The API Gateway is the dedicated runtime component in the IBM API Connect architecture responsible for processing and controlling API traffic. It acts as a proxy, intercepting all incoming API requests. At this point, it enforces the policies that have been defined in the API Manager, such as security checks (e.g., OAuth, API key validation), rate limiting, and traffic logging. After successful policy enforcement, the Gateway routes the request to the appropriate backend service. It is the data plane component where policies are actively applied to live traffic.

1. IBM API Connect v10.x Documentation: In the "API Connect components" section

the role of the Gateway is explicitly defined: "The Gateway is the component that enforces runtime policies to secure and control API traffic. The Gateway proxies and processes the API requests and responses."

Source: IBM. (2023). API Connect components. IBM API Connect 10.0.x Documentation. Retrieved from the IBM Knowledge Center. (Section: "API Connect components" > "Gateway").

2. IBM Redbooks: This publication details the architecture

stating

"The API gateway is the policy enforcement point that secures and controls API traffic. It is the component that handles the API traffic at run time."

Source: IBM Redbooks. (2018). IBM API Connect 2018.x Essentials. (SG24-8353-00). Page 10

Section 1.3.1 "API Connect components".

3. IBM API Connect v10.x Documentation: The overview section further clarifies the separation of duties: "You use the API Manager user interface to manage APIs for your provider organizations... The API Gateway is responsible for routing the API traffic and for the enforcement of the API security policies."

Source: IBM. (2023). API Connect overview. IBM API Connect 10.0.x Documentation. Retrieved from the IBM Knowledge Center. (Section: "API Connect overview").