[](https://www.paloaltonetworks.com/?ts=markdown) * Sign In * Customer * Partner * Employee * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown) * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * EN * [USA (ENGLISH)](https://www.paloaltonetworks.com) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca) * [CHINA (简体中文)](https://www.paloaltonetworks.cn) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it) * [JAPAN (日本語)](https://www.paloaltonetworks.jp) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk) * ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) * [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html) ![x close icon to close mobile navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg) [![Palo Alto Networks logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)](https://www.paloaltonetworks.com/?ts=markdown) ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * [](https://www.paloaltonetworks.com/?ts=markdown) * Products ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Products [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [AI Security](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise Device Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical Device Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [OT Device Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Cortex Advanced Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Unit 42 Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Solutions ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Solutions Secure AI by Design * [Secure AI Ecosystem](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [Secure GenAI Usage](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) Network Security * [Cloud Network Security](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Data Center Security](https://www.paloaltonetworks.com/network-security/data-center?ts=markdown) * [DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Intrusion Detection and Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Device Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [OT Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Secure All Apps, Users and Locations](https://www.paloaltonetworks.com/sase/secure-users-data-apps-devices?ts=markdown) * [Secure Branch Transformation](https://www.paloaltonetworks.com/sase/secure-branch-transformation?ts=markdown) * [Secure Work on Any Device](https://www.paloaltonetworks.com/sase/secure-work-on-any-device?ts=markdown) * [VPN Replacement](https://www.paloaltonetworks.com/sase/vpn-replacement-for-secure-remote-access?ts=markdown) * [Web \& Phishing Security](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) Cloud Security * [Application Security Posture Management (ASPM)](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Code Security](https://www.paloaltonetworks.com/cortex/cloud/code-security?ts=markdown) * [Cloud Security Posture Management (CSPM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management (CIEM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management (DSPM)](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management (AI-SPM)](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Cloud Workload Protection (CWP)](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [Web Application \& API Security (WAAS)](https://www.paloaltonetworks.com/cortex/cloud/web-app-api-security?ts=markdown) Security Operations * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Security Information and Event Management](https://www.paloaltonetworks.com/cortex/modernize-siem?ts=markdown) * [Network Security Automation](https://www.paloaltonetworks.com/cortex/network-security-automation?ts=markdown) * [Incident Case Management](https://www.paloaltonetworks.com/cortex/incident-case-management?ts=markdown) * [SOC Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown) * [Threat Intel Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown) * [Compliance Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/compliance-management?ts=markdown) * [Internet Operations Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/internet-operations-management?ts=markdown) * [Extended Data Lake (XDL)](https://www.paloaltonetworks.com/cortex/cortex-xdl?ts=markdown) * [Agentic Assistant](https://www.paloaltonetworks.com/cortex/cortex-agentic-assistant?ts=markdown) Endpoint Security * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Industries](https://www.paloaltonetworks.com/industry?ts=markdown) * [Public Sector](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown) * [Financial Services](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown) * [Manufacturing](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown) * [Healthcare](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown) * [Small \& Medium Business Solutions](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown) * Services ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Services [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Assess](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/assess/attack-surface-assessment?ts=markdown) * [Breach Readiness Review](https://www.paloaltonetworks.com/unit42/assess/breach-readiness-review?ts=markdown) * [BEC Readiness Assessment](https://www.paloaltonetworks.com/bec-readiness-assessment?ts=markdown) * [Cloud Security Assessment](https://www.paloaltonetworks.com/unit42/assess/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/assess/compromise-assessment?ts=markdown) * [Cyber Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/cyber-risk-assessment?ts=markdown) * [M\&A Cyber Due Diligence](https://www.paloaltonetworks.com/unit42/assess/mergers-acquisitions-cyber-due-diligence?ts=markdown) * [Penetration Testing](https://www.paloaltonetworks.com/unit42/assess/penetration-testing?ts=markdown) * [Purple Team Exercises](https://www.paloaltonetworks.com/unit42/assess/purple-teaming?ts=markdown) * [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/unit42/assess/ransomware-readiness-assessment?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/assess/soc-assessment?ts=markdown) * [Supply Chain Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/assess/tabletop-exercise?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * [Respond](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Cloud Incident Response](https://www.paloaltonetworks.com/unit42/respond/cloud-incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Managed Detection and Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/unit42/respond/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * [Transform](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [IR Plan Development and Review](https://www.paloaltonetworks.com/unit42/transform/incident-response-plan-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/transform/security-program-design?