# Glossary > Flexway's terms - contract, operation, upstream, tenant, policy, quota, virtual cluster, MCP surface... - each with the page that explains it. Reference - Since version 0.1.0 - Flexway v1.7.1 - https://flexway.io/en/docs/reference-glossary/ Flexway's terms, in alphabetical order, each with the page that explains it. Configuration keys and extension names are written as they are typed. ### Admin port The separate listener (`:9090` by default) of the probes, `/config`, the simulation, the journals and the metrics; never routable from outside. -> [Admin API](https://flexway.io/en/docs/reference-admin-api/) ### API key A secret given to a caller without a token, bound to a tenant and to named operations; the gateway keeps only its SHA-256 digest. -> [API keys](https://flexway.io/en/docs/operations-api-keys/) ### Asynchronous plane Publishing and consuming messages on a broker (Kafka, AMQP, MQTT, NATS) under an AsyncAPI contract, with the same identity and tenant as HTTP. -> [Publishing and consuming on a broker](https://flexway.io/en/docs/operations-async/) ### Bucket A caller's token bucket in a `rate-limit` policy: it fills at a rate and loses one token per request; empty, `429 rate_limited`. -> [Setting quotas](https://flexway.io/en/docs/operations-quotas/) ### Catalogue The list of served operations, with their upstream, security, owner and withdrawal date, published by `/config` and shown by the console. -> [Reading with the console](https://flexway.io/en/docs/operations-console/) ### Circuit breaker The per-upstream state that stops calling a failing upstream for a while, then tests it again (`upstreams..circuit_breaker`). -> [Setting quotas](https://flexway.io/en/docs/operations-quotas/) ### Closed by default What is not declared does not pass: operation, header, parameter, origin. The whitelist is the normal mode. -> [Security posture](https://flexway.io/en/docs/product-security/) ### Configuration digest `config_digest`: the semantic digest of the configuration served, printed by `flexway validate` and published by `/config`, which tells whether two replicas serve the same thing. -> [Changing the configuration without a restart](https://flexway.io/en/docs/operations-live-config/) ### Contract The document that describes an API - OpenAPI 3.1, AsyncAPI 3, gRPC service or A2A agent card. **The contract is the configuration**: the gateway serves exactly the operations it declares, and nothing else. -> [API gateway](https://flexway.io/en/docs/product-api-gateway/) ### Effective configuration What a replica serves at this moment: every key of `flexway.yaml` as loaded, secrets masked, plus the catalogue and the chains, read on `GET /config`. -> [Admin API](https://flexway.io/en/docs/reference-admin-api/) ### Enforced policy A policy a fragment places at the head of every chain of the gateway that imports it (HTTP listener): no local line removes, replaces or undoes it (since `1.7.0`). -> [Shared policy fragments](https://flexway.io/en/docs/operations-policy-fragments/) ### Extension An `x-flexway-*` key written in the contract for what belongs to an operation (upstream, timeout, cache, MCP tool...). The list is closed: an unknown extension is refused at load. -> [Configuration reference](https://flexway.io/en/docs/operations-configuration-reference/) ### Host A host name served with its own contracts and default upstream (`hosts`), to serve several APIs from one gateway. -> [Changing the configuration without a restart](https://flexway.io/en/docs/operations-live-config/) ### Issuer An OIDC identity provider declared under `auth.issuers`, whose tokens the gateway verifies. -> [Wiring your identity provider](https://flexway.io/en/docs/operations-identity/) ### MCP federation Existing MCP servers placed behind the gateway's MCP surface, their tools offered under their names, under the same decision as the contract's tools. -> [Agents and MCP](https://flexway.io/en/docs/operations-agents-mcp/) ### MCP surface The gateway's Model Context Protocol entry point: the operations marked `x-flexway-tool` are offered there as tools to agents, under the same decision as REST. -> [Agents and MCP](https://flexway.io/en/docs/operations-agents-mcp/) ### Operation A method on a path of a contract (or a gRPC method), the unit the gateway routes, authorizes, counts and logs. -> [Serving your first