Feature catalogue
Every feature of Flexway, as the catalogue says.
Each feature of the published release, its status and version: filter by domain, status, version or word.
211 features in Flexway v1.6.3
API (32)API page
- An OpenAPI 3.1 contract loaded; what is served is derived from itDelivered · since v0.1.0
- Start refused when a declared operation has no upstreamDelivered · since v0.1.0
- x-flexway-* extensions read in the contract, never anywhere elseDelivered · since v0.1.0
- flexway.yaml: hosts, upstreams, contract references - no operationDelivered · since v0.1.0
- flexway validate offline, output usable in CIDelivered · since v0.1.0
- Live reload through an immutable snapshot, no request lostDelivered · since v0.1.0
- An invalid configuration never replaces the running oneDelivered · since v0.1.0
- Secret references resolved at run time, never a plain valueDelivered · since v0.1.0
- Several contracts and hosts, conflicts detected at load timeDelivered · since v0.1.0
- Routing tree compiled at load time, deterministic precedenceDelivered · since v0.1.0
- Relay without transformation by defaultDelivered · since v0.1.0
- Upstream connection pool, HTTP/1.1 and HTTP/2Delivered · since v0.1.0
- Streams relayed without holding: SSE and chunked bodiesDelivered · since v0.1.0
- WebSocket relayedDelivered · since v0.1.0
- mTLS to the upstream, workload identityDelivered · since v0.1.0
- RFC 9457 on every product route; stable, redirectable typeDelivered · since v0.1.0
- Closed catalogue of codes in lowercase_snake_caseDelivered · since v0.1.0
- RFC 9110 semantics: 400/422, 401/403, 404/405, 429/503, 502/504Delivered · since v0.1.0
- Normative refusal headers: WWW-Authenticate, Allow, Retry-After, RateLimit-*Delivered · since v0.1.0
- request_id and trace_id in the response; the detail stays in the logDelivered · since v0.1.0
- Translation to the OpenAI error envelope on /v1/*Delivered · since v0.1.0
- REST to gRPC translation through Protobuf descriptorsDelivered · since v0.2.0
- gRPC and gRPC-Web end to endDelivered · since v0.2.0
- Translation to google.rpc.Status on the gRPC surfaceDelivered · since v0.2.0
- Import of an existing gateway's configuration, with a coverage reportDelivered · since v1.1.0
- Translation to the JSON-RPC error (MCP) and to the CloudEvents attribute (asynchronous)Delivered · since v1.5.0
- Published JSON Schema of flexway.yaml, of the contract's x-flexway-* extensions and of the policy types, generated from the configuration model: types, allowed values, defaults, version of arrival, reloadable, French and English descriptions; flexway schemaTo be scheduled
- Common policy fragments shared across gateways and repositories (federation): one versioned file referenced by several flexway.yaml, no central plane on the pathTo be scheduled
- HTTP/3 on the caller sideTo be scheduled
- Traffic split between versions of an upstream: weighted and deterministic, targeted canary (tenants, subjects, claim, declared header), blue-green by reload, rollback - never the spread across replicas, which stays at the edgeTo be scheduled
- Edge mode: the same binary on a site, signed configuration pulled and verified by the site, local decisions without a central plane; buffering stays with the local brokerPlanned in 1.11
- GraphQL: persisted queries declared as operations, cost and complexity judged at registration, any other query refusedTo be scheduled
Security (14)Security page
- JWT validation, cached JWKS keys with rotationDelivered · since v0.1.0
- iss and aud checked; several issuers in one configurationDelivered · since v0.1.0
- Scopes and roles derived from the contract's securityDelivered · since v0.1.0
- Closed by default: undeclared header, parameter, method or origin refusedDelivered · since v0.1.0
- Response security headers and declarative CORSDelivered · since v0.1.0
- Body and parameters validated against the contract's schemaDelivered · since v0.1.0
- No upstream error relayed as isDelivered · since v0.1.0
- API keys and client mTLS as first-class identitiesDelivered · since v0.1.0
- Opaque token introspection (RFC 7662)Delivered · since v0.1.0
- Chained audit log of authorisation decisionsDelivered · since v0.1.0
- Sender-constrained tokens: mTLS (RFC 8705) or DPoP (RFC 9449)To be scheduled
- Signature of inbound webhooks verified before the upstream, scheme declared in the contract (x-flexway-webhook, a security alternative): generic HMAC (header and prefix, timestamp, identifier, signed string from a closed template, hex or base64, SHA-256 or SHA-512), Standard Webhooks, presets for Stripe, GitHub, Slack, Shopify and SendGrid (ECDSA); secret by reference and rotation with two secrets, bound to a tenant; replay refused (timestamp out of tolerance, identifier already seen, bounded memory); bounded body read first, relayed intact; 401 webhook_signature_invalidPlanned in 1.8