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/transform/vciso?ts=markdown) * [Zero Trust Advisory](https://www.paloaltonetworks.com/unit42/transform/zero-trust-advisory?ts=markdown) [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-unit-42.svg) UNIT 42 RETAINER Custom-built to fit your organization's needs, you can choose to allocate your retainer hours to any of our offerings, including proactive cyber risk management services. Learn how you can put the world-class Unit 42 Incident Response team on speed dial. Learn more](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) * Partners ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Partners NextWave Partners * [NextWave Partner Community](https://www.paloaltonetworks.com/partners?ts=markdown) * [Cloud Service Providers](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown) * [Global Systems Integrators](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown) * [Technology Partners](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown) * [Service Providers](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown) * [Solution Providers](https://www.paloaltonetworks.com/partners/nextwave-solution-providers?ts=markdown) * [Managed Security Service Providers](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown) * [XMDR Partners](https://www.paloaltonetworks.com/partners/managed-security-service-providers/xmdr?ts=markdown) Take Action * [Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown) * [Managed Services Program](https://www.paloaltonetworks.com/partners/managed-security-services-provider-program?ts=markdown) * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner) * [Request Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess) * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator) [CYBERFORCE CYBERFORCE represents the top 1% of partner engineers trusted for their security expertise. Learn more](https://www.paloaltonetworks.com/cyberforce?ts=markdown) * Company ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Company Palo Alto Networks * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com) * [Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Military \& Veterans](https://jobs.paloaltonetworks.com/military) [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown) * [Precision AI Security](https://www.paloaltonetworks.com/precision-ai-security?ts=markdown) * [Our Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown) * [Accelerate Your Cybersecurity Transformation](https://www.paloaltonetworks.com/why-paloaltonetworks/nam-cxo-portfolio?ts=markdown) * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown) * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown) * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown) Careers * [Overview](https://jobs.paloaltonetworks.com/) * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/) [A Newsweek Most Loved Workplace "Businesses that do right by their employees" Read more](https://www.paloaltonetworks.com/company/press/2021/palo-alto-networks-secures-top-ranking-on-newsweek-s-most-loved-workplaces-list-for-2021?ts=markdown) * More ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) More Resources * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Tech Insider](https://techinsider.paloaltonetworks.com/) * [Knowledge Base](https://knowledgebase.paloaltonetworks.com/) * [Palo Alto Networks TV](https://tv.paloaltonetworks.com/) * [Perspectives of Leaders](https://www.paloaltonetworks.com/perspectives/?ts=markdown) * [Cyber Perspectives Magazine](https://www.paloaltonetworks.com/cybersecurity-perspectives/cyber-perspectives-magazine?ts=markdown) * [Regional Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Security Posture Assessment](https://www.paloaltonetworks.com/security-posture-assessment?ts=markdown) * [Threat Vector Podcast](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/) * [Packet Pushers Podcasts](https://www.paloaltonetworks.com/podcasts/packet-pusher?ts=markdown) Connect * [LIVE community](https://live.paloaltonetworks.com/) * [Events](https://events.paloaltonetworks.com/) * [Executive Briefing Center](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown) * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown) * [Contact us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) [Blog Stay up-to-date on industry trends and the latest innovations from the world's largest cybersecurity Learn more](https://www.paloaltonetworks.com/blog/) * Sign In ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Sign In * Customer * Partner * Employee * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown) * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * EN ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Language * [USA (ENGLISH)](https://www.paloaltonetworks.com) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca) * [CHINA (简体中文)](https://www.paloaltonetworks.cn) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it) * [JAPAN (日本語)](https://www.paloaltonetworks.jp) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) * [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html) * [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown) Search All * [Tech Docs](https://docs.paloaltonetworks.com/search) Close search modal [Deploy Bravely --- Secure your AI transformation with Prisma AIRS](https://www.deploybravely.com) [](https://www.paloaltonetworks.com/?ts=markdown) 1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) 2. [Cloud Security](https://www.paloaltonetworks.com/cyberpedia/cloud-security?ts=markdown) 3. [CWPP](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform?ts=markdown) 4. [What Is an API Gateway?](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway?ts=markdown) Table of Contents * [What Is a Cloud Workload Protection Platform (CWPP)?](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform?ts=markdown) * [The Importance of a CWPP](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform#importance?ts=markdown) * [Key Features of a CWPP](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform#features?ts=markdown) * [Benefits of a CWPP](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform#benefits?ts=markdown) * [Cloud Workload Protection Vs. Application Security](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform#security?ts=markdown) * [CWPPs and the Cloud-Native Application Protection Platform](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform#protection?ts=markdown) * [CWPP Considerations for Security Leaders](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform#leaders?ts=markdown) * [Cloud Workload Protection Platform FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-cwpp-cloud-workload-protection-platform#faqs?ts=markdown) * [What Is a Workload?](https://www.paloaltonetworks.com/cyberpedia/what-is-workload?ts=markdown) * [Workloads Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-workload#workloads?ts=markdown) * [Cloud Workload Characteristics](https://www.paloaltonetworks.com/cyberpedia/what-is-workload#cloud?ts=markdown) * [Cloud or