# Flexway on one page

> Product guide: what the capability brings, for whom, its limits and the version that delivered it - no configuration syntax. Developer side: Calling an API…

Concept - Since version 0.1.0 - Flexway v1.6.3 - https://flexway.io/en/docs/product-overview/

> Product guide: what the capability brings, for whom, its limits and the version that delivered it - no configuration syntax.
>
> Developer side: [Calling an API behind Flexway](https://flexway.io/en/docs/developer-overview/); operations side: [Configuring and operating Flexway](https://flexway.io/en/docs/operations-overview/).

Flexway is **one** gateway for an organisation's APIs, AI models and agents. A request is
authenticated, counted, budgeted, guarded, traced and audited **once**, whatever door it comes in
through: REST, gRPC, a stream, an agent tool, a message broker.

```mermaid
%%{init: {'theme':'base','themeVariables':{'fontSize':'14px','lineColor':'#94a3b8'}}}%%
graph LR
  C["Applications, partners,<br/>browsers, AI agents"]:::ext
  subgraph FW["Flexway - one decision"]
    D["Identity, quotas, policies,<br/>trace, audit, tenant"]:::hub
  end
  A["REST and gRPC APIs"]:::spoke
  M["AI models"]:::spoke
  G["Agents and MCP servers"]:::spoke
  K["Brokers: Kafka, AMQP,<br/>MQTT, NATS"]:::data
  O["Console and<br/>Git repository"]:::private

  C -->|"HTTP, gRPC, MCP, A2A, Kafka"| D
  D --> A
  D --> M
  D --> G
  D --> K
  O -.->|"observes, proposes"| D

  classDef hub     fill:#4f46e5,stroke:#3730a3,color:#fff,font-weight:bold
  classDef spoke   fill:#0891b2,stroke:#155e75,color:#fff,font-weight:bold
  classDef data    fill:#3b82f6,stroke:#1d4ed8,color:#fff,font-weight:bold
  classDef private fill:#10b981,stroke:#047857,color:#fff,font-weight:bold
  classDef ext     fill:#64748b,stroke:#334155,color:#fff,font-weight:bold
```

| Question | Short answer |
| --- | --- |
| **For whom** | A team that exposes APIs to customers, partners or agents, and wants one security, quota and cost policy for all that traffic |
| **What sets it apart** | The **contract is the configuration**: what is declared in OpenAPI, AsyncAPI or Protobuf is served, nothing else. AI and agents live in the same plane as the APIs, not in a second product |
| **What it does not do** | Issue tokens (your identity provider stays yours), terminate public TLS or filter like a WAF (the edge's job), let a model decide an authorization or a route |
| **How it installs** | One binary, one signed image, one configuration file; Kubernetes with a Helm chart, `docker run` for a trial |
| **Compatibility promise** | Since `1.0.0`, what an operator wrote reads unchanged across every `1.x` ([roadmap](https://github.com/flexwiz/flexway/blob/main/docs/ROADMAP.md)) |

## What Flexway does not do, and why

Chosen, not forgotten: each of these roles belongs to another component, or contradicts what makes
Flexway safe.

| What Flexway does not do | Why |
| --- | --- |
| Service mesh | Encryption and routing between services stay with the mesh in place; Flexway fits into it |
| Load balancing between replicas | The job of the edge and the mesh, which see the instances; Flexway picks the version of a service, not the machine |
| Composed GraphQL gateway, free aggregation | A free query has no rights, quota or trace known in advance; only queries declared in advance are considered |
| Connectors tied to one cloud provider | Contrary to sovereignty; an HTTP or gRPC call covers the need |
| Bot detection, web application firewall | They need network signals only the edge has; Flexway already refuses whatever is not declared |
| API testing client | Another product; offline validation, the examples and the console cover verification |
| Plugin ecosystem | An attack surface and a compatibility debt; only isolated, capped extensions are planned |
| Agent runtime, RAG platform, response evaluation, prompt registry | Their own tools carry them; Flexway governs tool and API calls, and enforces the list of approved models decided elsewhere |
| Approval workflow | It stays with you; Flexway will verify the approval proof issued by your identity provider (`1.10.0`, not built yet) |
| Shop-floor gateway, site broker | Modbus, OPC UA client-server and buffering a site's messages stay with those components; Flexway governs what arrives over MQTT |

## Reading this guide

Each capability fits in one table: what it does, why it matters, use cases, its limits, the version
that brought it, and where to configure it. **Versions** are milestones of the
roadmap; a release ships every milestone merged before it.

| Status used here | What it means |
| --- | --- |
| **Released** (`x.y.0`) | In a published release, under the compatibility promise |
| **Not built yet** | Decided or scoped, nothing delivered - listed in [What is not built yet](https://flexway.io/en/docs/product-not-built-yet/) |

> The source of truth for statuses stays the feature catalogue:
> where this guide and the catalogue differ, the catalogue is right.