API](https://flexway.io/en/docs/operations-first-api/) ### operationId The unique name of an operation in the contract. Required: quotas, keys, audit and metrics name operations by it. -> [Serving your first API](https://flexway.io/en/docs/operations-first-api/) ### Policy A named, phased and conditional (CEL) treatment - CORS, rate, quota, cache, transformation, external call... - declared under `policies` and attached by a chain. -> [Enriching a flow](https://flexway.io/en/docs/operations-policies/) ### Policy fragment A `kind: PolicyFragment` file of policy definitions written once, imported by several gateways that each pin it by its `sha256` digest; its definitions are named `/` there (since `1.7.0`). -> [Shared policy fragments](https://flexway.io/en/docs/operations-policy-fragments/) ### Policy chain The order in which policies apply to an operation: `global -> host -> routes -> operation`, the most specific wins, a removal is written `!name`. -> [Enriching a flow](https://flexway.io/en/docs/operations-policies/) ### Proposal A change of `flexway.yaml` prepared in the console, reviewed, then opened as a pull request on the repository that holds the configuration; the console never merges. -> [Proposing a change from the console](https://flexway.io/en/docs/operations-proposals/) ### Quota A ceiling of requests per tenant per day or month (a `quota` policy), counted in the shared cache; past it, `429 quota_exceeded`. -> [Setting quotas](https://flexway.io/en/docs/operations-quotas/) ### Rate class The group of operations that shares a caller's bucket in a `rate-limit` policy (`read`, `write` or a declared class); an operation changes class with `x-flexway-rate-class`. -> [Setting quotas](https://flexway.io/en/docs/operations-quotas/) ### Reload Reading the configuration and the contracts again without a restart; a refused configuration never replaces the one serving. -> [Changing the configuration without a restart](https://flexway.io/en/docs/operations-live-config/) ### Replica One instance of the gateway's process. Each replica has its own memory (cache, journals); only the counters are shared, through the shared cache. -> [Choosing a deployment](https://flexway.io/en/docs/operations-deployment/) ### Shared cache The Redis-compatible shared cache - Redis, Dragonfly or Valkey (`server.counters`) - where the replicas reconcile buckets and quotas, off the request path; optional, but required by tenant quotas. Its counters are disposable: lost, the gateway goes on with local counters. -> [Setting quotas](https://flexway.io/en/docs/operations-quotas/) ### Shedding The immediate refusal (`503 overloaded`) of lower-priority requests when the gateway saturates (`server.shedding`, `x-flexway-priority`). -> [Setting quotas](https://flexway.io/en/docs/operations-quotas/) ### SLO An availability or latency objective, on an operation or a group of operations, followed by the console with its error budget. -> [SLO objectives on groups of operations](https://flexway.io/en/docs/operations-slo-groups/) ### Tenant The isolated customer a request belongs to, read from a signed claim, an API key or a certificate - never from a value the caller writes. -> [Multi-tenant isolation](https://flexway.io/en/docs/product-multi-tenant/) ### Timeout budget The three timeouts of an exchange - `connect`, `read` (the silence tolerated, which alone bounds a stream) and `total` (retries included) -, from the most general (`server.timeouts`) to the most specific (`x-flexway-timeout` on the operation). -> [Serving your first API](https://flexway.io/en/docs/operations-first-api/) ### Token exchange Obtaining, from the caller's identity provider, a token issued for one specific upstream (RFC 8693): the upstream never receives the original token. -> [Agents and MCP](https://flexway.io/en/docs/operations-agents-mcp/) ### Upstream The service the gateway relays an operation to, declared under `upstreams` in `flexway.yaml` and named by the operation (`x-flexway-upstream`) or by default (`default`). An operation without an upstream makes the start fail. -> [Serving your first API](https://flexway.io/en/docs/operations-first-api/) ### Virtual cluster The Kafka cluster a native client sees through the gateway: declared in the AsyncAPI contract, each tenant reads and writes there under its own names. -> [Native Kafka clients](https://flexway.io/en/docs/operations-kafka-clients/)