APISIX

APISIX is a high-performance open-source API gateway designed for microservices and cloud-native applications. It offers dynamic routing, rate limiting, authentication, and traffic control features, ensuring efficient API management and scalability. APISIX is built on Nginx and Lua, providing flexibility and extensibility for modern development environments.

For basic usage, access the mentioned API endpoints via your API client. Authorization and authentication is done using KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles.. The created Bearer token has to be forwarded to APISIX as Authorization-Header.

Dashboard

For having a look on the currently provided endpoints in the API Management you can use the APISIX Dashboard. This is currently not integrated via OIDC-Login, so the credentials from the inventory must be used.

Upstreams and Route Configuration

Default upstreams and respective routes for the platform services are pre-defined during deployment. These include the FROST-ServerFROST-ServerA server implementation of the OGC SensorThings API for sensor data. On the platform, a data space maps to a project in FROST-Server, and users get access through project-specific roles., the GeoServerGeoServerThe component for geo-spatial content on the platform. Access to its layers and layer groups is controlled by roles that are specific to each data space., and StellioStellioAn NGSI-LD compatible context broker. On the platform, a data space maps to a tenant in Stellio with separate roles for reading, writing, and deleting entities..

Additional routes can be added per upstream.

Authorization for API Routes using the OIDC Plugin

For each route, the required scopes are defined in the OIDC plugin. Three specific OIDC scopes are defined in KeycloakKeycloakThe component that manages access to data spaces across all platform components. It uses realms, clients, roles, users, and groups, and represents each data space through specific roles. by default:

• api:read
• api:write
• api:delete

These scopes must be specified within the required_scopes array in the OIDC plugin editor:

Tokens are requested with a specific scope. APISIX will respect the requested scope when using the respective route.