Public sector
A gateway you host, on open standards.
Flexway helps you expose your APIs and digital services without depending on a third-party service: self-hosted, configured by open contracts, made in Europe.
What Flexway decides, on your infrastructure
Who calls, what Flexway decides, what is called: each route is a use case of your sector. Dashed: what is coming.
Architecture for the public sector: portal users, other agencies and business software go through Flexway, on your infrastructure. Flexway checks the token of your OIDC provider, identifies each agency by its client certificate, publishes on a declared AsyncAPI channel, audits and traces every decision and serves only the contract, in front of your business services, your existing systems and your AMQP or MQTT broker. An undeclared operation gets a 404.
- Citizens (portal)
- The public portal's users: their requests reach only what the contract declares, with your identity provider.
- Other agencies
- The other administrations: their exchanges go through Flexway, authenticated by client certificate.
- Business software
- The applications that call your APIs: each request goes through Flexway, which checks the contract and the identity before reaching your systems.
- Closed by default
- Closed by default: only what the contract declares is served; undeclared headers, methods or origins are refused.
- Your OIDC provider
- Your OIDC tokens, from several issuers at once, are checked by Flexway: signature, issuer, audience.
- Client certificate
- The client certificate (mTLS) identifies each partner and binds it to its tenant, passed on proven to your services.
- Declared AsyncAPI channel
- The channel must be declared in the AsyncAPI contract; an undeclared channel is refused before any publication.
- Audit and traces
- Every authorization decision is logged in a chained, verifiable audit, without request content.
- Business services
- Your REST and gRPC services: they receive only the requests Flexway let through, under deadline and circuit breaker.
- Existing systems
- Your existing systems: a gRPC service becomes callable over REST, without a rewrite, through the Protobuf descriptors.
- AMQP, MQTT broker
- Your Kafka, AMQP, MQTT and NATS brokers: Flexway publishes on them under an AsyncAPI contract, in a CloudEvents envelope.
- Line: one route
- Interchange: shared decision
- Request
- Event
- Refusal
- Your infrastructure
- Closed by defaultonly the contract is served
- Your OIDC providerseveral issuers at once
- Client certificateexchanges between agencies
- Declared AsyncAPI channelpublished to AMQP or MQTT
- Audit and tracesno external backend
1A citizen signs in to the portal
What Flexway decidesThe token of your OIDC provider is checked (issuer, audience); only what the contract declares is served.
What is protectedTraffic and identity stay with you, with no third-party service.
2Another agency exchanges data
What Flexway decidesIts client certificate identifies it before any access to your existing systems.
What is protectedEvery exchange is traced and audited, without request content.
3Business software publishes an event
What Flexway decidesThe channel must be declared in AsyncAPI; the gateway publishes to your broker.
What is protectedNo channel open outside the contract.
Citizens (portal)
The public portal's users: their requests reach only what the contract declares, with your identity provider.
Routes through here
Other agencies
The other administrations: their exchanges go through Flexway, authenticated by client certificate.
Routes through here
Business software
The applications that call your APIs: each request goes through Flexway, which checks the contract and the identity before reaching your systems.
Routes through here
Closed by default
Closed by default: only what the contract declares is served; undeclared headers, methods or origins are refused.
- Decision
- only the contract is served
- Catalogue features
- Closed by default: undeclared header, parameter, method or origin refused ; An OpenAPI 3.1 contract loaded; what is served is derived from it
Routes through here
Your OIDC provider
Your OIDC tokens, from several issuers at once, are checked by Flexway: signature, issuer, audience.
- Decision
- several issuers at once
- Catalogue features
- iss and aud checked; several issuers in one configuration ; JWT validation, cached JWKS keys with rotation
Routes through here
Client certificate
The client certificate (mTLS) identifies each partner and binds it to its tenant, passed on proven to your services.
- Decision
- exchanges between agencies
- Catalogue features
- API keys and client mTLS as first-class identities
Routes through here
Declared AsyncAPI channel
The channel must be declared in the AsyncAPI contract; an undeclared channel is refused before any publication.
- Decision
- published to AMQP or MQTT
- Catalogue features
- AsyncAPI as the source of the asynchronous plane ; AMQP(S) and MQTT
Routes through here
Audit and traces
Every authorization decision is logged in a chained, verifiable audit, without request content.
- Decision
- no external backend
- Catalogue features
- Chained audit log of authorisation decisions ; W3C traces propagated end to end
Business services
Your REST and gRPC services: they receive only the requests Flexway let through, under deadline and circuit breaker.
Routes through here
Existing systems
Your existing systems: a gRPC service becomes callable over REST, without a rewrite, through the Protobuf descriptors.
Routes through here
AMQP, MQTT broker
Your Kafka, AMQP, MQTT and NATS brokers: Flexway publishes on them under an AsyncAPI contract, in a CloudEvents envelope.
- Catalogue features
- AMQP(S) and MQTT
Routes through here
What the sector requires
- SovereigntyYour traffic stays with you
- Flexway runs in your infrastructure; its configuration is validated offline and reloaded without interruption.
- Open standardsNothing proprietary in your contracts
- OpenAPI and AsyncAPI for the configuration, OIDC for identity, OpenTelemetry for traces, RFC 9457 for errors.
- NIS2Traceability and detection
- Chained audit of decisions, a read-only console, alerts and traces without an external backend.
- IdentityYour identity provider, not ours
- Any OIDC provider, several at once; client certificates for exchanges between services.
How Flexway answers
Your traffic stays with you
- An OpenAPI 3.1 contract loaded; what is served is derived from itDelivered · v0.1.0
- Live reload through an immutable snapshot, no request lostDelivered · v0.1.0
Nothing proprietary in your contracts
- iss and aud checked; several issuers in one configurationDelivered · v0.1.0
- AMQP(S) and MQTTDelivered · v1.5.0
- Signed, replayable outgoing webhooksDelivered · v1.5.0
- Built-in alerts: thresholds per upstream or operation, webhook notificationDelivered · v1.3.0
- W3C traces propagated end to endDelivered · v0.1.0
Traceability and detection
- Chained audit log of authorisation decisionsDelivered · v0.1.0
- API catalogue derived from the contracts, with lifecycleDelivered · v0.1.0
- Tenant isolation in the console: 403, never an empty listDelivered · v0.1.0
Your identity provider, not ours
- iss and aud checked; several issuers in one configurationDelivered · v0.1.0
- API keys and client mTLS as first-class identitiesDelivered · v0.1.0
- RFC 8693 token exchange: human subject, agent actorDelivered · v0.1.0
State in Flexway's latest published release; a feature is marked delivered only with its release.
What Flexway does not do
- To date, Flexway is not qualified by any certification body.
- The package for isolated networks is part of the Enterprise offer, still to be built.
Let's talk about your gateway
Flexwiz is a young company: you talk directly with the person who founds it. Tell us what you want to run through Flexway. We talk about your infrastructure and your digital sovereignty requirements.
Online booking is coming soon; until then, an e-mail is enough.