On-Premises?](https://www.paloaltonetworks.com/cyberpedia/what-is-workload#phases?ts=markdown) * [Workload Management](https://www.paloaltonetworks.com/cyberpedia/what-is-workload#manage?ts=markdown) * [Workload Automation](https://www.paloaltonetworks.com/cyberpedia/what-is-workload#automation?ts=markdown) * [Cloud Workload Protection](https://www.paloaltonetworks.com/cyberpedia/what-is-workload#protection?ts=markdown) * [What Is API Security?](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security?ts=markdown) * [API Security Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#api?ts=markdown) * [Definition of an API](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#definition?ts=markdown) * [Why API Security Is Important](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#why?ts=markdown) * [Traditional Approach to Web Application Security](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#traditional?ts=markdown) * [Anatomy of an API Attack](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#anatomy?ts=markdown) * [API Security Risks](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#risks?ts=markdown) * [API Security for SOAP, REST and GraphQL](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#graphql?ts=markdown) * [API Security Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#best?ts=markdown) * [Cortex Cloud's API Security Solution](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#prisma?ts=markdown) * [API Security FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security#faqs?ts=markdown) * [Agentless vs Agent-Based Security](https://www.paloaltonetworks.com/cyberpedia/what-is-the-difference-between-agent-based-and-agentless-security?ts=markdown) * [Agentless Security](https://www.paloaltonetworks.com/cyberpedia/what-is-the-difference-between-agent-based-and-agentless-security#agentless?ts=markdown) * [Is Agentless or Agent-Based Security Better?](https://www.paloaltonetworks.com/cyberpedia/what-is-the-difference-between-agent-based-and-agentless-security#better?ts=markdown) * [FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-the-difference-between-agent-based-and-agentless-security#faqs?ts=markdown) * [What is the Difference Between Web Application Firewall (WAF) and Next-Generation Firewall (NGFW)?](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws?ts=markdown) * [What Is a Web Application Firewall (WAF)?](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws#what?ts=markdown) * [What Is an NGFW?](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws#ngfw?ts=markdown) * [The Similarities and Differences Between WAFs and NGFWs](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws#the?ts=markdown) * [When to Use WAFs vs. NGFWs](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws#when?ts=markdown) * [How Do WAFs and NGFWs Complement Each Other?](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws#how?ts=markdown) * [What Customers Should Consider When Searching for a Web Application Security Solution](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws#solution?ts=markdown) * [WAF vs NGFW FAQs](https://www.paloaltonetworks.com/cyberpedia/difference-between-wafs-and-ngfws#faqs?ts=markdown) * [What Is Layer 7?](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7?ts=markdown) * [Layer 7 Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#what?ts=markdown) * [Understanding the OSI Model](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#osi?ts=markdown) * [How Does Data Flow Through the OSI Model?](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#how?ts=markdown) * [The Role of Layer 7](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#role?ts=markdown) * [Layer 7 Load Balancing](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#load?ts=markdown) * [Layer 7 Security](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#security?ts=markdown) * [OSI Model Vs. the TCP/IP Model](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#model?ts=markdown) * [Layer 7 and the OSI Model FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-layer-7#faqs?ts=markdown) * [What Is Web Application and API Protection?](https://www.paloaltonetworks.com/cyberpedia/what-is-web-application-and-api-protection?ts=markdown) * What Is an API Gateway? * [API Gateway Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#explained?ts=markdown) * [API Gateways for Microservices Architectures](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#architectures?ts=markdown) * [What Is the API Gateway Pattern?](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#pattern?ts=markdown) * [Challenges of API Gateways Potential Response Time Increases](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#response?ts=markdown) * [Use Cases and API Gateway Benefits](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#benefits?ts=markdown) * [Service Mesh Vs. API Gateway](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#service?ts=markdown) * [API Gateway Vs. Load Balancer](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#balancer?ts=markdown) * [API Gateways Security and WAFs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#security?ts=markdown) * [API Gateway Solutions](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#solutions?ts=markdown) * [Industry Practices and Standards](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#practices?ts=markdown) * [API Gateway FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#faqs?ts=markdown) # What Is an API Gateway? 5 min. read Table of Contents * * [API Gateway Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#explained?ts=markdown) * [API Gateways for Microservices Architectures](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#architectures?ts=markdown) * [What Is the API Gateway Pattern?](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#pattern?ts=markdown) * [Challenges of API Gateways Potential Response Time Increases](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#response?ts=markdown) * [Use Cases and API Gateway Benefits](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#benefits?ts=markdown) * [Service Mesh Vs. API Gateway](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#service?ts=markdown) * [API Gateway Vs. Load Balancer](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#balancer?ts=markdown) * [API Gateways Security and WAFs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#security?ts=markdown) * [API Gateway Solutions](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#solutions?ts=markdown) * [Industry Practices and Standards](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#practices?ts=markdown) * [API Gateway FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#faqs?ts=markdown) 1. API Gateway Explained * * [API Gateway Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#explained?ts=markdown) * [API Gateways for Microservices Architectures](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#architectures?ts=markdown) * [What Is the API Gateway