- IP address and CIDR range allow and deny lists: a global deny list before routing (server.ip_deny, files reread on reload), an ip-filter policy per host, route or operation after routing and before identity; client address verified (X-Forwarded-For and PROXY protocol trusted from a peer of server.trusted_proxies only), 403 address_deniedPlanned in 1.8
- Exchange between organisations: purpose of use declared per operation and read from a verified claim, field minimisation per partnerTo be scheduled
Traffic (20)Traffic page
- Rate per caller (token bucket)Delivered · since v0.1.0
- 429 with Retry-After and RateLimit headersDelivered · since v0.1.0
- Rate classes per method, per-operation overrideDelivered · since v0.1.0
- Shared counters reconciled asynchronously between replicasDelivered · since v0.1.0
- Quota per tenant per day and monthDelivered · since v0.1.0
- Token quotas and monetary inference budgetDelivered · since v0.1.0
- Adaptive load shedding under saturationDelivered · since v0.1.0
- Timeout budget per operationDelivered · since v0.1.0
- In-flight request cap per upstream (bulkhead)Delivered · since v0.1.0
- Retries limited to idempotent methodsDelivered · since v0.1.0
- Circuit breaker with half-open stateDelivered · since v0.1.0
- Degradation announced (header and trace), never silentDelivered · since v0.1.0
- Graceful shutdown: streams in flight are drainedDelivered · since v0.1.0
- Global in-flight cap: an overloaded replica sheds instead of being killedDelivered · since v0.2.0
- Plans: request quotas, token quotas and budgets in euros per day and per month whose limit depends on the caller's plan - plan read from a verified claim or from the attribute of an API key or a certificate, plans declared in flexway.yaml, an explicit default plan (never "unlimited"), no external call; adds to the tenant's quotasPlanned in 1.8
- Inference budgets per user (verified subject) and per use case, on top of the per-tenant budget; use case declared in the contract (x-flexway-use-case on an operation, a model alias of /v1/*) or carried by a verified claim of a trusted client, never a caller's header; the most restrictive appliesPlanned in 1.8
- Inference budgets per attribution key: application (the verified client) and axes the operator declares (team, project, cost centre) read from a verified claim or an attribute of a key or certificate, a default value required, the most restrictive wins together with the budgetsPlanned in 1.8
- Tokens per minute rate per tenant, plan or attribution axis, reserved on the estimate then reconciled, 429 with Retry-AfterPlanned in 1.8
- Graduated actions per budget: notify, switch to a cheaper route or backend, deny; generalises the soft capPlanned in 1.8
- Coalescing of identical in-flight reads (single flight): GET and HEAD declared by the operation (x-flexway-coalesce), one upstream call for concurrent requests with the same key - the cache key, tenant and subject included for an identified call -, with or without cache, bounds on size and waiters, never a streamPlanned in 1.8
Transformations (24)Transformations page
- Request and response headers: set, remove, rename, deriveDelivered · since v0.1.0
- Path rewrite and query parametersDelivered · since v0.1.0
- Protected elements cannot be written, refused at startDelivered · since v0.1.0
- Phase engine: request, upstream, response, errorDelivered · since v0.1.0
- Four attachment levels, effective chain, the most precise winsDelivered · since v0.1.0
- Explicit removal (!name)Delivered · since v0.1.0
- CEL conditions compiled at load timeDelivered · since v0.1.0
- Dry-run simulation of a policy chainDelivered · since v0.1.0
- Body field projection and filtering, schema conformance checkedDelivered · since v1.1.0
- Masking of sensitive fields in responsesDelivered · since v1.1.0
- Upstream status code mapped to a semantic codeDelivered · since v1.1.0
- External call: timeout budget and declared failure behaviourDelivered · since v1.1.0
- Upstream Cache-Control, ETag and Vary honouredDelivered · since v1.1.0
- Public response cache, per operationDelivered · since v1.1.0
- Continuous cross-tenant isolation test, a blocking prerequisiteDelivered · since v1.1.0
- Authenticated cache, isolated per tenant and subjectDelivered · since v1.1.0
- Projection to gRPC and to a broker messageDelivered · since v1.5.0
