PingAuthorize

API gateway request and response flow

Using the application programming interface (API) gateway pattern, PingAuthorize processes JavaScript Object Notation (JSON) requests and responses in two distinct phases according to a defined sequence.

The gateway handles proxied requests in the following phases:

  • Inbound phase – When a client submits an API request to PingAuthorize Server, the gateway forms a policy request based on the API request and submits it to the policy decision point (PDP) for evaluation. If the policy result allows it, PingAuthorize Server forwards the inbound request to the API server.

  • Outbound phase – After PingAuthorize Server receives the upstream API server’s response, the gateway again forms a policy request, this time based on the API server response, and submits it to the PDP. If the policy result is positive, PingAuthorize Server forwards the outbound response to the client.

    Sequence diagram of the PingAuthorize API security gateway inbound and outbound data flow involving the client, PingAuthorize, the PDP, and the REST API

The API gateway supports only JSON requests and responses.