Pattern?](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#pattern?ts=markdown) * [Challenges of API Gateways Potential Response Time Increases](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#response?ts=markdown) * [Use Cases and API Gateway Benefits](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#benefits?ts=markdown) * [Service Mesh Vs. API Gateway](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#service?ts=markdown) * [API Gateway Vs. Load Balancer](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#balancer?ts=markdown) * [API Gateways Security and WAFs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#security?ts=markdown) * [API Gateway Solutions](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#solutions?ts=markdown) * [Industry Practices and Standards](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#practices?ts=markdown) * [API Gateway FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-api-gateway#faqs?ts=markdown) An API gateway is a server that acts as an intermediary between clients and [microservices](https://www.paloaltonetworks.com/cyberpedia/what-are-microservices?ts=markdown) in a distributed software architecture, often within a cloud environment. Serving as a reverse proxy, it handles client requests, routes them to the appropriate microservices and aggregates responses from multiple microservices into one response for the client. The API gateway also provides additional functionality, such as authentication, authorization, rate limiting, caching, and monitoring. By centralizing these functions, the API gateway simplifies the development, management, and scalability of microservices-based applications. ## API Gateway Explained API gateways are traffic conductors. They facilitate interactions between client applications and backend services. Operating as an intermediary between application programming interfaces (APIs) and their clients, the API gateway serves as the enforcement point for policies at runtime. This control includes how the gateway accepts API calls, routes requests to the appropriate services, aggregates results for responses, and translates protocols. Gateways also handle tasks like API authentication, rate limiting, and logging. By governing end-to-end access, transforming data and facilitating analytics, the API gateway earns a place in an organization's API management strategy. ![API Gateway for microservices](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/api-gateway-microservices.jpg "API Gateway for microservices") *Figure 1: Using an API gateway for client-to-microservice communication* The API gateway offers a unified point of access to the distributed architecture of [cloud-native](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-native?ts=markdown) microservices. By orchestrating interactions, steering traffic, and providing a layer of abstraction, the gateway simplifies the client's view of the backend. Its primary role lies in encapsulating the internal microservices and system architecture and exposing a set of tailored APIs to the client. ### How the API Gateway Works From the API call and response to performance and API protection, fulfilling its multifaceted role involves many steps. **Request Handling and Routing** When a client sends a request, the API gateway receives it and inspects the HTTP method, headers and URI to determine the target microservice. The gateway uses preconfigured routing rules to forward the request to the appropriate microservice instance. This process often involves load-balancing algorithms, such as Round Robin or Least Connections, to distribute the requests among the available instances. **Protocol Translation** API gateways can perform protocol translation between clients and microservices, allowing them to communicate using different protocols. A client might send a request using HTTP/REST, for example, which the gateway translates into a gRPC or message queue-based request before forwarding it to the target microservice. **Authentication and Authorization** [API security](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security?ts=markdown) is a crucial aspect of API management. The API gateway can act as a centralized point for implementing authentication and authorization mechanisms. It can integrate with identity providers (e.g., OAuth, OpenID Connect, SAML, or JWT) to validate incoming requests and ensure that clients have permissions to access the requested resources. **Rate Limiting and Quotas** To protect microservices from excessive load or abuse, the API gateway can enforce rate limits and quotas on incoming requests. Developers can establish this based on the client Internet Protocol, API key, user account, or other factors. **Response Transformation and Aggregation** The API gateway can modify and aggregate responses from multiple microservices before sending them back to the client. This includes transformations like adding, removing, or renaming fields in the response payload, converting data formats (e.g., XML to JSON), and aggregating data from multiple microservice responses into a single response object. **Caching** The API gateway can cache responses from microservices to reduce latency and improve performance. By storing frequently accessed data in-memory, the gateway can quickly respond to client requests without needing to repeatedly query the same data from the microservices. **Monitoring, Logging and Analytics** The API gateway can log incoming requests, responses, and errors, which provide valuable analytics data. This information can help system administrators and developers identify performance bottlenecks, detect security incidents and ensure the overall health of the system. **Resilience and Fault Tolerance** API gateways can implement resiliency patterns such as circuit breakers, retries, and timeouts to handle failures in the underlying microservices. In case a microservice instance becomes unresponsive or fails, the gateway can automatically redirect requests to other available instances, ensuring high availability and fault tolerance. ## API Gateways for Microservices Architectures Without an API gateway, developers would need to expose microservices to incoming requests and let the microservices determine how to respond. Imagine the resources needed for each microservice to decide whether to respond --- on a scale of multiple microservices per application and countless requests. The API gateway is a building block in [microservices architectures](https://www.paloaltonetworks.com/cyberpedia/what-are-microservices?ts=markdown), facilitating their decoupling nature and enhancing independent scalability and resilience. Acting as a façade, the gateway offers one entry point and a standardized interface that shields clients from the complexities of the underlying microservices. The gateway can tailor protocols to each microservice while presenting a consistent API to clients. It can also simplify client-side logic by translating between API