The API gateway for the APIs you haveand the ones you never built.
Hisar proxies REST, SOAP, GraphQL, gRPC and WebSocket behind one security chain, turns legacy SOAP services into JSON, and generates CRUD APIs straight from your databases. Runs on your own servers, licensed with a signed file — no phone-home, no metering.
$ unzip hisar-demo.zip && cd hisar-demo $ docker compose up -d ✔ Container hisar-demo-redis-1 Started ✔ Container hisar-demo-surrealdb-1 Started ✔ Container hisar-demo-elasticsearch-1 Started ✔ Container hisar-demo-apigateway-1 Started ✔ Container hisar-demo-frontend-1 Started $ docker compose logs apigateway | grep "INITIAL ADMIN" INITIAL ADMIN CREATED — email: [email protected] … $ open http://localhost:8080 # admin console on :8080 · gateway on :3000
Everything between your clients and your services
One binary, one middleware chain. A generated DB2API endpoint, a bridged SOAP service and a hand-written REST route all get the same WAF, rate limits, masking and audit trail.
Legacy SOAP, modern JSON
Clients send plain JSON; Hisar builds the SOAP envelope, applies action and version, and turns faults into structured JSON. WS-Trust / WS-Security tokens are acquired, cached and renewed by the gateway itself, so callers never handle an XML security header.
DB2API — APIs from your database
Point at PostgreSQL, MySQL, MariaDB, MSSQL, Oracle, MongoDB or SurrealDB and get CRUD endpoints with filtering, sorting, aggregation, declarative relations and row-level security. No application code.
AI gateway with a token wallet
OpenAI, Azure OpenAI, Anthropic and custom providers behind one endpoint. Prepaid token wallets per caller, guardrails for prompt injection and PII, streaming, semantic caching, fallback providers and cost metrics.
And everything else, on the same chain
OpenAPI and WSDL import
Build a service and its routes from an OpenAPI 3, Swagger 2.0 or WSDL document, pasted or fetched from a URL. SOAP operations arrive with action, version and a JSON-to-SOAP template. Re-sync later and review what changed before it is applied.
Access policies, explained
Allow and deny lists per application, service, route or DB2API table: networks, countries, users, API keys, User-Agent and Referer, with notes and expiry dates. Every refusal is recorded with its reason, and the console explains which rule stopped a request.
Anomaly-scoring WAF
57 built-in rules across 10 attack classes — SQLi, XSS, traversal, command, LDAP, NoSQL, SSRF, SSTI, XXE — with three-layer decoding against evasion. Policies merge across four scopes — global, service, route and even a single DB2API table. Block or DetectionOnly.
Cascade rate limiting
Up to seven tiers checked at once, from user and role down to organization. Shared, per-key, per-user or per-IP buckets on the same rule; sliding windows on Redis; changes reach every replica in milliseconds.
Plans, API keys, reserved capacity
Subscription-style plans bound to API keys with per-route quotas. Reserve a guaranteed share of a shared pool for a plan or a single key. Business-hour and promotion multipliers stack on top.
Identity, your way
RS256 JWT with rotating refresh tokens and reuse detection, scoped API keys and TOTP two-factor; OIDC, LDAP / Active Directory, external REST, trusted proxy and SAML 2.0 providers, hot-reloaded from the console. An API key carries an identity too, for row-level security without a login.
Data masking
Mask by field name, JSON or XML path, or value pattern — in replies and logs independently, with five strategies from prefix to stable hash. Preview a draft on a sample before saving; credentials are always masked in logs.
Hierarchical routing, live config
Organization → Application → API version → Service → Route. Policies inherit downward, deprecated versions answer with Deprecation and Sunset headers, and a past sunset date returns 410 Gone on its own. Admin changes reach every replica over Redis Pub/Sub — no restart, no polling wait.
Shadow traffic, mocks, faults
Mirror live traffic to a new upstream, answer from a mock while the backend is not ready, or inject delays and errors to test resilience — all after every gate. Per-route CORS, gzip compression and redirect routes come with it.
Circuit breaker, bulkhead, retry
Per-backend breakers shared across the cluster, per-host concurrency limits, backoff retries for idempotent calls. Health probes mark backends up or down automatically.
