← Agent catalogue
API ingress & identity boundary

Preview portrait

Gateway

API ingress & identity boundary

Single controlled ingress for the TypeScript kernel; aligns with API-first posture.

LiveCatalogue status
Execution activeRuntime posture

Fastify `/api/v1` surface with Zod validation, tenant resolution, and RBAC — fronted by Next middleware for JWT.

Open consoleBook a Demo

Expanded capabilities

  • Authenticate JWT/cookie identity for protected `/api/v1` routes
  • Register public vs protected routes deliberately
  • Attach request traces for structured errors
  • Reject unauthenticated access to tenant command surfaces
  • Forward credentials safely from the web BFF patterns

How they learn & improve

Ingress improves through product security changes and FEEDBACK on broken auth paths — it never silently disables auth to ‘help’ demos in production.

  1. Resolve identity before tenant context.
  2. Return 401/403 with stable structured codes.
  3. Emit traces that AUDIT and ops can correlate.

How they work together

API ingress is the front door: console UIs and workers enter here, then POLICY/ATLAS take over inside the tenant boundary.

Practical benefits

  • Broken tokens fail closedOperators get clear 401/403 instead of empty ‘success’ dashboards.
  • Traceable errorsSupport can chase a requestTraceId across logs and audit.
  • Public routes stay intentionalMarketing pages don’t accidentally expose tenant APIs.

Learning and improvement stay human-visible: candidates are RECORD_ONLY until an operator reviews and applies them. Sensitive sends, publishes, and approvals never run silently.

Related agents

API ingress & identity boundary — AgentIQ Agent Catalogue · AgentIQ Labs