styles --- HTTP REST, gRPC, GraphQL --- and aggregate responses from multiple services into a single response. ![API Transformation](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/api-transformation.jpg "API Transformation") *Figure 2: API transformation function in an API gateway* ## What Is the API Gateway Pattern? The API gateway pattern defines an approach where a server acts as a single-entry point for different types of clients --- web, mobile, desktop --- accessing a system comprising numerous microservices. The pattern aims to encapsulate the system's architecture by simplifying the client's interaction and reducing the number of requests and amount of data that needs to pass between client and server. ### Reverse Proxy or Gateway Routing The gateway routes client requests to the appropriate services within the system. By doing so, it hides the complexity of the system's internal structure from the client and reduces the client's need to manage multiple service endpoints. ### Requests Aggregation The API gateway pattern can aggregate responses from multiple services into one response to minimize the number of round-trip requests between the client and the server. This helps to improve efficiency and reduce latency. ### Cross-Cutting Concerns or Gateway Offloading The gateway handles cross-cutting concerns applicable across various services. Concerns can include logging, metrics, rate limiting and security. By managing them at the gateway level, it offloads these tasks from individual services, allowing them to focus on their core business logic. ![API Gateway Pattern](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/api-gateway-pattern.jpg "API Gateway Pattern") *Figure 3: The pattern is part of a distributed system reverse proxy or gateway routing.* ## Challenges of API Gateways Potential Response Time Increases While API gateways generally increase efficiency, they can introduce latency. The added processing steps for tasks like request routing, composition, and protocol translation can increase response time. Optimizing the performance of the API gateway will prevent it from forming a bottleneck. ### Dependencies If not designed for scalability, API gateways can create dependencies, hindering the independent deployment and scalability of microservices. When all traffic has to pass through the gateway, it may limit the velocity and autonomy that a microservices architecture usually enables. ### Complexity Implementing an API gateway adds another layer of complexity to the system. Configuration, maintenance, and the ongoing development of the gateway require effort and expertise, which might increase overhead on the team, especially for smaller projects. ### Security Compromise While an API gateway can enhance security, it can also pose risks if compromised. Because it's a single point of entry to the system, any security breach could expose the underlying services. Careful design and implementation of security controls are imperative to mitigate risks. ### Single Gateway Reliability The architecture of the API gateway poses another challenge --- availability. Given its role in handling all incoming API calls, any downtime can impact the system. Ensuring high availability, redundancy, and fault tolerance of the API gateway gains importance in a production environment. ## Use Cases and API Gateway Benefits API gateways serve diverse use cases across different architectural environments, playing a notable role in shaping the behavior of applications, particularly in distributed architectures. ### Microservices Security As these architectures proliferate numerous discrete services, coordinating interactions and routing requests becomes convoluted. An API gateway can streamline the process, handling request routing, composition, and protocol translation. It stands at the frontline, directing incoming API calls to backend services. And as mentioned, by serving as a single entry point into the system, the API gateway can offer a layer of defense to fortify the security of microservices. It can enforce policies like SSL termination, access control and IP whitelisting, eliminating the need for each microservice to implement these measures. This arrangement simplifies the security landscape and reduces the potential for errors and vulnerabilities. ### API Authentication An API gateway can authenticate user or system credentials, ensuring that only authorized entities can access the services. It supports different authentication mechanisms, such as OAuth or JWT, which offloads this responsibility from individual microservices and promotes better security practices. ### Input Validation API gateways can perform request validation to ensure only correctly formatted data enters the system. By rejecting invalid requests at the gateway, it lightens the load on individual microservices, allowing them to focus on their primary functions. ### Serverless Support In the context of serverless architectures, API gateways take on additional significance. With backend services running on demand, the API gateway needs to manage invocation requests for these functions. It also provides a buffer against the cold-start latency inherent in serverless environments. API gateways also play a role in managing the lifecycle of function-based services, including their invocation, scaling, and performance monitoring. They also handle version control, deployment, and staging, helping to streamline the function-as-a-service (FaaS) model that underpins serverless computing. ### Billing for Microservices In commercial settings, API gateways can manage billing and metering for API usage. They can track the number of requests each client makes and can enforce usage quotas and limits, which allows for a granular understanding of API usage and supports a usage-based billing model. ### Microservices Caching API gateways can take advantage of caching. By storing the response of a service request, the gateway can serve repeated requests for the same data, improving response times and reducing the load on backend services. It can also implement response compression to reduce bandwidth consumption and improve network efficiency. ### Extending Legacy Apps Use cases extend to the modernization of legacy systems. An API gateway allows organizations to wrap legacy applications in modern, RESTful APIs. This technique enables these legacy systems to interact with modern applications and services without extensive refactoring. ### Supports for DevOps and Serverless Environments In [DevOps practices](https://www.paloaltonetworks.com/cyberpedia/what-is-devops?ts=markdown), an API gateway forms a crucial bridge between development and operations teams by establishing a unified front for all the microservices. It promotes continuous integration and delivery by ensuring that API changes and deployments do not negatively affect the system's overall operation. ## Service Mesh Vs. API Gateway While both a service mesh and an API gateway manage interservice