Which integration targets can a route point at?

Four: a DataDack serverless function, an HTTP upstream, a DataDack load balancer, or a mock that answers at the edge with no backend. For HTTP and load-balancer targets the gateway uses the scheme and host of the configured URI. A mock currently returns 200 with an empty body.

How does the gateway decide which route serves a request?

By specificity, not by declaration order. Each segment scores - a literal 100, a path parameter 10, a greedy {proxy+} 1 - and the highest total wins, so /orders/new always beats /orders/{id}. If two routes tie, one declared for the request's method beats one declared ANY. A greedy parameter is only legal as the last segment, and a route whose template does not parse is dropped when configuration loads rather than failing a live request.

The edge reads the first path segment; when it names one of that API's stages it serves that stage and strips the segment, so GET /prod/orders/42 resolves to the prod stage and the route GET /orders/{id}. A stage pinned to a deployment serves that stored snapshot, which makes promoting a release a pointer move rather than a re-upload. Canary and weighted stages are not available yet - deployments are promoted whole.

What authentication does it support?

A route declares one of four modes. NONE is public. JWT validates a bearer token against your issuer using RS256, RS384 or RS512, discovering the issuer and fetching its JWKS so key rotation needs no redeploy. AWS_IAM verifies a SigV4 signature. CUSTOM hands the decision to a function of yours, as either a REQUEST authorizer that sees the whole request or a TOKEN authorizer that sees the header; custom-authorizer results are not cached yet. Separately, API keys arrive as X-Api-Key and are checked against the usage plans that carry them.

How is rate limiting applied?

Two throttles run. The route throttle is keyed on API, stage and route, with the stage setting a default that any route may override - that one protects your backend from all callers. The usage-plan throttle and quota are counted per API key against the plan's window, which may be a UTC day, a week starting Monday, or a calendar month - that one holds a single caller to what they bought. A refused request returns 429 with a Retry-After header.

How large a request can it accept?

The edge refuses a request body over 8 MB and total request headers over 1 MB. Where a route invokes a function, the body handed to that invocation is capped at 6 MB and the response it returns at 8 MB.

Where does the traffic actually run?

The data plane runs in the Noida (ap-south-3) region, in Yotta NM1 & CtrlS, Noida Tier-IV. A request is terminated, authorized, throttled and filtered inside India rather than being sent abroad for inspection, which is the point of running it here. API Gateway is listed as its own component on the public status page.

API Gateway is in Public Beta and has no published rate card yet. Create an account - new accounts get ₹1,000 in free credit on signup - and the console shows what is billable. Pricing on this site is always the console's, never a figure typed onto a page, so this question gets a real answer here the moment the rate card lands.

Can I attach my own domain?

The control plane manages domain names, API mappings and a certificate reference, so the configuration is in place. Serving a custom hostname from the edge is still being finished - run against the region hostname for now and use the status page and changelog to follow it.

Sovereign Edge · Public Beta

One front door for every API you run in India.

Define an HTTP API once - routes, integrations, authorizers, stages - and DataDack API Gateway terminates, authorizes, throttles and filters every request before it reaches your code. The control plane speaks the AWS API Gateway v2 shape, so an existing OpenAPI document imports as-is. The data plane runs in Noida (ap-south-3), so the request never leaves the country to be inspected.

New accounts get ₹1,000 in free credit on signup.

Open the console See how routes resolve What is live today

Fibre paths lit across a network fabric — THE API YOU DECLAREAP-SOUTH-3

Stage: prodRoutes · 5

GET/ordersfunctionJWT
GET/orders/{id}functionJWT
POST/ordersfunctionJWT
GET/statusmocknone
ANY/legacy/{proxy+}httpSigV4

Import it as OpenAPI, or build it route by route.

Integration targets4Function, HTTP, LB, mock

Authorizer modes4None, JWT, SigV4, custom

Max request body8 MBEnforced at the edge

Quota windows3Day, week, month

Public BetaZONE: ap-south-3NOIDA TIER-IVAWS APIGW V2 COMPATIBLEEDGE WAF ENFORCEDData plane in-region

Anatomy of a request

Eight things happen before your code does.

01
TLS termination
The connection is terminated at the sovereign edge, inside the region.
02
Resolve API and stage
The hostname identifies the API; the first path segment names the stage and is stripped.
03
Match the route
Every candidate is scored by specificity. The highest total wins, not the first declared.
04
Authorize
The route's authorizer runs - JWT, SigV4, a function of yours, or an API key.
05
Throttle and quota
The route throttle protects your backend; the usage plan holds one caller to its plan.
06
WAF
The API's rule set is evaluated before any backend is reached.
07
Invoke the target
A function, an HTTP upstream, a load balancer, or a mock answered at the edge.
08
CORS and log
CORS headers are applied and one row per request is shipped with the trace id.

api.ap-south-3.datadack.cloudIllustrative values

Inbound

GET/prod/orders/42

tls terminationTLS 1.3 · in-region

resolve api and stagestage = prod

match the routeGET /orders/{id} · 110

authorizeJWT RS256 · allow

throttle and quotawithin rate and quota

wafno rule matched

invoke the targetfunction · orders-api

cors and log200 · logged

200 OK

Request never left India

Trace id7f3c1a9e-4b22-4d81-9c0a-6e5f2b8d1a47

Request routing

Path templates that resolve deterministically.

