--- title: "API Gateway DevSecOps: Policy as Code, Testing, and Runtime Feedback - API7.ai" description: "Integrate gateway security into delivery with versioned policy, layered tests, protected control paths, and evidence-backed runtime feedback." url: "https://api7.ai/learning-center/api-gateway-guide/api-gateway-devsecops" --- [Skip to article](#column-content) Column contentsAPI Gateway Guide [API Gateway Guide](https://api7.ai/learning-center/api-gateway-guide) Search this column 01 Gateway Fundamentals [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=fundamentals)[1. What Is an API Gateway? API Gateway Software and Use Cases](https://api7.ai/learning-center/api-gateway-guide/what-is-an-api-gateway)[2. Why Do Modern Architectures Need an API Gateway?](https://api7.ai/learning-center/api-gateway-guide/why-do-modern-architectures-need-api-gateway)[3. Reverse Proxy vs Load Balancer vs API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-vs-reverse-proxy-vs-load-balancer)[4. API Gateway and Microservices: Decoupling and Traffic Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-and-microservices)[5. Understanding Core API Gateway Features](https://api7.ai/learning-center/api-gateway-guide/core-api-gateway-features)[6. Open Source vs. Commercial API Gateways: How to Choose the Right One?](https://api7.ai/learning-center/api-gateway-guide/open-source-vs-commercial-api-gateway)[7. API Gateway vs Service Mesh: How to Choose?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-vs-service-mesh)[8. Envoy vs NGINX, Java, and Go for API Gateways](https://api7.ai/learning-center/api-gateway-guide/nginx-vs-envoy-vs-java-vs-go)[9. Core Concepts of API Gateway: Service, Route, Upstream, Plugin, and Consumer](https://api7.ai/learning-center/api-gateway-guide/core-concepts-of-api-gateway)[10. API Gateway Comparison: Apache APISIX vs. Kong vs. Traefik vs. KrakenD vs. Tyk](https://api7.ai/learning-center/api-gateway-guide/api-gateway-comparison-apisix-kong-traefik-krakend-tyk) 02 Gateway Architecture and Design [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=architecture)[11. Deep Dive into API Gateway Architecture: Core Components and Design Principles](https://api7.ai/learning-center/api-gateway-guide/api-gateway-architecture)[12. Choosing the Right API Gateway for Your Architecture](https://api7.ai/learning-center/api-gateway-guide/api-gateway-monolithic-vs-microservices)[13. How to Architect an API Gateway for High Availability (HA)?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-high-availability)[14. API Gateway Plugin Architecture: How to Extend and Customize Your API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-plugin-system)[15. How Event-Driven Architecture (EDA) Works with API Gateway?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-event-driven-architecture)[16. API Gateway Request Lifecycle Explained](https://api7.ai/learning-center/api-gateway-guide/api-gateway-request-lifecycle-explained)[17. Cloud-Native API Gateway on Kubernetes](https://api7.ai/learning-center/api-gateway-guide/cloud-native-api-gateway-kubernetes)[18. API Gateway Control Plane vs. Data Plane](https://api7.ai/learning-center/api-gateway-guide/api-gateway-control-plane-vs-data-plane)[19. How API Gateways Work with GitOps: Automating API Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-gitops-integration)[20. How to Perform A/B Testing and Canary Releases with an API Gateway](https://api7.ai/learning-center/api-gateway-guide/ab-testing-canary-release-api-gateway) 03 Gateway Setup and Traffic Handling [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=traffic-protocols)[21. How to Deploy an API Gateway on Kubernetes: Step-by-Step Guide for Engineers](https://api7.ai/learning-center/api-gateway-guide/deploy-api-gateway-on-kubernetes)[22. Hands-on Setup with Apache APISIX API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-getting-started-guide)[23. API Gateway Auth: OAuth 2.0, JWT & OIDC with APISIX](https://api7.ai/learning-center/api-gateway-guide/api-gateway-authentication-apache-apisix-oauth-jwt-oidc)[24. Mastering Traffic Control: Efficiently Managing API Requests with Gateways](https://api7.ai/learning-center/api-gateway-guide/api-gateway-traffic-control-strategies)[25. Building Reliable API Gateways with Logging and Monitoring](https://api7.ai/learning-center/api-gateway-guide/api-gateway-logging-monitoring-best-practices)[26. Dynamic Routing in API Gateways: Best Practices for Flexible Traffic Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-dynamic-routing-management)[27. How