API Gateway Security Calculator

Gateway score = 0.16 × authentication coverage + 0.12 × schema coverage + 0.12 × rate-limit coverage (40 points) + 12 upstream mTLS + 10 WAF + 10 central logging + 10 vaulted secrets + 10 admin allow-list + 8 TLS 1.3 (60 points) = 100. Forty of the hundred points come from per-route policy coverage, because a gateway control only protects the routes it is attached to, and one forgotten route is the whole finding. The remaining sixty cover gateway-wide controls, with upstream mTLS and the admin API weighted highest since both decide whether the gateway can be bypassed or taken over.

Gateways centralise policy, which is their value and their risk: coverage gaps are invisible in the dashboard, and an exposed admin API rewrites every policy at once.

This calculator takes 10 inputs: Routes published through the gateway, Routes with authentication enforced at the edge, Routes with request schema validation, Routes with a rate limit policy, Mutual TLS to upstream services, WAF or bot rules in blocking mode, Structured access logs shipped to the SIEM, Upstream credentials held in a vault, TLS 1.3 terminated with modern ciphers only, Gateway admin API restricted to an allow-list. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because it is the control plane. Anyone who reaches it can disable authentication, add a route that proxies to internal services, or export upstream credentials, so it deserves a network allow-list, its own credentials and separate audit logging — not the same trust boundary as the data plane.