Unleash your streaming data with the Gravitee Event-Native API Gateway

Gravitee provides multi-protocol, multi-API support so you can consume backend streaming services and brokers any way you want, including REST, SSE, Websockets and more. Easily integrate streaming back-ends with front-end applications.

Enforce client-side authorization via protocols like OAuth2, set rate limits, consumption limits, and enforce threat protection mechanisms

Gravitee comes with a pre-built service catalog, where you can expose event and data streams as APIs, along with their documentation, access information, and provide self-service subscription options.

Unlock your back end data streams and leverage them in real-time web and mobile applications

Allow clients to consume and produce against Kafka as HTTP, REST, Websockets, Webhooks and SSE.

Whether that’s securely pushing in data to a Kafka topic via a POST or receiving real-time updates via a websocket, Gravitee lets you choose how to expose your data, with no need to use Kafka Connect. 

Perfect for leveraging IoT applications, Gravitee lets you access MQTT data via REST, Websockets, Webhooks and SSE.

This allows IoT devices to participate in a broader ecosystem while Gravitee takes care of the typically complex protocol. Automatically load balance across multiple MQTT brokers.

Solace is a leading enterprise event streaming and management platform used by organizations globally.

Now the Solace+Gravitee combination allows you to have your Solace data exposed to a wider array of external consumers, safely, securely and in a controlled manner.

Allow clients to consume and produce against RabbitMQ as HTTP, REST, Websockets, Webhooks and SSE.

Whether that’s securely pushing in data to RabbitMQ via a POST or receiving real-time updates via a websocket, Gravitee lets you choose how to expose your data, with no need to use other proxies.

Policies let you apply rules and logic at both the connection and message level in order to perform actions such as limiting consumption, perform traffic shaping and data transformations and collect usage data.

Gravitee ships with hundreds of policies out of the box and also makes it easy for you to create your own policies

Automatically support load balancing across multiple brokers or back end data streaming providers allowing you to deploy Gravitee in the largest of enterprises with complex deployments.

Supports all typical algorithms such as round-robin, weighted round-robin, random etc.

Automatically support Failover scenarios such as redirecting requests in the event of slow response times.

Support retry attempts, automatic failover, message offsets, quality of service, message durability and more.

Utilizing your data streams in an enterprise use case requires more than a simple proxy.

Gain full insight with detailed traffic and analytics.

Get analytics at a per-entry point level, along with detailed traffic analysis at both a connection level and message level with detailed run-time logs, message introspection and status codes.

A JSON Web Token (JWT) is an open method for representing claims securely between two parties. It is digitally signed using an HMAC shared key or RSA public/private key pair.

Easily apply JWT authentication of consumers against your backend brokers.

The API key authentication type enforces verification of API keys during request processing, allowing only applications with approved API keys to access an API. This plan type ensures that API keys are valid, i.e., not revoked or expired, and are approved to consume the specific resources associated with the API.

OAuth 2.0 is an open standard that applications can use to provide client applications with secure, delegated access. OAuth 2.0 works over HTTPS and authorizes devices, APIs, servers, and applications via access tokens instead of credentials.

The OAuth2 authentication type checks access token validity during request processing using token introspection. If the access token is valid, the request is allowed to proceed. If not, the process stops and rejects the request.

A Push plan is used when an API contains an entrypoint that sends message payloads to API consumers (e.g., Webhook). This type of plan is unique in that the security configuration is defined by the API consumer, in the subscription request created in the Developer Portal. For example, when subscribing to a Webhook entrypoint, the API consumer specifies the target URL and authentication for the Gateway to use when sending messages.