API Gateways Support WebSocket](https://api7.ai/learning-center/api-gateway-guide/how-api-gateways-support-websocket)[28. API Gateway for GraphQL: Security, Cost, and Caching](https://api7.ai/learning-center/api-gateway-guide/api-gateway-handle-graphql)[29. How API Gateways Handle HTTP/3 QUIC Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-http3-quic)[30. How API Gateways Handle MQTT Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-mqtt) 04 Gateway Integrations, AI, and MCP [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=ai-mcp)[31. How API Gateways Handle gRPC Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-grpc-support)[32. How API Gateways Implement Custom Plugins](https://api7.ai/learning-center/api-gateway-guide/api-gateway-custom-plugins)[33. How API Gateways Integrate with Kafka](https://api7.ai/learning-center/api-gateway-guide/api-gateway-kafka-integration)[34. How to Implement API Aggregation in API Gateways](https://api7.ai/learning-center/api-gateway-guide/api-gateway-api-aggregation)[35. How API Gateways Enable Serverless Architecture](https://api7.ai/learning-center/api-gateway-guide/api-gateway-serverless-architecture)[36. How API Gateways Proxy LLM Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-proxy-llm-requests)[37. How API Gateways Enhance MCP Servers](https://api7.ai/learning-center/api-gateway-guide/api-gateway-enhance-mcp-server)[38. MCP Gateway vs MCP Proxy vs AI Gateway vs API Gateway](https://api7.ai/learning-center/api-gateway-guide/ai-gateway-vs-mcp-gateway-vs-api-gateway)[39. What Is an AI Gateway? Architecture and Benefits](https://api7.ai/learning-center/api-gateway-guide/what-is-an-ai-gateway)[40. What Is an MCP Gateway? Architecture, Use Cases & How It Works (2026 Guide)](https://api7.ai/learning-center/api-gateway-guide/what-is-mcp-gateway) 05 Gateway Performance [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=performance)[41. How API Gateway Reduces Latency: Performance Optimization Strategies](https://api7.ai/learning-center/api-gateway-guide/how-api-gateway-reduces-latency)[42. API Gateway Caching Strategy: Comprehensive Analysis and Implementation Guide](https://api7.ai/learning-center/api-gateway-guide/api-gateway-caching-strategy-analysis)[43. How to Optimize API Gateway Load Balancing: Advanced Strategies and Best Practices](https://api7.ai/learning-center/api-gateway-guide/how-to-optimize-api-gateway-load-balancing)[44. How API Gateway Efficiently Handles Large-Scale Traffic: Architecture and Strategies](https://api7.ai/learning-center/api-gateway-guide/how-api-gateway-handles-large-scale-traffic)[45. How to Improve API Gateway QoS: Traffic Classes, Capacity Protection, and SLOs](https://api7.ai/learning-center/api-gateway-guide/api-gateway-quality-of-service)[46. API Gateway Log Storage: Pipelines, Retention, Security, and Cost](https://api7.ai/learning-center/api-gateway-guide/api-gateway-log-storage)[47. API Gateway Timeouts and Retries: Safe Policies and APISIX Configuration](https://api7.ai/learning-center/api-gateway-guide/api-gateway-timeouts-retries)[48. API Gateway Concurrency Control: Capacity Budgets, Backpressure, and Load Shedding](https://api7.ai/learning-center/api-gateway-guide/api-gateway-concurrency-control)[49. Asynchronous API Gateway Patterns: Queues, Callbacks, and Performance Boundaries](https://api7.ai/learning-center/api-gateway-guide/asynchronous-api-gateway-patterns)[50. API Gateway TLS Performance: Handshakes, Session Reuse, and Measurement](https://api7.ai/learning-center/api-gateway-guide/api-gateway-tls-performance) 06 Gateway Security [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=security)[51. DDoS Defense at the API Gateway: Layered Controls and Failure Planning](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ddos-defense)[52. Distributed API Gateway Rate Limiting: Local vs Redis Counters and Accuracy Trade-offs](https://api7.ai/learning-center/api-gateway-guide/distributed-api-gateway-rate-limiting)[53. API Gateway IP Allowlist and Denylist Management: Trust, Proxies, and Operations](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ip-allowlist-denylist-management)[54. API Gateway Security Scanning: What to Test and How to Operationalize Findings](https://api7.ai/learning-center/api-gateway-guide/api-gateway-security-scanning)[55. SQL Injection and XSS at the API Gateway: Detection Limits and Defense in Depth](https://api7.ai/learning-center/api-gateway-guide/sql-injection-xss-api-gateway)[56. API