1. Why a Private API Gateway Matters

A typical API Gateway sits at the edge and exposes public REST endpoints.
But some environments require:

• APIs callable only from internal systems
• Backend microservices running in private subnets
• Zero inbound public access
• Authentication and authorization enforced at gateway level
• Isolation between dev, test, pprd, prod

These requirements push you toward a private deployment using Private Endpoint Mode.

This means:

• The API Gateway receives traffic only from inside your VCN
• Clients must be inside the private network (on-prem, FastConnect, VPN, or private OCI services)
• The entire flow stays within the private topology

2. Architecture Overview

A private API Gateway requires several OCI components working together:

• API Gateway (Private Endpoint Mode)
• VCN with private subnets
• Service Gateway for private object storage access
• Private Load Balancer for backend microservices
• IAM policies controlling which groups can deploy APIs
• VCN routing configuration to direct requests correctly
• Optional WAF (private) for east-west inspection inside the VCN

The call flow:

1. A client inside your VCN sends a request to the Gateway’s private IP.
2. The Gateway handles authentication, request validation, and OCI IAM signature checks.
3. The Gateway forwards traffic to a backend private LB or private OKE services.
4. Logs go privately to Logging service via the service gateway.

All traffic stays private. No NAT, no public egress.

3. Deploying the Gateway in Private Endpoint Mode

When creating the API Gateway:

• Choose Private Gateway Type
• Select the VCN and Private Subnet
• Ensure the subnet has no internet gateway
• Disable public routing

You will receive a private IP instead of a public endpoint.

Example shape:

Private Gateway IP: 10.0.4.15
Subnet: app-private-subnet-1
VCN CIDR: 10.0.0.0/16

Only systems inside the 10.x.x.x network (or connected networks) can call it.

4. Routing APIs to Private Microservices

Your backend might be:

• A microservice running in OKE
• A VM instance
• A container on Container Instances
• A private load balancer
• A function in a private subnet
• An internal Oracle DB REST endpoint

For reliable routing:

a. Attach a Private Load Balancer

It’s best practice to put microservices behind an internal load balancer.

Example LB private IP: 10.0.20.10

b. Add Route Table Entries

Ensure the subnet hosting the API Gateway can route to the backend:

Destination: 10.0.20.0/24
Target: local

If OKE is involved, ensure proper security list or NSG rules:

• Allow port 80 or 443 from Gateway subnet to LB subnet
• Allow health checks

5. Creating an API Deployment (Technical Example)

Here is a minimal private deployment using a backend running at internal LB:

Deployment specification

{
  "routes": [
    {
      "path": "/v1/customer",
      "methods": ["GET"],
      "backend": {
        "type": "HTTP_BACKEND",
        "url": "http://10.0.20.10:8080/api/customer"
      }
    }
  ]
}

Upload this JSON file and create a new deployment under your private API Gateway.

The Gateway privately calls 10.0.20.10 using internal routing.

6. Adding Authentication and Authorization

OCI API Gateway supports:

• OCI IAM Authorization (for IAM-authenticated clients)
• JWT validation (OIDC tokens)
• Custom authorizers using Functions

Example: validate a token from an internal identity provider.

"authentication": {
  "type": "JWT_AUTHENTICATION",
  "tokenHeader": "Authorization",
  "jwksUri": "https://id.internal.example.com/.well-known/jwks.json"
}

This ensures zero-trust by requiring token validation even inside the private network.

7. Logging, Metrics, and Troubleshooting 100 Percent Privately

Because we are running in private-only mode, logs and metrics must also stay private.

Use:

• Service Gateway for Logging service
• VCN Flow Logs for traffic inspection
• WAF (private deployment) if deeper L7 filtering is needed

Enable Access Logs:

Enable access logs: Yes
Retention: 90 days

You will see logs in the Logging service with no public egress.

8. Common Mistakes and How to Avoid Them

Route table missing entries

Most issues come from mismatched route tables between:

• Gateway subnet
• Backend subnet
• OKE node pools

Security Lists or NSGs blocking traffic

Ensure the backend allows inbound traffic from the Gateway subnet.

Incorrect backend URL

Use private IP or private LB hostname.

Backend certificate errors

If using HTTPS internally, ensure trusted CA is loaded on Gateway.

Regards

Osama