API Management

1. Overview

The API Management screen manages the routes, consumers, and authentication of the APIs exposed by the platform — the admin panel for Nukk's API Gateway.

An API Gateway is the single entry point for a system's APIs: instead of each Flow or Backend App directly exposing its own endpoint, every call passes through it, which centrally applies security (authentication, API Keys), traffic control (rate limiting), timeouts, and routing to the correct destination. This avoids exposing internal infrastructure directly to the internet, standardizes authentication across different services, and allows an API's real destination to be swapped/moved without impacting whoever consumes it.

The screen has three tabs:

• Routes — maps a public URL to a Flow or Backend App.
• Consumers — credentials (API Keys) and usage limits for whoever consumes routes protected by API Key.
• Auth — the gateway's authentication settings.

2. Exposing an API

To expose a Flow or Backend App as an API, two steps are usually needed:

1. Create a Route (Routes tab) — defines the public URL, the allowed HTTP methods, and which Flow/Backend App the call should be forwarded to.
2. Create a Consumer (Consumers tab) — only needed if the route's Security Type is set to API Key. The Consumer represents whoever will consume the API and receives the key (API Key) used to authenticate calls.

If the route doesn't use API Key as its security type, the Consumer step isn't necessary.

3. Routes Tab

Lists the registered routes, filterable by Squad and Environment. The table shows: Route, URI Prefix, Target, Security Type, Last Update, Status, and Actions.

Creating a Route

The New Route form has the following fields:

Field	Description
Route Name	Identification name for the route.
Target Type	The route's destination type: Flow or Backend App.
Flow / Backend App	Selection of the specific Flow or Backend App that will receive calls, according to the chosen Target Type.
URI Prefix	Public URL prefix for the route (e.g. /api/v1/example).
HTTP Methods	HTTP methods allowed on this route (e.g. GET, POST, DELETE, PATCH, PUT, OPTIONS).
Security Type	Security type applied to the route. E.g. API Key — requires the call to provide a valid API Key from a registered Consumer.

Timeouts (advanced) — optional; if left blank, they use the gateway default (~60s). Values in milliseconds:

Field	Description
Read timeout (ms)	Maximum time waiting for the target's (Flow/Backend App) response.
Send timeout (ms)	Maximum time to send the request to the target.
Connect timeout (ms)	Maximum time to establish the connection to the target.

4. Consumers Tab

Lists the registered API consumers, filterable by Squad and Environment. The table shows: Consumer, API Key, Rate Limit by Second, Rate Limit by Minute, Last Update, Status, and Actions.

Each Consumer represents an access credential, used to authenticate calls on routes with Security Type = API Key.

Column	Description
Consumer	Consumer's name.
APIKEY	API key generated for that consumer, used in requests.
Rate Limit by Second	Requests-per-second limit allowed for that consumer.
Rate Limit by Minute	Requests-per-minute limit allowed for that consumer.
Status	Consumer status (e.g. INSTALLING during provisioning).

TODO: detail the New Consumer creation form (fields and how to configure rate limits).

5. Auth Tab

TODO: detail the authentication configuration options available on this tab.

6. FAQ

Does every route need a Consumer? No — a Consumer is only needed when the route uses Security Type = API Key. Other security types may not require this step.

Can more than one Consumer use the same route? TODO: confirm whether multiple consumers can access the same route with different limits.

What happens if timeouts aren't configured? The gateway uses the default value (~60 seconds) for read, send, and connect.