communication, their focus areas differ. A comprehensive microservices strategy often includes both an API gateway and a service mesh. Acting as a reverse proxy, the API gateway deals with client-to-services communication, or north-south traffic. The service mesh provides service discovery, load balancing, failure recovery, metrics and monitoring through service-to-service communication, or east-west traffic. ## API Gateway Vs. Load Balancer A load balancer and an API gateway have overlapping functions, but their primary objectives diverge. A load balancer distributes network traffic across multiple servers to enhance responsiveness and availability. Operating at the transport layer, it distributes load based on policies and the health of backend servers. An API gateway operates at a higher level, focusing on application logic. It handles routing, aggregation, protocol translation and security. While it also can distribute requests among services, its features surpass those of a typical load balancer, encompassing application-level concerns and policies. *Video 1: Overview of API security and tips for enhancing API security* ## API Gateways Security and WAFs API gateways and [web application firewalls (WAFs)](https://www.paloaltonetworks.com/cyberpedia/what-is-a-web-application-firewall?ts=markdown) play distinct yet interconnected roles in the security and efficiency of web applications. The API gateway focuses on ensuring the correct use of APIs by enforcing valid request structures and authenticating and authorizing clients. It can block requests that don't meet criteria, but it usually can't inspect the content of the requests for patterns matching known attack vectors. The WAF operates as a protective barrier for web applications, intercepting and inspecting HTTP traffic to identify and block threats. By using predefined security rules and anomaly detection, the WAF can prevent SQL injection, cross-site scripting (XSS), distributed denial-of-service (DDoS), and other types of attack. Its rules can also be updated to guard against newly discovered vulnerabilities and attack methods, which makes the WAF a vital line of defense against web application attacks. In practice, using an API gateway with a WAF provides a layered security approach. The API gateway manages interactions with the API, while the WAF provides an additional security layer against malicious activity. Together, they offer a powerful combination of application management and [API security](https://www.paloaltonetworks.com/cyberpedia/what-is-api-security?ts=markdown). ## API Gateway Solutions Organizations have several deployment options for API gateway, depending on the requirements and infrastructure of their applications. * On-premises: Organizations can deploy an API gateway on-premises within a data center, which provides control over the infrastructure and security. * Cloud-based: API gateway can be deployed in a public or private cloud environment, offering scalability, and flexibility. * Serverless: Using serverless computing platforms such as AWS Lambda or Azure Functions eliminates the need for organizations to manage underlying infrastructure. * Hybrid: With a combination of on-premises, cloud or serverless environments, organizations can meet unique application requirements. When exploring your API gateway options, look for a solution that meets your application's requirements. Consider factors like scalability, extensibility, and integration with existing infrastructure and services. Popular solutions include: **Amazon API Gateway** A fully managed service from Amazon Web Services (AWS), Amazon API Gateway handles all aspects of API management and traffic management. It supports WebSocket and REST APIs, has built-in DDoS protection, integrates with AWS services like Lambda and DynamoDB, and can scale to any volume of traffic. **Azure API Management** This Microsoft offering includes an API gateway, developer portal, and a variety of tools for defining and managing APIs. It offers features like throttling, routing, caching, identity provider integration and analytics. **Kong** An open-source API gateway and platform built on top of NGINX, Kong offers extensibility through a rich plugin ecosystem that includes integration with various databases and services. Kong also provides load balancing, authentication, rate limiting, and health checks. **Apigee** Apigee by Google Cloud provides a full-featured API platform that includes an API gateway, developer portal and tools for API design, monetization, security, analytics, and operations. **MuleSoft Anypoint Platform** An integration platform that includes API gateway functionality, MuleSoft Anypoint Platform offers features like security, caching and load balancing, along with integration and orchestration capabilities. ## Industry Practices and Standards Follow leading practices for optimal gateway performance. **Implement security best practices:** Ensure that your API gateway is configured to enforce authentication, authorization, and encryption to protect your microservices from unauthorized access and potential security threats. **Monitor and log API traffic:** Collect logs and metrics from your API gateway to gain insights into the performance, availability, and security of your microservices. Use this data to identify issues, optimize performance, and detect potential security threats. **Optimize performance:** Configure caching, rate limiting, and load balancing in your API gateway to improve the performance and reliability of your microservices. **Plan for scalability:** Design your API gateway to accommodate growth in your application's user base and the number of microservices it supports. Consider using cloud-based or serverless deployment options for better scalability. **Maintain API documentation:** Keep your API documentation up to date and easily accessible for developers and clients, ensuring they have the information needed to interact with your microservices effectively. **Implement versioning:** Allow versioning in your API gateway to manage changes and updates to your microservices without breaking existing clients. **Use health checks and monitoring:** Regularly monitor the health and performance of your API gateway and microservices, setting up alerts and notifications to quickly detect and address issues. **Adopt a DevOps/DevSecOps culture:** Encourage collaboration between development, security and operations teams, ensuring that security and performance standards are integrated throughout the application lifecycle. ## API Gateway FAQs ### What is an API (Application Programming Interface)? APIs are sets of protocols and tools for building software applications. They define the methods and data formats that an application should use to communicate with other software components, operating systems or microservices. ### What is an API call? An API call is the process that takes place when you send a request after setting up your API with the correct endpoints. Your