Overview

High-level architecture and responsibilities of the API Gateway.

Introduction

The arya-banking-api-gateway is the single entry point for all external and internal HTTP traffic in the Arya Banking platform. Built on Spring Cloud Gateway, it operates as a reactive proxy that handles request routing, load balancing, and cross-cutting security concerns.

Core Responsibilities

The gateway performs four critical functions:

Function	Mechanism
Request Routing	Path-predicate-based routing to downstream microservices via Config Server + Eureka `lb://`
JWT Authentication	Resource server validation for tokens issued by Keycloak.
Access Control	Route-level authorization (public vs. authenticated vs. internal).
API Docs Aggregation	Swagger UI at `/swagger-ui.html` proxies `/admin-service/v3/api-docs`, `/auth-service/v3/api-docs`, `/user-service/v3/api-docs` via `lb://` routes.

Swagger UI

The gateway aggregates OpenAPI docs from all downstream services. Access the unified Swagger UI at:

Text code-highlight

http://localhost:8085/swagger-ui.html

The gateway proxies API doc requests to each service via Eureka service discovery (lb://):

Yaml code-highlight

# Routes defined in arya-banking-configs/application.yml
- id: admin-service-api-docs
  uri: lb://arya-banking-admin-service
  predicates:
    - Path=/admin-service/v3/api-docs
  filters:
    - RewritePath=/admin-service/v3/api-docs, /v3/api-docs

Each service exposes its own Swagger UI directly as well — see the individual service API reference pages.

Dockerized Deployment

The API Gateway is deployed as a Docker container as part of the platform stack. It is defined in compose/platform.yml alongside the Service Registry and Config Server.

Image: karthikulkarni/arya-banking-api-gateway:latest
Container Name: api-gateway
Host Port: 8085 → Container 8085
Network: arya-banking-net

See the [Infrastructure → Docker Compose](/docs/infra/docker-compose/) page for the full platform stack definition.

Reactive Architecture

Unlike traditional servlet-based Spring Boot applications, the API Gateway is built on Spring WebFlux.

Because the gateway is reactive, all security configurations must use `ServerHttpSecurity` instead of the standard `HttpSecurity` used in other microservices.

Dual OAuth2 Role

The gateway is uniquely configured to act in two capacities simultaneously:

OAuth2 Client: Initiates the Authorization Code flow (using Keycloak) for browser-based login redirects.
OAuth2 Resource Server: Validates the Bearer JWT on every incoming API request using RS256 asymmetric keys.

Request Flow

Getting Started

Architecture