Access Log Auditing: Evidence, Integrity, Retention, and Review](https://api7.ai/learning-center/api-gateway-guide/api-access-log-auditing)[57. Preventing API Scraping and Abuse: Identity, Behavioral Signals, and Rate Controls](https://api7.ai/learning-center/api-gateway-guide/prevent-api-scraping-abuse)[58. API Gateway mTLS: Client Identity, Certificate Rotation, and APISIX Configuration](https://api7.ai/learning-center/api-gateway-guide/api-gateway-mtls)[59. Fine-Grained API Gateway Authorization: RBAC, ABAC, and External Policy Decisions](https://api7.ai/learning-center/api-gateway-guide/fine-grained-api-gateway-authorization)[60. API Gateway and WAF Reference Architecture: Ownership, Header Trust, and Failure Modes](https://api7.ai/learning-center/api-gateway-guide/api-gateway-waf-reference-architecture) 07 Gateway Ecosystem and Comparisons [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=ecosystem)[61. Apache APISIX vs Kong: Migration, Operations, and Team Fit](https://api7.ai/learning-center/api-gateway-guide/apache-apisix-vs-kong)[62. Traefik vs Kong vs APISIX: A Reproducible API Gateway Benchmark Method](https://api7.ai/learning-center/api-gateway-guide/traefik-kong-apisix-benchmark-method)[63. Amazon API Gateway Explained: Deployment Models, Trade-offs, and Use Cases](https://api7.ai/learning-center/api-gateway-guide/amazon-api-gateway-explained)[64. API Gateway and Istio: Clear North-South and East-West Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-istio)[65. API Gateway with NGINX: Layering, Ownership, and Migration Patterns](https://api7.ai/learning-center/api-gateway-guide/api-gateway-nginx)[66. API Gateway with Envoy: Deployment Patterns and Policy Ownership](https://api7.ai/learning-center/api-gateway-guide/api-gateway-envoy)[67. API Gateway with Cloudflare API Shield: Edge and Origin Security Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-cloudflare-api-shield)[68. Apigee vs MuleSoft vs Amazon API Gateway: A Decision Framework](https://api7.ai/learning-center/api-gateway-guide/apigee-mulesoft-amazon-api-gateway)[69. Should an API Gateway Connect Directly to a Database? Patterns and Risks](https://api7.ai/learning-center/api-gateway-guide/api-gateway-database-access-patterns)[70. API Gateway Architecture for Large-Scale SaaS Platforms](https://api7.ai/learning-center/api-gateway-guide/api-gateway-large-scale-saas-architecture) 08 Industry Applications and Integrations [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=applications)[71. API Gateway CI/CD: Validation, Promotion, and Safe Rollback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ci-cd)[72. API Gateways for AI and ML Inference: Traffic, Security, and Observability](https://api7.ai/learning-center/api-gateway-guide/api-gateways-ai-ml-inference)[73. API Gateway Architecture for Financial Services: Controls and Failure Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-financial-services)[74. API Gateway Architecture for E-Commerce: Checkout Reliability and Traffic Peaks](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ecommerce)[75. API Gateways for Mobile Applications: Authentication, Payloads, and Versioning](https://api7.ai/learning-center/api-gateway-guide/api-gateways-mobile-applications)[76. API Gateways for Web3 Applications: RPC Traffic, Identity, and Abuse Controls](https://api7.ai/learning-center/api-gateway-guide/api-gateways-web3-applications)[77. OpenAPI-Driven API Gateway Operations: Import, Validation, and Drift Control](https://api7.ai/learning-center/api-gateway-guide/openapi-driven-api-gateway-operations)[78. gRPC-Web and gRPC Transcoding Through an API Gateway](https://api7.ai/learning-center/api-gateway-guide/grpc-web-grpc-transcoding-api-gateway)[79. API Gateway Pricing and Cost Optimization: A Workload-Based Model](https://api7.ai/learning-center/api-gateway-guide/api-gateway-pricing-cost-optimization)[80. Evaluating API Gateway Directions: Evidence and Architectural Impact](https://api7.ai/learning-center/api-gateway-guide/api-gateway-trends) 09 Advanced Gateway Applications [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=operations)[81. API Gateways in Zero Trust Architecture: Identity, Policy, and Limits](https://api7.ai/learning-center/api-gateway-guide/api-gateways-zero-trust-architecture)[82. API Gateway Log Analytics: Correlation, Queries, and Operational Signals](https://api7.ai/learning-center/api-gateway-guide/api-gateway-log-analytics)[83. From API Sprawl to Governed Delivery: The Gateway's Role in