What is API-dex
Most organisations that run more than one API gateway end up with more than one developer portal: one per gateway, each with its own catalog, its own sign-in and its own idea of who may call what. Developers learn three portals. Platform teams maintain three access models. Nobody holds a full list of the APIs the organisation exposes.
API-dex replaces those portals with one. It connects to each gateway as an environment, reads the APIs, applications and credentials that gateway already manages, and presents them through a single catalog, a single access model and a single sign-in. The gateways keep doing what they do best: routing and securing traffic. API-dex never proxies a call.
Who it is for
- Platform and API teams who own the gateways and want one place to govern access without configuring every gateway the same way.
- Backend teams who publish APIs and want consumers to find them, read the specification and know who owns them.
- Application developers who need credentials for an API and should not have to learn which gateway it lives on.
- Regulated organisations in government, finance and the public sector that need the portal to run on their own infrastructure and to come with security evidence.
One catalog above the gateways
Connect Apigee, Gravitee and Azure API Management as named environments. Every screen is scoped to the environment selected in the header, so a test gateway and a production gateway never mix.
Publish an OpenAPI specification with the API-dex CLI from a CI/CD pipeline, or drop it onto the APIs page with a CI/CD account. The result is the same catalog entry either way.
Pick two versions of a specification and read a structured, side-by-side diff of what changed between them.
API-dex issues the keys, secrets or tokens each gateway expects, so an application works the moment it subscribes.
Each API shows the backend team that owns it, so consumers know who to contact for changes and incidents.
Catalogue MCP servers next to your APIs, behind a feature flag, with the same access controls and the same card layout.
Access that mirrors your organisation
Consumer teams share applications. Backend teams own APIs. Team owners manage membership and roles themselves.
Decide once who may call what. A permission group links teams to the APIs they may subscribe to, and every application those teams create inherits the access.
Consumers, producers, administrators, CI/CD accounts and subscription managers each see only the menus their role allows.
Administrators review pending application requests before access is granted. Sharing an application is limited to its owners and portal administrators.
Restrict which roles may enter a given environment, independent of team and application permissions.
See calls, errors and response times across your APIs, choose a time range, and share a filtered view by URL.
Built for regulated environments
API-dex deploys on-premise or hybrid, inside your network, next to the gateways it connects to.
Sign-in runs through Keycloak, federated to your organisation's identity provider, so access follows the accounts and groups you already manage.
WCAG 2.2 Level A across the portal: full keyboard operability, screen-reader labelling and visible focus states.
Configurable multilingual support with a full right-to-left layout. Administrators choose which of seven languages, Arabic included, the portal offers.
Theme presets, light and dark mode, logos and colour tokens per organisation, so one portal can carry several visual identities.
Administrators inspect API requests and troubleshoot from Logging. Sensitive values are redacted before anything is written.
Evidence for your reviewers
Buying software in a regulated organisation means answering a security review. Alongside the product, AppyThings maintains a Trust Center with API-dex's security overview, OWASP ASVS self-assessment, SBOM approach and the documents available under NDA, so your reviewers get answers without an email thread. It is part of what you get with API-dex, not a feature inside the portal.
What API-dex is not
- Not an API gateway. It does not route, throttle or secure API traffic. Your gateways do.
- Not a replacement for your gateway's console. Traffic policies, quotas and routing stay where they are. API-dex presents what the gateway exposes and manages who may use it.
- Not a hosted service. API-dex runs on your infrastructure, under your contract.
Next steps
Environments, the catalog, applications and access controls, end to end.
An administrator registers an environment and verifies it is live.
A backend team gets an API into the catalog, owned and discoverable.
An application developer subscribes to an API and makes the first call.