Before you can test an API well, you need to understand how it is described and how it is exposed. Three related ideas matter here: the API definition, its specification, and the API gateway in front of it.
API definition and specifications
An API specification is the formal, machine-readable description of what an API offers — its endpoints, methods, parameters, request and response formats, and error codes. For REST APIs, the OpenAPI Specification (formerly Swagger) is the de facto standard; SOAP uses WSDL.
- Endpoints — the URLs you can call.
- Methods — the operations allowed (GET, POST, etc.).
- Schemas — the exact shape of request and response data.
- Status codes — the expected responses for success and failure.
The API gateway
An API gateway is a server that sits in front of your APIs and acts as the single entry point for clients. It handles cross-cutting concerns so individual services do not have to.
An API gateway as the front door
- Authentication and authorisation.
- Routing requests to the right service.
- Rate limiting and throttling.
- Logging, monitoring, and caching.
Conclusion
The specification tells you what an API promises; the gateway controls how it is accessed. Understanding both helps you design precise tests and interpret behaviour — including the auth and rate-limit responses the gateway introduces.