- Built-in catalogue delivered with the productPartly · next to be scheduled
- JSON decoding and encodingTo be scheduled
- XML, YAML, form decodersTo be scheduled
- Negotiated gzip, brotli and zstd response compression (Accept-Encoding and qualities), compress policy, levels set by the bench, size threshold, allow list of types, never on a stream (SSE, unknown length, WebSocket) nor on an already encoded response; Vary: Accept-Encoding, one cache entry per encodingPlanned in 1.8
- Validation of FHIR resources against their declared profilesTo be scheduled
- WebAssembly modules: sandbox, memory and time cappedTo be scheduled
- Response composed from several upstreams, overall time budgetTo be scheduled
AI (19)AI page
- OpenAI-compatible /v1/* surfaceDelivered · since v0.1.0
- Policy routing across providers and modelsDelivered · since v0.1.0
- Budget and rate per tenantDelivered · since v0.1.0
- Sensitive requests pinned, sovereignty and fallback by policyDelivered · since v0.1.0
- Metadata audit, never a promptDelivered · since v0.1.0
- Inference streaming relayed without holdingDelivered · since v0.1.0
- OpenAI-compatible multimodal content, vision backendDelivered · since v1.5.0
- Embeddings, with budget and auditDelivered · since v1.5.0
- Backends by kind (OpenAI, relay, gRPC), local or upstream meteringDelivered · since v1.5.0
- gRPC method of a specialised model, metered per callDelivered · since v1.5.0
- Inference-aware routing (Gateway API Inference Extension)To be scheduled
- Semantic cache, per operationTo be scheduled
- Task routes: a named route lists ordered candidates (backend and model), chosen by a model alias or the declared use case; a simple task goes to the small model because its route says soPlanned in 1.9
- Declared criteria: hosting class (cloud, private, local) and region of the backends, sorted by declared order, declared cost or measured latency, the reason for the choice in the trace and the auditPlanned in 1.9
- Model canary: weighted, deterministic split between the candidates of a route, manual or declared rollbackPlanned in 1.9
- Models allowed per caller (tenant, plan, use case), 403 model_not_allowed outside the listPlanned in 1.9
- Declared, ordered data classes, the class of a request (use case, claim, trusted header, detector), the highest class per backend; generalises pinningPlanned in 1.9
- Residency: regions allowed per tenant, class or use case, the region served in the trace and the auditPlanned in 1.9
- Backend kinds for inference APIs that are not OpenAI-compatibleTo be scheduled
Agents: MCP and A2A (14)Agents: MCP and A2A page
- MCP surface: the contract's operations offered as toolsDelivered · since v0.1.0
- OAuth 2.1 resource server, RFC 9728 metadataDelivered · since v0.1.0
- Issuer validation and resource indicators (RFC 8707)Delivered · since v0.1.0
- RFC 8693 token exchange: human subject, agent actorDelivered · since v0.1.0
- Delegation bounded in time and depth, cascading revocationDelivered · since v0.1.0
- Client ID Metadata Documents; the case of unattended agentsDelivered · since v0.1.0
- MCP federation: existing MCP servers under the same authorisation, quota and auditDelivered · since v0.1.0
- A2A governance: signed agent cards, traffic under quota and auditUnder way
- Input and output guardrailsPlanned in 1.9
- AI for operations: proposals, never in the decision pathTo be scheduled
- Human approval required for a tool or an operation marked sensitive: the gateway verifies a proof of approval issued by the identity provider (CIBA, authorization_details RFC 9396), bound to the operation and its arguments; the workflow stays with the clientPlanned in 1.10
- Rights limited to a task and a duration: an agent token carrying authorization_details (RFC 9396), checked against the operation and its argumentsPlanned in 1.10
- Contextual control of a tool's arguments: a CEL condition on the request body and the identity (a cap depending on the caller's role)Planned in 1.10
- Budget per agent run: calls, tokens and euros capped for a whole taskPlanned in 1.10
Asynchronous (18)Asynchronous page
- AsyncAPI as the source of the asynchronous planeDelivered · since v1.5.0
- Kafka publishing under contract, CloudEvents envelopeDelivered · since v1.5.0
- Mediation of the synchronous to asynchronous boundaryDelivered · since v1.5.0
- AMQP(S) and MQTTDelivered · since v1.5.0
- Signed, replayable outgoing webhooksDelivered · since v1.5.0
- Native Kafka proxy: Kafka clients on the gateway, virtual clusters and topics per tenantDelivered · since v1.6.1
- Message field encryption at the native proxyDelivered · since v1.6.1