information is transferred, processed, and feedback is returned back. An API call is a command from a user or system to the API of another system. ### What is an API request? An API request is a communication from a client to an API that tells it to perform a specific action. It involves making a call to an API endpoint and typically includes: * Base URL of the API * Path specifying a resource * HTTP method indicating the desired action * Headers containing metadata * Possibly a body with data ### What is API authentication? API authentication is a process that validates the identities of parties involved in API interactions. It uses methods like API keys, OAuth, or JWT to ensure that only authorized parties can access the API. ### What is an API key? An API key is a unique identifier used to authenticate a client, developer, or calling program when making requests to an API. Typically generated as a long string of random characters by the API provider, API keys are issued to users who include the key in their requests. API gateways can be configured to require API keys for access. While they don't directly provide security, they help track and control how the API is used. ### What is an API ID? An API ID is a unique identifier for an API. It is used for tracking, management, and controlling access to an API. In cloud services like AWS, each instance of an API gateway deployment is given an API ID, which is used in the invocation URL for the API. Similarly, in Google Cloud, each API is assigned a project ID and an API ID that are used to manage and call the API. ### What is API caching? API caching stores the responses from microservices in a cache, allowing API gateway to serve cached responses to clients instead of forwarding requests to the microservices. Caching can improve application performance by reducing the load on the microservices and minimizing response times for clients. ### What is fault tolerance? Fault tolerance is the ability of a system to continue operating correctly even in the presence of failures, such as hardware failures, software errors, or network issues. API gateway can be designed to provide fault tolerance by implementing features like load balancing, circuit breakers, and retries, ensuring that client requests are still processed even if some microservices are unavailable. ### What is API throttling? API throttling is the process of limiting the number of API requests a client can make in a specific period. Throttling is used to prevent excessive load on the backend servers, ensuring fair usage of resources and protecting the API from potential denial-of-service attacks. API gateway can be configured to enforce rate limiting based on client IP addresses, API keys, or other identifiers. ### What is serverless computing? [Serverless computing](https://www.paloaltonetworks.com/cyberpedia/what-is-serverless-security?ts=markdown) is a cloud computing execution model that allows developers to build and run applications without managing the underlying infrastructure. In serverless computing, cloud providers automatically allocate resources and handle scaling, patching, and capacity planning. Developers only pay for the compute resources and execution time their applications consume. ### What is a reverse proxy? A reverse proxy is a server that sits between clients and one or more backend servers, forwarding client requests to the appropriate backend server and returning the server's response to the client. Reverse proxies can be used for load balancing, caching, and security purposes. ### What is a service mesh? A service mesh is a configurable infrastructure layer for a microservices application. It facilitates service-to-service communications, resilience, and observable behavior, while offloading these capabilities from the individual services. ### What is transformation in API? API transformation refers to the process of modifying or converting the structure, format, or content of data exchanged between an API and its consumers. Transformation allows for communication and interoperability between different systems or applications that may have varying data requirements. In the context of APIs, transformation typically involves modifying the payload or data representation format, such as converting XML to JSON or vice versa, altering the data structure or performing data validation and enrichment. It can also include tasks like data mapping, protocol translation, or encryption/decryption. API transformation plays a crucial role in ensuring compatibility and efficient data exchange between the API provider and consumers, especially when dealing with heterogeneous systems or when adapting to different standards or protocols. ### What is meant by versioning? When you implement versioning in your API gateway, you allow multiple versions of your API to coexist and be accessible to clients. Versioning maintains backward compatibility for older clients when you introduce new features, make changes to existing ones, or fix bugs in your microservices. API versioning ensures that your existing clients don't break when updates are made to the API, and it provides a smooth transition for clients to adopt the new API changes. ### What is a REST API? A REST API (Representational State Transfer API) is a type of API that adheres to the principles of REST architectural style. It uses standard HTTP methods and is stateless, meaning each request from a client contains all the information needed to process the request. REST APIs interact with resources, where each resource is identified by a specific URL. The API uses different HTTP methods to manipulate these resources. ### What is a RESTful API? A RESTful API is essentially the same as a REST API. The term emphasizes that the API adheres strictly to the principles of REST. This means the API has a clear separation of concerns (client-server architecture), it is stateless; it can cache data to improve performance; it has a uniform interface; and it is layered, allowing for encapsulation of legacy services and components. ### What is a WebSocket API? A WebSocket API is a type of API that enables live, bidirectional communication between client and server over a single, long-lived connection. Unlike REST APIs, which are stateless, a WebSocket API maintains a persistent connection, allowing for instantaneous data push and synchronization. ### What is an envoy proxy? Envoy Proxy is a high-performance, open-source edge and service proxy designed for cloud-native applications. It can handle outbound and inbound traffic for all services in an architecture and provides dynamic service discovery, load balancing, TLS termination, HTTP/2 and gRPC proxies, circuit breakers, health checks, and more. Envoy is often used as a component in service mesh deployments. ### What is an API endpoint? An API endpoint is a specific route or URL where an API can be accessed by a client. Each endpoint is associated with a specific function or resource, and it often includes specific paths