Load balancing & canary
Round-robin, weighted, least-connections or random across backends. Canary and blue-green releases by weight or pin header, tracked per variant.
Response caching
Redis-backed cache per route with TTLs, query-parameter keys and vary-by-header — restricted to public routes so nothing leaks across tenants. AI responses get exact and semantic caching.
Geo-blocking, DDoS, IP reputation
MaxMind lookups with allow and deny lists, per-IP rate and burst caps with automatic bans, and an in-memory reputation snapshot so enforcement costs no Redis round-trip.
Notifications & e-mail gateway
Slack, Discord, webhook and SMTP alerts, licence reminders and a daily security report, in every edition. The E-mail gateway module lets your applications send mail with one REST call: templates, quotas, one SMTP relay, recipients kept out of logs.
Built to operate
Single binary or Docker images, schema and migrations applied at boot, zero-downtime deploys with automatic rollback, control/data plane isolation, modules switched on and off at runtime, a Trash with cascading restore, and a console in Turkish and English.
Multi-protocol by design
One Service definition, dispatched on protocol. Legacy SOAP sits next to gRPC without a second gateway.
A hierarchy you can reason about
Configuration lives in SurrealDB. Every instance holds a lock-free snapshot of the route registry, rebuilt when an admin change is published over Redis Pub/Sub — reads on the hot path never touch a database.
Hierarchical schema
Policies inherit downward; any level can override.
- •Organization"Meridian Logistics"
- └─Application"Shipment Tracker"
- └─ApiVersionv1, v2 · deprecated / sunset date
- └─Serviceprotocol · backends · load balancing · auth · policies
- └─Routeslug · path · method
- └─RouteVersionschemas · cache · policy overrides
- └─RateLimitcascade target
Source of truth for organizations, services, routes, rate limits, users and licences. Schema and migrations are applied at boot.
Counters, sliding windows, circuit-breaker state, sessions and the Pub/Sub channel that propagates config changes.
Structured request, audit and security-block logs behind the dashboard. Traffic keeps flowing if the cluster is unreachable — only the log views go quiet.
Middleware stack
Top is outermost. A request a stage refuses never reaches the stages below it.
- plane_guarddata plane cannot reach /api
- traceW3C traceparent → root OTel span
- geo_block403 by country
- ip_banin-memory reputation snapshot
- corsper-route policy, preflight before any quota
- ddos_protectionper-IP rate + burst
- rate_limitcascade, most restrictive wins
- log_requestsmasked logs + Prometheus
- input_validationSQLi / XSS / traversal backstop
- security_headersHSTS / CSP / …
- wafanomaly-scoring engine
- dynamic_routerregistry snapshot · access policy → handler
Defense in depth, enforced at the edge
Five active layers plus a full WAF. Every mutation on the admin API is audited; every refusal is one structured record with its reason, and the console explains which policy or rule stopped a request.
Brute-force
Two ladders: per IP (15 min → 1 h → 24 h bans) and per account, so password spraying across rotating IPs is caught too. CAPTCHA after a threshold.
Input validation & SSRF
SQLi, XSS, traversal and size limits on every request. Upstream SSRF guard blocks cloud metadata endpoints and re-validates DNS on every proxied call.
Security headers
HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy; server header stripped.
DDoS
50 rps per IP, burst 100 / 10 s, automatic bans, body caps — with a per-replica fallback so the data plane stays up if Redis is down.
mTLS
Client certificates presented to upstreams (custom CA or public roots) and required from callers with subject / issuer matching.
Anomaly scoring
57 rules tagged OWASP / CWE across 10 attack classes, scoped policies per service or route, body inspection, Block or DetectionOnly.
Mask fields in responses and in log capture independently — personal data never lands in Elasticsearch.
reCAPTCHA v3 and hCaptcha, triggered only after repeated failed logins from an IP.
Service credentials encrypted with AES-GCM; passwords hashed with Argon2; API keys stored as SHA-256 hashes.
See every request, end to end
A one-command Docker Compose stack brings up Tempo, Prometheus, Loki and a ready-made ten-panel Grafana dashboard. Nothing external is required to start: the admin console ships its own internals and log views.
Traces
W3C traceparent extracted into a root OpenTelemetry span and propagated upstream, exported over OTLP gRPC to Tempo or Jaeger.