- Binary payloads under a schema: Protobuf and Avro (schemaFormat), CBOR under a JSON schema, opt-in validation, transcoding to JSON for SSE and webhooks; a prerequisite of the native Kafka proxy and of the MQTT listenerDelivered · since v1.6.1
- Read-only schema registry, Confluent API (Confluent, Apicurio, Karapace, Redpanda): magic-byte wire format, cache by identifier, schema bound to the declared subject required, never a writeDelivered · since v1.6.1
- NATS Core and JetStream on the asynchronous plane, as a client of the broker: acknowledged JetStream publication (PubAck) from HTTP or an MCP tool, refused towards NATS Core; consumption over SSE (fan-out), WebSocket and webhook (durable JetStream consumers); subject bound to the tenant, * and > wildcards included in the channel after the bound segments; gateway identity by credentials file, nkey, token or password, TLS and mTLSDelivered · since v1.6.1
- AMQP 1.0 on the asynchronous plane, as a client of the broker (RabbitMQ 4, Azure Service Bus, ActiveMQ Artemis, Solace): accepted disposition before 202, message settled after the client's acknowledgement or the webhook's 2xx, CloudEvents AMQP binding, SASL PLAIN, ANONYMOUS and EXTERNAL, TLS and mTLSDelivered · since v1.6.1
- ACLs and quotas per Kafka client at the native proxyPartly · next to be scheduled
- MQTT ingress for devices: MQTT 5 and 3.1.1 listener (TCP, TLS, WebSocket) as a proxy in front of the client's broker, one upstream connection per device, PUBACK after the broker'sPlanned in 1.7
- Device identity and authorisation: X.509 certificate, OIDC token as password, API key; topic = declared AsyncAPI channel, bound parameters, wildcards included in the channel, authorised last will, quotas per device and per tenantPlanned in 1.7
- Sparkplug B 3.0: spBv1.0 namespace, online state of nodes and devices per tenant, checked sequences, NCMD/DCMD commands under a declared scopePlanned in 1.7
- OPC UA PubSub JSON over MQTT (OPC 10000-14) under an ordinary contractPlanned in 1.7
- CoAP for constrained devices (RFC 7252) under contract, as a proxy in front of the client's serviceTo be scheduled
- Downstream command authorised by the declared state of the system, read by a decision service of the client (external-call on the asynchronous plane)To be scheduled
Operations (70)Operations page
- Structured JSON logs, no personal dataDelivered · since v0.1.0
- Metrics per operation, upstream and tenant, bounded cardinalityDelivered · since v0.1.0
- W3C traces propagated end to endDelivered · since v0.1.0
- /healthz, /readyz, /metrics, /config on a separate portDelivered · since v0.1.0
- Dashboards and alerts delivered with the productDelivered · since v0.1.0
- Adaptive trace samplingDelivered · since v0.1.0
- /simulate: route, effective chain and verdict without calling the upstreamDelivered · since v0.1.0
- API catalogue derived from the contracts, with lifecycleDelivered · since v0.1.0
- Traffic per operation, upstream and tenantDelivered · since v0.1.0
- Tenant isolation in the console: 403, never an empty listDelivered · since v0.1.0
- Upstream health: circuit breakers, ejections, timeoutsDelivered · since v0.1.0
- Effective policy chain per routeDelivered · since v0.1.0
- Usage: requests, tokens, euros, per tenantDelivered · since v0.1.0
- Opening an end-to-end traceDelivered · since v0.1.0
- Local accounts and first admin, without an identity provider: generated initial password, forced change, TOTP for admins, shared lockDelivered · since v0.1.0
- Management of local accounts in the console: invitation, role and tenant, reset, MFA, deactivationDelivered · since v0.1.0
- Optional OIDC coexisting with local accounts: accounts / breakglass / off modes, tenant taken from a claim or from the roleDelivered · since v0.1.0
- Single binary, distroless non-root image, multi-architectureDelivered · since v0.1.0
- Start with no mandatory dependencyDelivered · since v0.1.0
- Helm chart and reference manifestsDelivered · since v0.1.0
- SBOM, signature and keyless attestation on the digestDelivered · since v0.1.0
- Version served visible: flexway version, build in /config, service.version, and in the console (sign-in and interface)Delivered · since v1.1.0
- Declarative proposal: a diff, never a mutationDelivered · since v1.2.0
- Pull request opened from the proposalDelivered · since v1.2.0
- Screen to simulate a policy chainDelivered · since v1.2.0
- Audit log of the proposalsDelivered · since v1.2.0
- Agents dashboard: tools called, cost, scopesDelivered · since v1.2.0
- Catalogue conformance: operations without an owner, deprecated without a dateDelivered · since v1.2.0