A route is a method and a path template. The router scores every candidate by specificity rather than taking the first that matches, so adding a broad proxy route can never shadow an exact one you already shipped.

Try it

Pick a request, watch it resolve

These five routes belong to one API. Choose an incoming path and every candidate is scored by the same rule the gateway uses.

Incoming request

ANY/{proxy+}

{proxy+}+1

GET/orders

Request has more segments

—

GET/orders/{id}

orders+100{id}+10

110Wins

GET/orders/new

"42" is not "new"

—

GET/orders/{id}/items/{itemId}

Request has fewer segments

—

Serves this requestGET /orders/{id}→functionid=42

Literal · 100{param} · 10{proxy+} · 1On a tie, a route declared for the method beats one declared ANY.

Segment types and the weight each scores

Segment types and the weight each scores
Template	Matches	Weight	Notes
/orders	/orders	100	A literal segment. Always beats a parameter at the same position.
/orders/{id}	/orders/42	10	A path parameter. Matches exactly one segment, never zero and never two.
/files/{path+}	/files/a/b/c.pdf	1	Greedy. Legal only as the final segment, and the weakest match there is.

How a winner is chosen

01Score every segment: literal 100, parameter 10, greedy 1.
02The highest total wins, so /orders/new beats /orders/{id}.
03On a tie, a route declared for the method beats one declared ANY.
04A route whose template will not parse is dropped at load, not served as a 500.

Stages live in the path

The edge reads the first path segment and, when it names one of that API's stages, serves that stage and strips the segment. A stage pinned to a deployment serves that stored snapshot, so promoting is a pointer move rather than a re-upload.

GET /prod/orders/42
stage  → prod
route  → GET /orders/{id}
id     → 42

Integrations

Four things a route can point at.

The integration is the second half of a route. Every kind below is projected to the edge and served today.

LAMBDA

Serverless function

Invoke a DataDack function. The gateway is the same front door the FaaS fleet already sits behind, so there is no second hop to configure.

Request body capped at 6 MB, response at 8 MB.

HTTP

HTTP upstream

Proxy to any reachable HTTP origin - a VM, a managed app, a service outside DataDack.

The scheme and host are used; the stored URI path is not.

LOAD_BALANCER

Load balancer

Point a route at a DataDack load balancer and let it fan out across the pool behind it.

Pairs with the L4/L7 balancer and its health checks.

MOCK

Mock

Answer at the edge with no backend at all - useful to publish a contract before the service exists.

Returns 200 with an empty body; a stored mock body is not yet served.

Authorization

Decided at the edge, before your code runs.

Authorization is a property of the route, not something each backend reimplements. An unauthenticated request is refused at the gateway, so an unprotected handler behind a protected route is not a hole you can accidentally ship.

NONE

Public

No authorizer. The route is open, and says so in its own configuration rather than by omission.

Still subject to throttles and the WAF.

JWT

Validate a bearer token against your issuer. The gateway discovers the issuer and fetches its JWKS, so key rotation needs no redeploy.

RS256, RS384 and RS512. Issuer URLs must be publicly resolvable.

AWS_IAM

SigV4

Verify a SigV4-signed request. Clients and SDKs that already sign for AWS work unchanged.

Verified by the control plane, enforced at the edge.

CUSTOM

Custom authorizer

Hand the decision to a function of your own - REQUEST authorizers see the whole request, TOKEN authorizers see the header.

Returns a policy the gateway evaluates. Results are not cached yet.

API keys and usage plans

A key arrives as X-Api-Key and is resolved to the usage plans that carry it. A plan sets both a throttle and a quota, so a partner's monthly allowance and their burst ceiling are one object rather than two systems.

Header: X-Api-Key
Plan carries: Rate, burst and quota
Quota windows: UTC day · week from Monday · calendar month
Attached to: Any number of APIs and stages

Traffic control

Throttles, quotas and a WAF in front.

Two throttles run on every request, and they answer different questions. The route throttle protects your backend from everyone; the usage-plan throttle holds one caller to what they bought.

Route throttleburst 12 · refill 4/s

Tokens

Arrivals

Illustrative rates. Keyed on API, stage and route.429s 0

Usage planburst 12 · refill 4/s

Tokens

Arrivals

Illustrative rates. Counted per API key, against the plan.429s 0

route

Per-route throttle

Keyed on API, stage and route. A stage sets the default and any route overrides it, so a single expensive endpoint can be held down without capping the rest of the API.

