Build OCI API Gateway deployment configurations with routes, auth, and rate limiting.
Last verified: May 2026
Build API Gateway deployment configurations with routes, authentication, rate limiting, and CORS.
Required Fields
compartmentIddisplayNamepathPrefixspecification.routesOutput will appear here...OCI API Gateway is a managed service for creating, publishing, and securing REST APIs that front-end your backend services, functions, and HTTP endpoints. Configuration involves defining deployments with route collections, authentication policies (JWT, custom authorizers), rate limiting, CORS settings, request/response transformations, and logging. This builder helps you assemble API Gateway deployment specifications with correct route paths, method mappings, backend types, and policy configurations. It generates JSON deployment specs compatible with the OCI CLI, Terraform, and the API Gateway REST API.
Your team is building a B2B API to be consumed by 50 partner companies. Each partner needs JWT auth, per-partner rate limiting (100 req/s normal, 500 req/s premium tier), and request logging for billing. The builder generates a single deployment with: JWT validation against your IdP, rate-limit-by-key policy keyed on JWT 'sub' claim with overrides per premium-tier partner, execution logging to OCI Logging, and 5 routes mapped to OCI Functions backends. Total config time: 1 hour vs 4-6 hours hand-crafting the YAML and discovering schema errors at deploy time.
Custom authorizer functions add ~30-50ms of latency per request because the Gateway invokes a separate function before forwarding. For most JWT validation, prefer native JWT policy over a custom authorizer — it's faster, simpler, and well-tested. Reserve custom authorizers for genuinely complex auth (multi-IdP federation, fine-grained authorization rules).
Rate limit values are PER deployment, not per backend. If you've split your API across 3 deployments (e.g., for separate compartment ownership), you need to add up rate limits across them carefully — a 100 req/s limit on each = 300 req/s total at the backend.
Always enable execution logging on production deployments and route to OCI Logging. The default is logs OFF — meaning when something goes wrong, you have no record of what request hit which backend. The cost of execution logging is negligible compared to the cost of debugging blind.
The builder constructs API Gateway deployment specs with route collections (path + methods + backend types: HTTP_BACKEND, ORACLE_FUNCTIONS_BACKEND, STOCK_RESPONSE_BACKEND), request policies (authentication via JWT or function, rate limiting, CORS, mutual TLS), logging policies, and request/response transformations. Output is a deployment spec JSON ready for `oci api-gateway deployment create` and Terraform oci_apigateway_deployment resources.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.