- Account activity and sign-in history, bounded, in the consoleDelivered · since v1.2.0
- OIDC identities seen, read-only, minimisedDelivered · since v1.2.0
- Detail of an operation: throughput, errors by code, latencies, split by tenant, comparison with the previous periodDelivered · since v1.3.0
- Built-in alerts: thresholds per upstream or operation, webhook notificationDelivered · since v1.3.0
- Traces seen by the gateway, in the console: a sample of slow or failing requests, with the duration of each step (routing, identity, policies, upstream)Delivered · since v1.3.0
- Log of the gateway's recent errors, filterable by operation, upstream and tenantDelivered · since v1.3.0
- Built-in metrics source: the console works without an external metrics backend, bounded and configurable history; the Prometheus API remains an optionDelivered · since v1.3.0
- Reload markers: one mark per reload applied or refused on every chart of the console, version and result on hover, touch and focusDelivered · since v1.3.0
- Service-level objectives per operation: remaining error budget, burn rate over several windows, built-in alert ruleDelivered · since v1.3.0
- Strongest changes against the previous period (throughput, errors, p95), on Traffic and the OverviewDelivered · since v1.3.0
- Alert rule from a chart: generated YAML to copy into the values, no writeDelivered · since v1.3.0
- Compare two freely chosen windows, overlaid on the same charts (Traffic, Operation, Upstreams)Delivered · since v1.3.0
- New error detected: a problem code never seen on an operation for 7 days, flagged, with a built-in ruleDelivered · since v1.3.0
- Hour-by-weekday heat map (throughput, errors) on TrafficDelivered · since v1.3.0
- Periodic summary (daily, weekly) through the alerts' signed webhooksDelivered · since v1.3.0
- Shareable links: the URL keeps the screen, window, tenant and filters; scope reread by the serverDelivered · since v1.3.0
- Health per gateway replica: status of each replica and freshness of its last reportDelivered · since v1.4.0
- Console on phone and tablet - shell: navigation from 360 to 1,024 px (bottom bar, rail, drawer), tenant always visible, palette opened by touchDelivered · since v1.4.0
- Console on phone and tablet - lists and tables by touch: no horizontal scrolling of a list, priority columns, targets of at least 44 pxDelivered · since v1.4.0
- Console on phone and tablet - charts, markers, heat maps and topology by touch: nothing on hover aloneDelivered · since v1.4.0
- Console on phone and tablet - panels, dialogs and forms (silences, proposals, accounts) by touchDelivered · since v1.4.0
- Console: Kafka clients and clusters, connections per tenant, refusals by cause, encryption and built-in alert rulesDelivered · since v1.6.1
- Overview per upstream, with no external tool: throughput, 4xx and 5xx errors, p50, p95 and p99 latencies, availability over 24 h, as time chartsPartly · next to be scheduled
- Long streams (SSE, WebSocket) measured apart: open connections, duration, events relayed - never counted in the latencyPartly · next to be scheduled
- Rankings: slowest operations, operations most in error, strongest rises since the previous periodPartly · next to be scheduled
- Health of the gateway itself: replicas, requests in flight, shedding, reloads accepted or refused, version servedPartly · next to be scheduled
- Console: SLO objectives per group of operations - per upstream (x-flexway-upstream), per OpenAPI tag, per explicit list (journey) or global; availability weighted by requests, p95 latency of the group or of each member, the group's budget and slo-burn, each member's share, a global objective on the Overview; no new seriesPartly · next to be scheduled
- Reproducible performance bench, budgets checked in CIPartly · next to be scheduled
- OpenTelemetry GenAI conventions (gen_ai.*) on inference spans and metrics, beside the flexway.* names, model served as a bounded dimensionPlanned in 1.8
- Developer portal: catalogue, try-out, keysTo be scheduled
- Break-glass access, traced and boundedTo be scheduled
- Console: devices and shop-floor nodes - connections per tenant and per listener, refusals by cause, Sparkplug nodes online and offline, sequence gaps, built-in device-connections-refused and sparkplug-node-offline rulesPlanned in 1.7
- Shared console: declared scopes (scopes block: gateways, metrics source, repository, groups by role); without the block, behaviour unchangedTo be scheduled
- Shared console: scope selector, metrics read from the scope's source, multi-scope overview (counters added, never the percentiles)To be scheduled
