
Import OpenAPI 3.0 or 3.1 JSON inline or through the ClamAV-protected quarantine path. RLX Gate retains the exact source, SHA-256 digest, normalized metadata, and operation index.
Scoped runtime configuration
Upstreams and routes have revision-checked update, enable, disable, deletion, and immutable history operations. They must belong to the authenticated organization, workspace, environment, project, and API. Private-network targets are denied unless an operator explicitly enables them.
Application access and route policy
Operators can issue one-time API keys, trust bounded JWT or OIDC providers, map subjects to application clients, and attach typed authentication, CORS, source-network, and request-header controls. Envoy calls a fail-closed authorizer over a local Unix socket.
Persisted traffic evidence
Envoy emits privacy-minimized request records to the control plane for tenant-scoped summaries and recent-event views. Raw credentials, headers, bodies, client IPs, user agents, query strings, and raw request identifiers are not retained.
Signed delivery and rollback
Candidates are canonicalized, checksummed, HMAC-signed, compiled into deterministic Envoy CDS/LDS resources, and written atomically. Filesystem delivery is recorded; Envoy ACK/NACK confirmation is not yet available.
Frequently asked questions
Which API formats are supported now?
OpenAPI 3.0.x and 3.1.x JSON. YAML and other protocols remain backlog work.
Is every route tenant-scoped?
Yes. Creation and reads resolve the authenticated context and enforce project relationships on the server.