Modernization](https://api7.ai/learning-center/api-gateway-guide/api-gateway-modernization)[84. API Monetization at the Gateway: Plans, Metering, Entitlements, and Billing Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-monetization-gateway)[85. Safe AI-Assisted API Gateway Optimization: Recommendations, Guardrails, and Approval](https://api7.ai/learning-center/api-gateway-guide/ai-assisted-api-gateway-optimization)[86. API Gateways for Low-Code and No-Code Integration: Governance and Safety](https://api7.ai/learning-center/api-gateway-guide/api-gateways-low-code-no-code-integration)[87. API Gateway and CIAM Integration: Token Validation, Consent, and Identity Context](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ciam-integration)[88. Elastic API Gateway Scaling: Signals, Capacity, and Safe Scale-In](https://api7.ai/learning-center/api-gateway-guide/elastic-api-gateway-scaling)[89. Multi-Tenant SaaS API Gateways: Isolation, Quotas, and Tenant-Aware Policy](https://api7.ai/learning-center/api-gateway-guide/multi-tenant-saas-api-gateway-policy)[90. API Gateway DevSecOps: Policy as Code, Testing, and Runtime Feedback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-devsecops) 10 Platform Engineering and Planning [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=platform-governance)[91. API Discovery and Documentation at the Gateway: Inventory, Ownership, and Drift](https://api7.ai/learning-center/api-gateway-guide/api-discovery-documentation-gateway)[92. WebAssembly Plugins for API Gateways: Portability, Isolation, and APISIX Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-webassembly-plugins)[93. Monitoring API Gateways with Prometheus and Grafana: Metrics, Dashboards, and Alerts](https://api7.ai/learning-center/api-gateway-guide/monitor-api-gateways-prometheus-grafana)[94. API Gateway Reliability Engineering: SLOs, Failure Isolation, and Incident Response](https://api7.ai/learning-center/api-gateway-guide/api-gateway-reliability-engineering)[95. API Gateways for Edge AI Inference: Routing, Constraints, and Observability](https://api7.ai/learning-center/api-gateway-guide/api-gateways-edge-ai-inference)[96. Reducing Cloud Cost with API Gateway Controls: Measurement Before Optimization](https://api7.ai/learning-center/api-gateway-guide/reducing-cloud-cost-api-gateway-controls)[97. Improving API Developer Experience with Gateway Standards and Self-Service](https://api7.ai/learning-center/api-gateway-guide/improving-api-developer-experience-gateway-self-service)[98. API Gateway Change Management: Compatibility, Progressive Delivery, and Rollback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-change-management-rollback)[99. Operating Serverless APIs: Cold Starts, Idempotency, and Asynchronous Handoffs](https://api7.ai/learning-center/api-gateway-guide/operating-serverless-apis-gateway)[100. Planning an API Gateway Roadmap for the Next Five Years](https://api7.ai/learning-center/api-gateway-guide/planning-api-gateway-roadmap-next-five-years) [API Gateway Guide](https://api7.ai/learning-center/api-gateway-guide)[Advanced Gateway Applications](https://api7.ai/learning-center/api-gateway-guide?topic=operations) On this page On this page - [Key Takeaways](#key-takeaways) - [Build One Evidence Chain](#build-one-evidence-chain) - [Translate Threats Into Enforceable Requirements](#translate-threats-into-enforceable-requirements) - [Keep Policy as Code Focused](#keep-policy-as-code-focused) - [Validate at Four Different Layers](#validate-at-four-different-layers) - [1. Syntax and Schema](#1-syntax-and-schema) - [2. Organizational Policy](#2-organizational-policy) - [3. Runtime Behavior](#3-runtime-behavior) - [4. Adversarial and Bypass Testing](#4-adversarial-and-bypass-testing) - [Protect the Delivery Identity](#protect-the-delivery-identity) - [Use Runtime Feedback Without Creating an Unsafe Autopilot](#use-runtime-feedback-without-creating-an-unsafe-autopilot) - [Define Risk-Proportionate Gates](#define-risk-proportionate-gates) - [DevSecOps Verification Checklist](#devsecops-verification-checklist) - [FAQ](#faq) - [Is a WAF or scanner enough for gateway DevSecOps?](#is-a-waf-or-scanner-enough-for-gateway-devsecops) - [Should every runtime finding block deployment?](#should-every-runtime-finding-block-deployment) - [Can production policy be fixed directly during an incident?](#can-production-policy-be-fixed-directly-during-an-incident) - [Next Steps](#next-steps) Article 90 # API Gateway DevSecOps: Policy as Code, Testing, and Runtime