Skip to content
ENExplore Calculators

API Gateway Security Calculator

Score the controls at your API gateway and the share of published routes covered by authentication, schema validation and rate limits.

About API Gateway Security Calculator

Forty of the hundred points come from per-route policy coverage, because a gateway control only protects the routes it is attached to, and one forgotten route is the whole finding. The remaining sixty cover gateway-wide controls, with upstream mTLS and the admin API weighted highest since both decide whether the gateway can be bypassed or taken over. Gateways centralise policy, which is their value and their risk: coverage gaps are invisible in the dashboard, and an exposed admin API rewrites every policy at once.

Formula

API Gateway Security

Gateway score = 0.16 × authentication coverage + 0.12 × schema coverage + 0.12 × rate-limit coverage (40 points) + 12 upstream mTLS + 10 WAF + 10 central logging + 10 vaulted secrets + 10 admin allow-list + 8 TLS 1.3 (60 points) = 100.

authentication coverage
Share of published routes requiring authentication
control score
Gateway-wide controls, independent of route count

Worked example

With the default values below, API Gateway Security Calculator returns Gateway Security Score of 69. Change any input above and every figure here is recalculated in your browser.

Inputs used

Routes published through the gatewayaccepts 1–100,000 routes
240 routes
Routes with authentication enforced at the edgeaccepts 0–100,000 routes
210 routes
Routes with request schema validationaccepts 0–100,000 routes
150 routes
Routes with a rate limit policyaccepts 0–100,000 routes
180 routes
Mutual TLS to upstream services
No
WAF or bot rules in blocking mode
Yes
Structured access logs shipped to the SIEM
Yes
Upstream credentials held in a vault
Yes
TLS 1.3 terminated with modern ciphers only
Yes
Gateway admin API restricted to an allow-list
No

Results

Gateway Security Score
69 / 100
Gateway Grade
C — Fair
Authentication Coverage
87.5%
Routes Without Authentication
30
Schema Validation Coverage
62.5%
Highest-Value Fix
Enforce authentication on the 30 route(s) still open

Step by step

  1. 1Values used
  2. 2API Gateway Security
  3. 3Gateway Security Score= 69 / 100
  4. 4Gateway Grade= C — Fair
  5. 5Authentication Coverage= 87.5
  6. 6Routes Without Authentication= 30
  7. 7Schema Validation Coverage= 62.5
  8. 8Highest-Value Fix= Enforce authentication on the 30 route(s) still open

Assumptions and limits

  • The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is API Gateway Security calculated?

Gateway score = 0.16 × authentication coverage + 0.12 × schema coverage + 0.12 × rate-limit coverage (40 points) + 12 upstream mTLS + 10 WAF + 10 central logging + 10 vaulted secrets + 10 admin allow-list + 8 TLS 1.3 (60 points) = 100. Forty of the hundred points come from per-route policy coverage, because a gateway control only protects the routes it is attached to, and one forgotten route is the whole finding. The remaining sixty cover gateway-wide controls, with upstream mTLS and the admin API weighted highest since both decide whether the gateway can be bypassed or taken over.

Why does API Gateway Security matter?

Gateways centralise policy, which is their value and their risk: coverage gaps are invisible in the dashboard, and an exposed admin API rewrites every policy at once.

What values do I need to enter?

This calculator takes 10 inputs: Routes published through the gateway, Routes with authentication enforced at the edge, Routes with request schema validation, Routes with a rate limit policy, Mutual TLS to upstream services, WAF or bot rules in blocking mode, Structured access logs shipped to the SIEM, Upstream credentials held in a vault, TLS 1.3 terminated with modern ciphers only, Gateway admin API restricted to an allow-list. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does the admin API carry so much weight?

Because it is the control plane. Anyone who reaches it can disable authentication, add a route that proxies to internal services, or export upstream credentials, so it deserves a network allow-list, its own credentials and separate audit logging — not the same trust boundary as the data plane.

Related Calculators

API Gateway Security Calculator | Calcrivo