A refusal returns 429 with Retry-After.

plan

Per-plan throttle and quota

Counted per key in Postgres against the plan's window. Rate and burst cap the moment; the quota caps the period.

Day, week and month windows.

waf

Edge WAF

A rule set attached to the API, evaluated before the target is reached. Set it per API and read the decisions back in the request log.

Runs ahead of every integration.

cors

CORS

Configured on the API, not hand-rolled per handler. Preflights are answered from that configuration at the edge and the headers are applied to real responses too.

One definition, every route.

Request body8 MBRefused above this at the edge

Request headers1 MBTotal header bytes

Function request6 MBBody handed to an invocation

Function response8 MBReturned from an invocation

Enforced by the gateway. A request over a limit is refused before it costs you anything downstream.

Observability

Every request keeps one trace id.

The edge mints a trace id on arrival and every hop forwards it. A request that crossed the gateway, an authorizer and a function is one trace, not three logs you correlate by timestamp.

One id, end to end

X-Trace-Id is minted at the entry point and carried through every internal call, with each hop adding its own span id.

Structured request log

A row per request - method, path, status, target, cache state, byte counts, timings and client IP - shipped to the log service over gRPC. Only that service holds the store's credentials.

Gateway metrics

Request counts, request duration, upstream latency, shed load and filter decisions are exported for scraping.

OpenTelemetry

Transports are instrumented through the platform's APM layer, so spans land in the same place as the rest of your estate.

API Gateway is its own component on the public status page for ap-south-3.

Open the status page

Compatibility

Shaped like the API your tooling expects.

The control plane follows the AWS API Gateway v2 resource model and verbs. If you already describe your API as OpenAPI, import it; if you need to leave, export it.

Resources the control plane manages

APIs
Routes
Integrations
Stages
Deployments
Authorizers
Models
Domain names
API mappings
API keys
Usage plans
Tags

OpenAPI in, OpenAPI out

Import an OpenAPI document to create an API and its routes, and export the live configuration back out. The export is the current state, not the document you first uploaded.

Live today, and what is not

Live today, and what is not
Capability	State	Detail
Path routing, stages, deployments	Live	Served from the stored snapshot
JWT, SigV4, custom and API-key auth	Live	Enforced before the target runs
Route and usage-plan throttling	Live	429 with Retry-After
WAF and CORS	Live	Per API, at the edge
OpenAPI import and export	Live	Round-trips the live configuration
Per-integration timeouts	Planned	Accepted and stored; not yet read by the edge
Request and response mapping	Planned	Parameter mapping and templates are stored only
JSON Schema request validation	Planned	Models exist; validation does not run yet
Mock response bodies	Planned	Mocks answer 200 with an empty body today
VPC links	Planned	The routes exist and answer 501
Canary and weighted stages	Planned	Deployments are promoted whole

Some of these are accepted by the API but not yet enforced at the edge. They are listed as planned for exactly that reason.

Side by side

DataDack API Gateway vs AWS API Gateway.

The HTTP API shape is deliberately familiar, so the differences that matter are where the traffic runs and which parts are finished. AWS figures are published headline behaviour - check the provider before you rely on them.

DataDack API Gateway vs AWS API Gateway.
Capability	DataDack (Noida)	AWS API Gateway (HTTP API)
Where requests terminate	Noida (ap-south-3), inside IndiaDPDP-aligned jurisdiction	The AWS region you choose
Route matching	Specificity scored: literal 100, param 10, greedy 1Same intent; the weights are published here	Most-specific match wins
Integration targets	Function, HTTP upstream, load balancer, mock	Lambda, HTTP, private integration, mock
Authorization	JWT, SigV4, custom function, API keySigV4 clients work unchanged	JWT, IAM, Lambda authorizer, API key
Throttling and quotas	Per route and per usage plan	Per route or stage, and per usage plan
OpenAPI import and export	Yes	Yes
Max request body	8 MBBoth refuse above the limit at the edge	10 MB
WAF at the gateway	Included, per API	Separate service
Request and response mapping	Planned - stored, not yet enforcedSee the capability table above	Available
Private network links	Planned - the routes answer 501	Available
Pricing	Public Beta - no rate card yetThe console is the quote when it lands	Per million requests

FAQ

API Gateway questions

Answers taken from what the gateway does today, not from what is planned.

The control plane follows the AWS API Gateway v2 resource model - APIs, routes, integrations, stages, deployments, authorizers, models, domain names, API keys and usage plans - and accepts OpenAPI import and export. SigV4-signed requests validate, so AWS SDKs and signing clients work unchanged. It is a compatible shape rather than a guarantee that every v2 field is honoured: per-integration timeouts, parameter mapping, mapping templates and JSON Schema validation are accepted and stored but not yet enforced at the edge.

Discover the full power of DataDack Cloud.