Feedback API7.ai September 22, 2026 API gateway DevSecOps means making security requirements reviewable, testable, deployable, observable, and correctable throughout the API lifecycle. It is not a scanner added after deployment, and it is not permission for runtime alerts to rewrite production policy automatically. The useful loop is: define a threat-informed rule, test the exact gateway artifact, release it through a protected control path, observe both allowed and denied behavior, and feed evidence into an owned source change. General promotion and rollback mechanics belong to [API Gateway CI/CD](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ci-cd); this guide focuses on security gates and feedback. ## Key Takeaways - Store security intent, gateway configuration, exceptions, and tests as versioned artifacts. - Separate schema validity, organizational policy, runtime behavior, and attack-resistance tests. - Give CI only the control-plane access needed for its target and protect that path from the public data plane. - Test negative identity, authorization, input, resource, dependency, and bypass paths. - Treat runtime findings as evidence for triage and a reviewed change, not as trusted policy instructions. - Measure whether controls reduce risk without hiding legitimate failures or creating unsafe exceptions. ## Build One Evidence Chain ``` flowchart LR T[Threat model and API contract] --> P[Versioned security policy] P --> S[Static schema secret and dependency checks] S --> R[Test gateway runtime] R --> N[Negative and abuse tests] N --> A[Approval with evidence] A --> D[Protected control-plane deployment] D --> O[Runtime gateway and application signals] O --> I[Triage and owned issue] I -->|reviewed source change| P ``` The feedback arrow returns to reviewed source. A log event, anomaly score, or scanner result can be incomplete, spoofed, or misclassified; it should not directly become an authorization rule. NIST [SP 800-218 Secure Software Development Framework](https://csrc.nist.gov/pubs/sp/800/218/final) provides high-level practices that can be integrated into an existing software lifecycle. Apply that idea to the gateway artifact: prepare the organization, protect the artifact and delivery path, produce well-secured configuration, and respond to discovered weaknesses. ## Translate Threats Into Enforceable Requirements Write each rule with an owner, scope, evidence, exception process, and failure behavior. | Threat | Gateway-relevant requirement | Control that remains elsewhere | | ---------------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------ | | Broken authentication | Validate the exact issuer, audience, token type, time, and required credential state | Identity lifecycle and account recovery | | Broken authorization | Enforce coarse route or method policy after authentication | Object and workflow authorization | | Resource exhaustion | Bound rate, concurrency, body size, time, and expensive operations | Worker, queue, database, and vendor budgets | | Injection or malformed input | Reject known-invalid shape and size before proxying | Domain validation, safe queries, output encoding | | Misconfiguration | Validate schemas, references, secret use, admin exposure, and unsafe defaults | Host, network, container, and cloud controls | | Improper inventory | Require owner, environment, version, exposure, and retirement metadata | Organization-wide asset discovery and ownership | Do not label a requirement “secure” without a testable statement. “JWT enabled” is not enough; “a token for issuer A and audience B is accepted, while wrong issuer, wrong audience, expired, unsigned, and ID-token cases are denied” is reviewable. ## Keep Policy as Code Focused Policy as code can check properties that are easy to lose in review: - public routes use an approved authentication pattern or an owned exception; - administrative endpoints are absent from public listeners and networks; - upstream TLS identity and trust roots are explicit; - retries on non-idempotent operations are absent or narrowly justified; - logs exclude authorization headers, secrets, and unnecessary bodies; - caller headers are not promoted to trusted identity without validation and replacement; - every route has an owner, data class, environment, and retirement state; - plugin and gateway versions match the validator used in CI. An exception should contain an owner, reason, compensating control, expiry, and review link. A permanent unstructured ignore list is policy drift. ## Validate