The gateway handles proxied requests in the following phases:

  • Inbound phase – When a client submits an API request to PingAuthorize Server, the gateway forms a policy request based on the API request and submits it to the policy decision point (PDP) for evaluation. If the policy result allows it, PingAuthorize Server forwards the inboundinbound A direction of message flow coming into a service. The type of message depends service's identity access management role. request to the API server.
  • Outbound phase – After PingAuthorize Server receives the upstream API server's response, the gateway again forms a policy request, this time based on the API server response, and submits it to the PDP. If the policy result is positive, PingAuthorize Server forwards the outboundoutbound The direction of transaction flow from a service or server. response to the client.
Produced by OmniGraffle 7.18.5\n2021-09-07 19:39:56 +0000 Canvas 1 Layer 1 Request_and_response_flow Request_and_response_flow_Services Graphic_101 Line_25 Graphic_14 Text REST API Graphic_11 Text REST API Line_24 Graphic_15 Text PDP Graphic_13 Text PDP Line_23 Graphic_16 Text PingAuthorize Graphic_12 Text PingAuthorize Line_113 Graphic_114 Text Client Graphic_112 Text Client Request_and_response_flow_Actions Graphic_65 Text Client receives filtered REST API response Graphic_125 Text REST API handles request Graphic_58 Text PingAuthorize forwards API request to REST API Graphic_107 Text Inbound phase: PingAuthorize filters API request Graphic_47 Text PingAuthorize validates access token Graphic_36 Text Client makes REST API request Graphic_126 Text Outbound phase: PingAuthorize filters API response Request_and_response_flow_Messages Line_67 Graphic_68 Text request Line_75 Graphic_76 Text API request and response Line_83 Graphic_84 Text response Line_85 Graphic_86 Text token validation Line_87 Graphic_88 Text submit API request for policy processing Graphic_124 Text apply policy result to API request Line_123 Line_127 Graphic_128 Text submit API response for policy processing Graphic_129 Text apply policy result to API response Line_130

The API gateway supports only JSONJSON (JavaScript Object Notation) An open, lightweight data-interchange format that uses human-readable text to store and transmit data. requests and responses.