Early Warning
You Hear About It
Before Your Customers Do.
Drift between what you designed and what is running. Commitments you are about to break — or promised and never use. Service levels slipping. Attacks and probing, traced to who is behind them. One place, before any of it becomes an incident — a smoke alarm, not a fire report.
And every API is protected the moment it goes live — nothing to install, nothing to tune.
What it warns you about
Everything That Would
Otherwise Surprise You.
Drift
What is running has stopped matching what you designed and promised — found before a partner finds it.
Commitments
Both ways: allowances about to be exceeded, and capacity you are paying for or promising that nobody uses.
Service levels
The limits and quotas in your agreements, enforced on every request, and the risks to them raised as they happen rather than after something breaks.
Attacks
Probing, credential misuse and enumeration — attributed to a named consumer, not an address.
Protection built in
Like A Firewall.
Without The Learning Mode.
A web application firewall has to watch your traffic for weeks to guess what normal looks like — and still blocks some good requests and lets some bad ones through. Apiway does not guess. Your contract (OpenAPI) says exactly which paths, fields and values are allowed; your service levels (OpenSLA) say who may call how often. The protection is built from those two documents, so it is exact from the first request, on every API, and it changes the moment they do.
When somebody is trying
A Firewall Sees An Address.
We See An Identity.
Protection runs after the caller has been authenticated, so every signal is attributable to somebody. A subscriber probing an operation they have no entitlement to is a very different event from an anonymous scan — and only one of them is worth waking up for.
Who tried
Named consumer, partner system or AI agent — not a source address. Attribution is the difference between an alert and a lead.
What they tried
The operation, and which control refused it: an entitlement they do not hold, a payload the contract does not permit, or a limit they exceeded.
How persistently
Severity rises with volume. A few refusals are usually a misconfigured integration. A burst is somebody looking for a way in.
Not a separate product
You Are Not Buying
Another Console.
These signals are produced by serving the request. There is no agent to install, no log pipeline to build, and no correlation step where somebody joins a gateway log to an identity provider log and hopes the timestamps line up.
The same record becomes your evidence for NIS2, DORA and the EU AI Act — because it was never a separate logging exercise.
- 01Identity — the consumer or agent, and the human it acted for
- 02Operation — what was being attempted, per operation rather than per API
- 03Control — entitlement, contract, or limit
- 04Severity — escalating with volume, so noise stays quiet and patterns surface
Where it goes next
A Signal Today
Is Blast Radius Tomorrow.
These events are recorded, and they form part of blast radius analysis. So the question stops being "was anything alerted last night" and becomes the one that actually matters: if this consumer were compromised, what could it reach — and if we change this operation, who is affected.
Before a change lands
Who depends on this operation, what they are entitled to, and how they have been behaving. Impact assessed against what is actually happening rather than against a dependency diagram someone drew last year.
After something looks wrong
The reach of a single credential, expressed in the operations and data it could touch — which is the first question asked in an incident and usually the slowest to answer.