InfoQ Homepage API Gateway Content on InfoQ
-
Zone Redundancy Comes to API Management Standard v2
Microsoft has enabled zone redundancy on the Standard v2 tier of Azure API Management, following its arrival on Premium v2 in December. Standard v2 starts at $700 per month against $2,801 for Premium v2, but carries a 99.95% SLA rather than 99.99%. Zone redundancy can only be configured when creating an instance.
-
Microsoft Moves AI Governance from Policy to Runtime Enforcement
Microsoft has outlined an AI governance architecture spanning nine governance domains and four functions: policy, control, visibility, and proof. The approach connects policies with runtime enforcement, continuous evaluation, observability, identity, security, and audit evidence to help organizations verify governance requirements as AI applications and agents operate in production.
-
MCP Goes Stateless, and Developers Ask Whether That Just Makes it an API Again
The MCP 2026-07-28 specification removes the initialize handshake and session header, and adds required method and tool-name headers so gateways can route agent traffic without parsing JSON. Reaction split between developers calling it a rediscovery of REST and those arguing the standard itself was always the point.
-
Azure API Management Adds Dedicated AI Gateway Tier, Governing Models and MCP Tools
Microsoft released a dedicated AI Gateway tier of Azure API Management in public preview, with a control plane built around models, MCP servers and tools rather than APIs. It fronts Foundry, Bedrock, Vertex AI and OpenAI behind one endpoint, with policy cards instead of XML. Architects welcomed the consolidation while questioning where the governance boundary sits.
-
Azure API Management Ships Unified Model API and MCP Content Safety at Build 2026
Azure API Management shipped a Unified Model API that lets clients speak one format while APIM transforms requests to Anthropic, Vertex AI, and other backends. Content safety policies now cover MCP tool calls and Agent-to-Agent payloads alongside LLM traffic. Token metrics expanded to track reasoning, cached, and audio tokens across providers.
-
A Trailing Slash Bypassed AWS API Gateway Authorization
A security researcher found that adding a trailing slash to AWS HTTP API paths bypassed Lambda authorizer authentication entirely, enabling unauthenticated wire transfers at a fintech. The root cause is a path normalization mismatch between HTTP API's greedy route matching and its authorization layer. The same vulnerability class appeared in gRPC-Go via CVE-2026-33186.
-
AWS Load Balancer Controller Reaches GA with Kubernetes Gateway API Support
AWS shipped GA support for Kubernetes Gateway API in its Load Balancer Controller, dumping annotation-based configuration for type-safe CRDs with proper validation. The release handles both L4 (TCP/UDP via NLB) and L7 (HTTP/gRPC via ALB) routing through the Gateway API spec. Teams get cross-namespace routing, automatic certificate discovery, and role separation without cluster-admin permissions.
-
Cloudflare Demonstrates Moltworker, Bringing Self-Hosted AI Agents to the Edge
Cloudflare has introduced Moltworker, an open-source solution for running Moltbot—a self-hosted personal AI agent—on its Developer Platform, eliminating the need for local hardware, such as Mac minis. Rebranded from Clawdbot, Moltbot serves as a personal assistant in chat applications, integrating with AI models, browsers, and third-party tools while maintaining user control.
-
Azure API Management Premium v2 GA: Simplified Private Networking and VNet Injection
Microsoft has launched API Management Premium v2, redefining security and ease-of-use in cloud API gateways. This new architecture enhances private networking by eliminating management traffic from customer VNets. With features like Inbound Private Link, availability zone support, and custom CA certificates, users gain unmatched networking flexibility, resilience, and significant cost savings.
-
KubeCon NA 2025 - Erica Hughberg and Alexa Griffith on Tools for the Age of GenAI
Generative AI technologies need to support new workloads, traffic patterns, and infrastructure demands and require a new set of tools for the age of GenAI. Erica Hughberg from Tetrate and Alexa Griffith from Bloomberg spoke last week at KubeCon + CloudNativeCon North America 2025 Conference about what it takes to build GenAI platforms capable of serving model inference at scale.
-
Azure APIM Simplifies Event-Driven Architecture with Native Service Bus Policy
Microsoft's new feature in API Management (APIM) enables seamless messaging to Azure Service Bus, simplifying API connections in event-driven architectures. By using the send-service-bus-message policy, developers can easily route HTTP requests to Service Bus for asynchronous processing, enhancing integration, security, and control without additional components.
-
From Outages to Order: Netflix’s Approach to Database Resilience with WAL
Netflix uses a Write-Ahead Log (WAL) system to improve data platform resilience, addressing data loss, replication entropy, multi-partition failures, and corruption. WAL decouples producers and consumers, leverages SQS/Kafka with dead-letter queues, and supports delay queues, cross-region replication, and multi-table mutations for high-throughput, consistent, and recoverable database operations.
-
Google Apigee Adds Built-in LLM Governance with Model Armor
Google Cloud has launched the public preview of Model Armor, a native LLM governance framework integrated into the Apigee API management platform. Detailed in a community post, Model Armor introduces out-of-the-box enforcement for LLM-specific policies such as prompt validation, output filtering, and token-level controls at the API layer.
-
Amazon API Gateway Adds Dynamic Routing Based on Headers and Paths
AWS's new dynamic routing rules for Amazon API Gateway empower developers to streamline API traffic management by routing requests based on HTTP headers without complex URL structures. This innovative feature simplifies API versioning, enables fine-grained control, enhances A/B testing, and improves request visibility, making API configurations more efficient and user-friendly.
-
How Locking, Saturation and CDN Network Issues Brought down Canva
The Canva engineering team recently published their post-mortem on the outage they experienced last November, detailing the API Gateway failure and the lessons learned during the incident.