Quickstart: contract to live route
Create or join an organization, import an OpenAPI 3.0 or 3.1 JSON contract, register a reachable backend, define the public hostname and route policy, build a signed candidate, and publish it to Envoy.
- Use a non-production backend for the first route
- Confirm hostname, path, methods, timeout, and rate limits
- Call the gateway URL with the required application identity
- Record the active revision before testing rollback
Core concepts
Organizations contain workspaces, environments, projects, APIs, applications, products, and routes. The control plane owns intent and evidence; Envoy owns the request path and continues with the last verified snapshot.
Identity and policy
Console users authenticate with approval-gated passkeys. Applications use issued API keys or configured JWT/OIDC identity. Route attachments enforce authentication, CORS, source-network, and request-header policy through fail-closed authorization.
Operate and recover
Production releases use immutable, digest-pinned images and signed manifests. Health gates, previous-release rollback, checksum-verified backups, restore tooling, and audit history provide a bounded recovery path.
Know the boundary
Each guide distinguishes shipped behavior from active development. Schema enforcement, body transforms, distributed tracing, anomaly detection, broader developer self-service, and multi-region fleet management remain roadmap work.