Metrics
GET /metrics for Prometheus — golden signals plus rate-limit hits, circuit-breaker state, bulkhead rejections, AI tokens and cost.
Logs
Request, audit and security-block records to Elasticsearch with admin-tunable retention, plus copies to up to eight log destinations — HTTP (NDJSON), Loki push or syslog. Masking applies to every copy.
Tech stack
- Rust
- Axum
- SurrealDB (config)
- Redis (cache, counters, pub/sub)
- Elasticsearch (logs)
- JWT & API keys
- TOTP 2FA
- Argon2 · AES-GCM
- MaxMind GeoIP
- JSON Schema
- OpenTelemetry → Tempo
- Prometheus /metrics
- Loki / Promtail
- Grafana dashboard
- PostgreSQL
- MySQL / MariaDB
- MSSQL
- Oracle
- MongoDB
- SurrealDB
- React
- Material UI
- TR / EN
- Recharts
- Swagger UI
Where Hisar stands next to the usual suspects
KrakenD and Kong are excellent gateways for API-first estates. Hisar is built for organisations that also carry legacy SOAP services, databases without an API layer, and on-premise constraints.
| Hisar | KrakenD | Kong | |
|---|---|---|---|
| CRUD APIs generated from existing databases | Yes | No | No |
| SOAP ⇄ JSON bridge with WS-Trust token handling | Yes | Partial / add-on | Partial / add-on |
| Built-in anomaly-scoring WAF | Yes | Partial / add-on | Partial / add-on |
| AI / LLM gateway | Yes | Yes | Yes |
| Turkish and English admin console | Yes | No | No |
| Deployment | Self-hosted: single binary or Docker images | Self-hosted: Docker, packages, marketplace images | Cloud-first (Konnect) or self-hosted OSS |
| Commercial model | Signed licence file per module — no metering, no per-call billing | Flat enterprise pricing, quoted by sales | Konnect metered per request and model; Enterprise quoted |
| Free edition | 5 routes, 10 RPS per route, no time limit | Community Edition (Apache 2.0) | OSS gateway (Apache 2.0); Konnect 30-day trial |
Competitor columns summarise the public krakend.io and konghq.com sites as of September 2026 and are not a feature audit. "Partial / add-on" means the capability exists through an enterprise edition, plugin or external product.
Install it on your own machine in five minutes
The free edition is the real gateway with a hard cap: 5 routes and 10 requests per second per route. No licence, no time limit, no account. When you are ready, upload a licence in the admin console and the same installation goes to full capacity — licensed modules included.
Requirements: Docker with the docker compose command — Docker Engine on Linux, Docker Desktop on macOS and on Windows with WSL 2 — on an x86-64 machine or a Mac with Apple silicon. About 2 GB of free memory; the first start downloads about 1 GB. The README walks through each operating system.
- 1Download the bundle
One zip from the GitHub release: the compose file, a ready .env and the README — or git clone the repository. Images are pulled from the public registry, no login.
- 2Start the stack
Redis, SurrealDB, Elasticsearch, the gateway and its admin console come up together. Images are pulled from the public registry — no build step.
unzip hisar-demo.zip && cd hisar-demo # or: git clone https://github.com/hisar-gateway/hisar-demo.git docker compose up -d
- 3Sign in
The first admin password is generated once and printed to the gateway log on one line. Sign in to the admin console and choose your own under the account menu → Profile.
docker compose logs apigateway | grep "INITIAL ADMIN"
- 4Add your first route
Create an organization, an application, a service and a route — or import an OpenAPI or WSDL document. Put a REST or SOAP upstream behind the gateway and watch it on the dashboard.
What comes up
- Admin UI
- http://localhost:8080
- Gateway
- http://localhost:3000
- Health
- http://localhost:3000/health
The demo compose runs on a single host over plain HTTP, without the TLS edge, plane isolation and replicas of the production layout. Docs →
Demo vs licensed
Offline, signed, à la carte
Licences are Ed25519-signed files verified against a public key inside the binary. No phone-home, no restart: upload in the admin console and it is active on every replica within milliseconds. Modules are licensed individually — keep the WAF you already own and buy only what you need.
