---
title: API routing
description: API Security Enforcer (ASE) uses a combination of header hostname and URL suffix to route incoming API requests to the correct backend server.
component: pingintelligence
version: 5.1
page_id: pingintelligence:api_security_enforcer:pingintelligence_api_routing
canonical_url: https://docs.pingidentity.com/pingintelligence/5.1/api_security_enforcer/pingintelligence_api_routing.html
revdate: April 3, 2024
section_ids:
  multiple-host-names-with-same-api-name: Multiple host names with same API name
  single-host-name-with-different-api-names: Single host name with different API names
  wildcard-host-name-and-api-name: Wildcard host name and API name
---

# API routing

API Security Enforcer (ASE) uses a combination of header hostname and URL suffix to route incoming API requests to the correct backend server.

The following sections show scenarios for routing based on server and application programming interface (API) *(tooltip: \<div class="paragraph">
\<p>A specification of interactions available for building software to access an application or service.\</p>
\</div>)* name:

## Multiple host names with same API name

ASE supports configuring more than one hostname on one ASE node or cluster. It routes the incoming traffic based on the host name and the API configured in the JavaScript Object Notation (JSON) *(tooltip: \<div class="paragraph">
\<p>An open, lightweight data-interchange format that uses human-readable text to store and transmit data.\</p>
\</div>)* file. For example, traffic to two hosts named shopping.xyz.com and trading.xyz.com is routed based on the configurations in the respective API JSON file.

![Diagram of API traffic through ASE](../../5.2/_images/zty1564009023892.png)

For incoming API requests, ASE first checks for the host name in the JSON file. If the host name is configured, then it checks for the API name. If both host and API name are defined, then the incoming API request is routed to one of the configured servers.

In the above example, ASE checks whether shopping.xyz.com is configured in the JSON file (`shopping.json`). It then checks for the API, `/index`. If it finds both to be present, then it routes the traffic to one of the defined backend servers. The following is a snippet from a sample JSON file which shows the values that should be configured for `shopping.json`:

```
"api_metadata": {
 "protocol": "https",
 "url": "/index,
 "hostname": "shopping.xyz.com",
 "cookie": "JSESSIONID",
 "cookie_idle_timeout": "200m",
 "logout_api_enabled": true,
 "cookie_persistence_enabled": false,
```

For each API, configure a separate JSON file.

## Single host name with different API names

ASE supports configuring the same hostname with different API names. For example, hostname shopping.xyz.com has two different APIs, `/index` and `/auth`. Traffic to each API is routed using the API specific JSON file: `shopping-index.json` or `shopping-auth.json`.

In the following illustration, any requests for shopping.xyz.com/index are routed by ASE to a server configured in `shopping-index.json`. In this case, shopping-index.json file parameters must match for both the hostname and API. Similarly, requests to shopping.xyz.com/auth, are routed by ASE to a server configured in `shopping-auth.json`.

![Diagram of API traffic through ASE](../../5.2/_images/zpl1564009024794.png)

## Wildcard host name and API name

ASE can also be used as a simple load balancer to route traffic for legacy web applications. The load balancing technique used for server load balancing is based on protocol and cookie information. To configure ASE as a simple load balancer, set the following parameters in a JSON file:

```
"hostname": "*",
"url": "/",
```

When hostname `"*" `and `url` `"/"` are configured in a JSON file, any request that does not match a specific hostname and `url` defined in another JSON file uses the destination servers specified in this file to route the traffic.

![Diagram of API traffic through ASE](../../5.2/_images/obw1564009025720.png)

In the above illustration, hostname is configured as `"*"` and `url` as `"/"`. ASE does not differentiate between hostname and API name. It simply balances traffic across all backend servers.

For all scenarios, when connections are being routed to a backend server which goes down, ASE dynamically redirects the connections to a live server in the pool.