at Four Different Layers ### 1. Syntax and Schema Parse YAML or JSON, validate required fields and types, and scan for plaintext secrets. Apache APISIX 3.19.0's [Admin API schema validation endpoint](https://apisix.apache.org/docs/apisix/3.19/admin-api/) can validate an entity body before submission: ``` curl "${APISIX_ADMIN_URL}/apisix/admin/schema/validate/routes" \ -H "X-API-KEY: ${APISIX_ADMIN_KEY}" \ -H "Content-Type: application/json" \ -X POST \ --data-binary @route.json ``` This is a runnable command shape when both environment variables and `route.json` are supplied. The endpoint checks the entity schema only. APISIX documents that foreign keys, uniqueness, deployment reachability, and runtime behavior can still fail later. ### 2. Organizational Policy Evaluate the parsed artifact against the rules above. Report the exact resource, rule, evidence, and approved exception. Pin the policy bundle and validator version in the release record. ### 3. Runtime Behavior Start the production gateway version in an isolated environment and test route matching, identity, authorization boundaries, validation, quota, timeout, upstream failure, logging, and secret redaction. Verify the response source: a gateway `401`, plugin `403`, quota `429`, and upstream error prove different paths. ### 4. Adversarial and Bypass Testing Attempt direct upstream access, header spoofing, token substitution, wrong audience, method changes, encoded paths, oversized bodies, slow requests, replay, and cross-tenant objects. A positive smoke test cannot prove these negative properties. ## Protect the Delivery Identity Apache APISIX's Admin API controls the deployed instance. The [3.19.0 documentation](https://apisix.apache.org/docs/apisix/3.19/admin-api/) says to change the Admin API key and review the `allow_admin` IP allowlist. Keep the Admin API on an operator network. Two Boolean defaults define this boundary. `apisix.enable_admin` defaults to `true`: `true` enables the Admin API router for a deployment role that serves it, while `false` disables that router. `deployment.admin.admin_key_required` also defaults to `true`: `true` checks the configured Admin key, while `false` bypasses that key check. The validation command above therefore assumes the default `true` path and sends `X-API-KEY`. An IP allowlist or TLS protects a different boundary and does not restore Admin-key authentication when the check is disabled. Native Admin keys have `admin` and `viewer` roles: `viewer` is limited to `GET`, while `admin` can perform configuration writes. They do not provide per-resource or time-limited grants. If CI should reach only one target for one release window, enforce that narrower authority in an external control-plane service or proxy and network boundary, or through short-lived secret issuance and rotation. Do not describe that external scope as a property of an APISIX Admin key. Deployment topology changes the boundary. In APISIX [decoupled mode](https://apisix.apache.org/docs/apisix/3.19/deployment-modes/), the data plane handles requests while the control-plane role exposes the Admin API. In traditional mode, one role handles both. In file-driven standalone mode, the data plane loads complete YAML or JSON configuration. Choose the validation and credential path for the actual mode; do not assume every data-plane pod should accept administrative writes. Record: - actor and workload identity; - source commit, artifact digest, and policy bundle; - target environment and resource scope; - reviewed creates, changes, and deletions; - approval and exception IDs; - deployment and post-deployment test result. ## Use Runtime Feedback Without Creating an Unsafe Autopilot Collect both prevention and outcome signals: - authentication and authorization denials by reason; - rate, concurrency, and payload-limit rejections; - upstream versus gateway error source; - latency, saturation, and dependency health; - unexpected routes, versions, hosts, and direct-backend traffic; - policy revision and configuration rollout markers; - application-owned fraud, object-denial, and business outcomes. Do not interpret a rise in denials as proof that the control is effective. It may indicate an attack, a broken client release, an expired key set, a policy regression, or a telemetry change. Preserve representative evidence with privacy and retention controls, then assign triage. A safe automated response can stop a rollout or restore a previously approved artifact when a deterministic guardrail is breached. Creating