Licensable modules
- WAF
- DDoS protection
- Geo-blocking
- Rate limiting & plans
- Load balancing
- mTLS
- Circuit breaker · bulkhead · retry
- Response caching
- CAPTCHA
- Data masking
- Tracing & dashboards
- DB2API
- AI gateway
- Canary releases
- SSO · LDAP · SAML · 2FA
- Developer portal
- Identity provider (OIDC · LDAPS)
- E-mail gateway
Always on, in every edition: routing for REST, SOAP, GraphQL, gRPC and WebSocket, JWT and API-key authentication, access policies, input validation, security headers, OpenAPI and WSDL import, CORS, shadow traffic, mocks and fault injection, logging with log destinations, notifications, health checks and the admin console.
Starter
A team putting its first services behind a gateway.
- All five protocols, incl. SOAP bridge
- Rate limiting & plans
- Response caching
- Circuit breaker · bulkhead · retry
- Admin console in Turkish and English
Professional
Production workloads with a security mandate.
- Everything in Starter
- WAF, DDoS, geo-blocking, CAPTCHA
- Load balancing & mTLS
- Data masking
- Tracing & Grafana dashboards
Enterprise
Legacy estates, multiple environments, AI workloads.
- Everything in Professional
- DB2API — 7 database engines
- AI gateway with token wallets
- SSO · LDAP · SAML · 2FA
- Identity provider — OIDC and LDAPS
- E-mail gateway for your applications
- Canary releases & developer portal
- Multiple environments per licence
Packages are starting points; any module can be added to any licence.
More than 60 days to expiry — every licensed module.
0–60 days left — everything still works; the log and e-mail warn.
No licence or expired — 5 routes, 10 RPS per route, licensed modules off.
Bad signature, organisation or environment — the gateway refuses to start.
Get a licence or a quote
Tell us the modules, routes and environments you need, and we will come back with a quote.
API gateway, reverse proxy, AI gateway — what is what?
The terms overlap and vendors blur them on purpose. Here is how we use them, and where Hisar fits.
What is an API gateway?
An API gateway is a single entry point that sits in front of your backend services. Every client request passes through it before reaching an upstream, so cross-cutting concerns — authentication, rate limiting, a web application firewall, logging, caching, load balancing and observability — are handled once at the network edge instead of in every service. Hisar does this for REST, SOAP, GraphQL, gRPC and WebSocket traffic, and for CRUD APIs it generates directly from a database.
What is the difference between an API gateway and a reverse proxy?
A reverse proxy such as NGINX, HAProxy or Traefik forwards connections and terminates TLS; it knows little about the API behind it. An API gateway understands the API: it routes by application, version and service, identifies the caller, applies per-consumer quotas and plans, inspects payloads with a WAF, converts protocols (for example SOAP to JSON) and audits every call. The two are complementary — in a production Hisar deployment Traefik handles ingress and TLS while Hisar enforces API policy.
Is an API gateway the same as a load balancer?
No. A load balancer spreads connections across identical instances. An API gateway can do that per service too — Hisar offers round-robin, weighted, least-connections and random strategies plus circuit breaker, bulkhead and canary releases — but its main job is policy: who may call what, how often, with which payload, and what gets logged.
What is an AI gateway or LLM gateway?
An AI gateway applies the API-gateway pattern to traffic bound for large language models. Instead of every application talking to OpenAI, Anthropic or Azure directly, calls go through one route that meters tokens and cost, enforces token budgets and prepaid wallets, caches identical or similar prompts, screens prompts and answers for injection and personal data, and fails over to a backup provider. Hisar ships this as a licensed module on the same middleware chain as every other route.
Why write an API gateway in Rust?
A gateway sits on the hot path of every request, so tail latency and memory behaviour matter. Rust has no garbage collector, so there are no collection pauses; memory safety is checked at compile time; and the result is a single static binary with no runtime to install. Hisar is built on Axum and Tokio for asynchronous I/O.
Can it run on-premise or air-gapped?
Yes. Hisar is self-hosted with Docker Compose, its license is an Ed25519-signed file verified offline against a key embedded in the binary, and it never phones home or meters usage externally. Without a license it still starts in a restricted demo mode.
Does it replace my existing WAF, SSO or load balancer?
Only if you want it to. Licensing is per module: keep your own WAF appliance, identity provider or load balancer and license only the parts you are missing — for example DB2API, the SOAP-to-JSON bridge or the AI gateway.