to perform various operations on that resource. For example, in a RESTful API, an endpoint for a user resource might be '/users', with '/users/{id}' allowing access to a specific user, and HTTP methods like GET, POST, PUT, DELETE used to perform operations on the resource. ### What is an HTTP endpoint? An HTTP endpoint is a URL where a client application can access your API. This endpoint is exposed over HTTP(S) and defined by a URL pattern, an HTTP method (GET, POST, PUT, DELETE, etc.), and the types of data it can accept and return. An API is typically made up of multiple HTTP endpoints, each corresponding to a specific service or functionality. ### What is an HTTP API? An HTTP API is an API that is accessed via HTTP (Hypertext Transfer Protocol) methods, such as GET, POST, PUT, and DELETE. It allows communication between software systems, often serving as a bridge to connect the client and server, so they can send and receive data. HTTP APIs can be built in multiple architectural types, including REST, GraphQL, or gRPC. Similarly, they can return data in various formats, such as JSON or XML. ### What is a backend service? A backend service refers to any service that handles requests from a client application or frontend service but is not directly exposed to the user. Backend services can include databases, microservices, business logic services, and other server-side components. They are responsible for processing requests, performing operations, and returning the results back to the client application. ### What is a backend API? A backend API is an API that serves as the interface for backend services. It encapsulates the business logic, data access operations and other server-side processing needed by client applications or frontend services. Client apps interact with backend APIs to retrieve data, execute business processes, and interact with underlying systems, databases, or other services. A backend API may be implemented in any number of architectural styles, such as REST, GraphQL, or gRPC. ### What is open source? Open source refers to a type of software whose source code is available to the public and can be modified or enhanced by anyone. This promotes collaboration and transparency, as users are free to improve the software, fix bugs, or adapt it for their needs. Notable examples of open-source software include the Linux operating system, the Apache HTTP Server, and the MySQL database management system. ### What is OAuth? OAuth (Open Authorization) is an open standard for access delegation, allowing users to grant third-party applications limited access to their resources without sharing their credentials. OAuth provides a secure and standardized way for applications to request and manage access tokens, which can be used to access protected resources on behalf of a user. ### What is OpenID Connect? OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 protocol, used for user authentication. It allows clients to verify the identity of the user and obtain basic profile information in an interoperable manner. OIDC issues an ID token to the client after successful authentication. This can then be validated to ensure the integrity and authenticity of the user's data. ### What is JSON Web Token (JWT)? JSON Web Token (JWT) is an open standard for securely transmitting information between parties as a JSON object. JWTs are often used for authentication and authorization purposes, as they can be digitally signed or encrypted to ensure the integrity and confidentiality of the transmitted data. In API gateway, JWTs can be used to authenticate clients and authorize access to microservices. ### What is a cloud shell? A cloud shell is a browser-based command-line interface for interacting with cloud resources. It provides a preconfigured, on-demand environment from which users can manage and administer their cloud services. Cloud shells often come with a set of tools pre-installed, allowing developers to run scripts, build applications and carry out administrative tasks directly within the cloud environment. ### What is proxy integration? Proxy integration is a type of API integration in AWS API gateway, where the API acts as a pass-through for requests and responses. This means that incoming requests pass directly to the backend service without needing to be mapped. Responses from the backend service likewise pass directly back to the client. It simplifies the process of integrating APIs with backend services. ### What is a client app? A client app is a software application that runs on a user's device, such as a smartphone or computer, and communicates with remote servers to request services. Examples include web browsers, email clients and messaging apps. They interact with backend servers via APIs to retrieve and manipulate data. ### What is a private API? A private API is an API that's not publicly available or accessible. Its access is restricted to a specific audience, typically within an organization or among specific partners. Private APIs serve internal business needs, improving productivity and efficiency. They are often used to expose data and services for use by other parts of the organization or by specific external partners. Related Content [What Is Web Application and API Protection? APIs can spare developers from making every API from scratch. But ensuring web application and API protection in cloud-native environments is a challenge.](https://www.paloaltonetworks.com/cyberpedia/what-is-web-application-and-api-protection?ts=markdown) [Tip Sheet: Secure Your APIs Unmanaged and unsecured APIs make easy targets for bad actors searching for exposed application logic, resources, and sensitive data.](https://www.paloaltonetworks.com/resources/datasheets/tip-sheet-secure-your-apis?ts=markdown) [5 Best Practices for Securing Modern Web Applications and APIs As Web apps and APIs evolve, so does the attack surface. Developers and security practitioners need a comprehensive solution to protect their web apps and APIs.](https://www.paloaltonetworks.com/resources/ebooks/5-best-practices-for-securing-modern-web-applications-and-apis?ts=markdown) [ESG Research Report: Security API Attack Surface We surveyed IT, cybersecurity, and application development professionals to uncover the latest trends in API security.](https://start.paloaltonetworks.com/2023-api-security-data-in-new-report.html) ![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20Is%20an%20API%20Gateway%3F&body=Explore%20the%20role%20of%20API%20gateways%20in%20software%20development%2C%20simplifying%20microservices%20complexity%20and%20enhancing%20client%20interactions%20with%20applications.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/what-is-api-gateway) Back to Top [Previous](https://www.paloaltonetworks.com/cyberpedia/what-is-web-application-and-api-protection?ts=markdown) What Is Web Application and API Protection? {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2025 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language