a new deny rule from unreviewed traffic is a different and higher-risk action. ## Define Risk-Proportionate Gates | Change | Minimum security evidence | | ------------------------------- | ------------------------------------------------------------------------------- | | Description or owner metadata | Schema, ownership, and diff review | | Route or upstream change | Match tests, TLS and bypass checks, failure behavior | | Authentication or authorization | Full positive and negative identity matrix plus application boundary review | | Rate or resource policy | Counter key, defaults, dependency failure, fairness, and overload tests | | Logging or telemetry | Field inventory, secret/PII review, delivery failure, retention and access | | New plugin or runtime | Provenance, supported version, configuration schema, sandbox and failure review | High-risk gates can require two-person approval or a canary, but approval does not substitute for evidence. Conversely, forcing every metadata fix through a full attack suite creates noise and encourages bypasses. ## DevSecOps Verification Checklist - Does every security rule state the exact protected boundary and failure behavior? - Are the gateway, plugin, policy, and validator versions pinned? - Do schema checks avoid claiming reference or runtime correctness? - Do tests cover allowed, denied, absent, slow, stale, bypass, and recovery paths? - Is the Admin API isolated from the public request path? - Are CI credentials short-lived, scoped, redacted, and attributable? - Are deletions and expired exceptions reviewed? - Can runtime alerts distinguish gateway rejection from upstream failure? - Does feedback create an owned review item instead of a new unreviewed rule? - Can the team reproduce the evidence for the running policy revision? ## FAQ ### Is a WAF or scanner enough for gateway DevSecOps? No. Those tools provide specific detection evidence. DevSecOps also needs identity, authorization, resource, configuration, delivery, observability, ownership, and remediation controls. ### Should every runtime finding block deployment? No. Define severity, confidence, scope, and expiry rules. A verified critical boundary failure may block; an uncertain anomaly may require triage and additional evidence. ### Can production policy be fixed directly during an incident? Emergency changes may be necessary, but record actor, scope, reason, expiry, and effective state. Follow with a reviewed source change so the emergency state does not become invisible drift. ## Next Steps Connect the security gates to [gateway CI/CD and rollback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ci-cd), [API security scanning](https://api7.ai/learning-center/api-gateway-guide/api-gateway-security-scanning), and [auditable access evidence](https://api7.ai/learning-center/api-gateway-guide/api-access-log-auditing). [Previous article**Multi-Tenant SaaS API Gateways: Isolation, Quotas, and Tenant-Aware Policy**](https://api7.ai/learning-center/api-gateway-guide/multi-tenant-saas-api-gateway-policy)[Next topic · Platform Engineering and Planning**API Discovery and Documentation at the Gateway: Inventory, Ownership, and Drift**](https://api7.ai/learning-center/api-gateway-guide/api-discovery-documentation-gateway) On this page - [Key Takeaways](#key-takeaways) - [Build One Evidence Chain](#build-one-evidence-chain) - [Translate Threats Into Enforceable Requirements](#translate-threats-into-enforceable-requirements) - [Keep Policy as Code Focused](#keep-policy-as-code-focused) - [Validate at Four Different Layers](#validate-at-four-different-layers) - [1. Syntax and Schema](#1-syntax-and-schema) - [2. Organizational Policy](#2-organizational-policy) - [3. Runtime Behavior](#3-runtime-behavior) - [4. Adversarial and Bypass Testing](#4-adversarial-and-bypass-testing) - [Protect the Delivery Identity](#protect-the-delivery-identity) - [Use Runtime Feedback Without Creating an Unsafe Autopilot](#use-runtime-feedback-without-creating-an-unsafe-autopilot) - [Define Risk-Proportionate Gates](#define-risk-proportionate-gates) - [DevSecOps Verification Checklist](#devsecops-verification-checklist) - [FAQ](#faq) - [Is a WAF or scanner enough for gateway DevSecOps?](#is-a-waf-or-scanner-enough-for-gateway-devsecops) - [Should every runtime finding block deployment?](#should-every-runtime-finding-block-deployment) - [Can production policy be fixed directly during an incident?](#can-production-policy-be-fixed-directly-during-an-incident) - [Next Steps](#next-steps)