15.1. Solution overview

The following diagram shows how a request is processed by the Airlock Gateway using API keys with Airlock IAM.

The focus of the following is on API key-based access control. All other API protection features - such as filtering or enforcing API specifications - are not shown.

Exemplary API access

APIKeys-Overview
(1)
The administrator creates a Tech-Client and issues one or more API keys in the Airlock IAM Adminapp.
Note: This step can be done manually in the Adminapp web application or using the REST API.
(2)
The API key is delivered to the Tech-Client (the API client) and attached to each API request.
(3)
The Airlock Gateway applies all filters on the request, extracts the API key, and looks up information about the Tech-Client by calling the API Policy Service end-point in Airlock IAM (this step may be skipped using cached information).
(4)
Based on the Tech-Client attributes, the Airlock Gateway decides whether access to the API is granted and what rate limit applies. The request is passed to the API service.