Enterprise API Gateway — Features (Full Detail)

Features

• API Consumers — environments, linked clients, sandbox, rate limits, allowed IPs
• API Keys — scopes, expiry, rotation with grace period, revoke
• Route Registry — gateway path → internal target, methods, versions, public routes
• Gateway REST Proxy — unified external entry for registered routes
• Request Logging — status, latency, IP, optional bodies
• Rate Limiting & Security — IP blocklist, failed-auth auto-block, HMAC
• Webhooks — subscriptions, retries, dead-letter queue
• OAuth2 / JWT — client credentials, token TTL
• OpenAPI metadata — title/description for docs
• Analytics & SLA — daily stats, latency percentiles, alerts
• Reports & Bulk Import — CSV tools
• Developer Portal — optional client-area key self-service
• Dashboard widget — admin home overview
• Clean uninstall — tables, options, uploads removed

How to Use

1. Enable the gateway

1. Open API Gateway → Settings.
2. Set Enable API Gateway to Yes.
3. Configure default rate limit and log retention.
4. Copy the Gateway Base URL from the dashboard.

2. Create a consumer

1. Go to API Consumers → New.
2. Enter name, environment (production / staging / development).
3. Optionally link a CRM client, set allowed IPs and rate limit.
4. Save.

3. Issue an API key

1. Go to API Keys → New.
2. Select the consumer, scopes (read / write / admin), and expiry.
3. Copy the key immediately — it is shown only once.

4. Register routes

1. Go to Routes → New.
2. Set HTTP method, gateway path, and internal target path.
3. Set required scope and version (e.g. v1).
4. Activate the route.

Default seeded routes include a public health check and example module paths. Edit or disable them as needed.

5. Call the API

GET {gateway_base_url}/v1/health

Authorization: Bearer YOUR_API_KEY
# or (depending on your setup)
X-API-Key: YOUR_API_KEY

Authenticated routes require a valid key with the matching scope. Public routes (e.g. health) may not require auth.

6. Monitor & secure

• Request Logs — inspect traffic and errors
• Security — IP blocklist, auth failure policies, HMAC
• Analytics — usage and latency / SLA
• Webhooks — outbound events
• OAuth Clients — JWT tokens (optional)
• Reports / Import — CSV tools
• Developer Portal — client self-service (optional)

API Authentication Overview

Manage keys under API Keys and OAuth under OAuth Clients. Rotate keys when needed; a grace period keeps the previous key valid briefly.

Rate limiting

Limits can be set globally (Settings), per consumer, or per key. Exceeding the limit returns HTTP 429.

Permissions

Capabilities are registered on activation. Assign them under Setup → Staff → Roles:

• Dashboard, Consumers, API Keys, Routes, Request Logs
• Webhooks, OAuth Clients, Analytics, Import, Reports
• Settings (includes Security screen)

Typical capabilities: view, create, edit, delete (feature-dependent).

Cron Jobs

Background tasks (log purge, webhooks, analytics, SLA, token cleanup) run through Perfex CRM's main cron:

* * * * * php /path/to/perfex/index.php cron/index > /dev/null 2>&1

Uninstall

From Setup → Modules, deactivate then uninstall Enterprise API Gateway. This removes:

• All module database tables (eag_*)
• All module options (including JWT secret and settings)
• Upload data under uploads/enterprise_api_gateway/

Core Perfex CRM data is not affected.