- Shared console: existing roles applied within a scope, a role without a tenant sees every tenant of its scope, no access without a group matchTo be scheduled
- Console: plans, budgets and refusals - consumption per plan, per use case and per user (hashed subject, ranking), refusals by cause (webhook_signature_invalid, address_denied, quota_exceeded and budget_exceeded per limit), bytes saved by compression and upstream calls avoided by coalescing, a reader limited to their tenantPlanned in 1.8
- Console: inference routing - routes, candidates and their state (circuit breaker, measured latency, declared cost), actual split and reasons for the choice, canary, model_not_allowed refusalsPlanned in 1.9
- Console: costs per attribution axis - consumption and budget per application, team, project, cost centre, tiers, end-of-month forecast, budget-threshold and budget-forecast rules, chargeback exportPlanned in 1.8
- Console: data protection - decisions by cause (detector, class, residency, guard service), maskings and refusals, region served, guard-unavailable rulePlanned in 1.9
- Console: catalogue of AI services - models and routes, A2A agents, MCP tools from the contract and federated, versions, owners, terms of usePlanned in 1.10
- Optional Kubernetes operatorTo be scheduled
- Exportable proof of execution (European AI Act)To be scheduled
No feature matches.
What is coming
The roadmap's horizon, apart: forecasts, suggested releases that are not commitments.
- suggested for 1.8Report of calls outside the contractFlexway already refuses what is not declared: it shows what clients try to call (shadow APIs, outdated clients)
- suggested for 1.8`flexway diff`Two versions of a contract compared in CI: breaking change, deprecation, new scope; refused if breaking without a new version
- To be scheduledHuman approval of sensitive tool callsA tool marked sensitive waits for a person's approval, traced, before it goes out
- To be scheduledBudget per agent runA cap on calls, tokens and euros for a whole agent task, not only per request
- To be scheduledJurisdiction routingA request from a European tenant only goes to upstreams and models hosted in Europe, declared and proven in the trace
- To be scheduledEvidence report for the European AI ActSigned export of the decisions, models and guardrails applied, per period
- suggested for 1.10Guaranteed structured outputsA model's response checked against the expected JSON schema; retry or refusal
- To be scheduledPersonal data detection in promptsMasking, or a switch to an internal model, before sending
- To be scheduledOpenTelemetry GenAI conventionsModel, tokens, cost, tool called, readable by any observability tool
- To be scheduledRouting by measured cost and latencyThe model chosen by its actual latency and cost
- To be scheduledMCP server registryThe tools offered to agents, with owner, scopes and usage
- suggested for 1.10DORA and NIS2 reportsIncidents, availability per critical service, third-party dependencies, drawn from the SLOs and traces
- To be scheduledFAPI 2.0 profileThe open banking security profile
- suggested for 1.10Carbon footprint per requestEstimated energy and CO2 per operation and per model, in the console and in usage
- suggested for 1.10Mock responses from the contractAn operation without an upstream answers with the contract's examples
- suggested for 1.8`Sunset` and `Deprecation` headers to callersClients warned automatically; extends `x-flexway-sunset`
- suggested for 1.9Migration from other gatewaysMigration assistants for other configuration formats on the market
- suggested for 1.10SOAP and XMLA WSDL contract declares the operations; a REST caller reaches an existing SOAP service, XML decoded under strict limits (external entities refused, size and depth bounded)
- suggested for 1.10Declared fault injectionDelays and errors on a share of the traffic, in pre-production
- suggested for 1.10Traffic mirroringA copy of real traffic to a new version, with no effect on the response
- suggested for 1.10Anomaly detection in the consoleUnusual rises in errors, latency or cost, as proposals, never as decisions
- To be scheduledAI cost forecastEnd-of-month projection per tenant
- suggested for 1.10SPIFFE workload identity to upstreamsmTLS without hand-managed certificates
- suggested for 1.10Hybrid post-quantum TLSML-KEM key exchange with X25519
Let's talk about your gateway
Flexwiz is a young company: you talk directly with the person who founds it. Tell us what you want to run through Flexway. We talk about your infrastructure and your digital sovereignty requirements.
Online booking is coming soon; until then, an e-mail is enough.