API Gateway supports REST-based APIs, SOAP-based APIs, WebSocket APIs, OData APIs, and GraphQL APIs. This support enables organizations to leverage their current investments in SOAP-based APIs while adopting REST for new APIs. The API Gateway's SOAP to REST transformation feature enables an API provider to expose parts of the SOAP API or expose the complete SOAP API with RESTful interface. API Gateway allows you to customize the way the SOAP operations are exposed as REST resources.

API Gateway protects APIs from malicious attacks initiated by external client applications. Administrators can secure traffic between API consumer requests and the execution of services on API Gateway by filtering requests coming from particular IP addresses and blocklisting specified IP addresses, detecting and filtering requests coming from particular mobile devices.

API Gateway provides complete run-time governance of APIs. API Gateway enforces access tokens such as API key check, OAuth2 token and operational policies such as security policies for run-time requests between applications and native services. API providers can enforce security, traffic management, monitoring, and SLA management policies, can transform requests and responses into expected formats, and collect events metrics on API consumption and policy evaluation. API Policies can be defined globally and applied to a set of APIs. With API Gateway you can also define policy templates that can be applied across APIs.

API Gateway provides routing policies such as content-based, and conditional routing, for run-time requests between applications and native services. These policies perform routing and load balancing of incoming requests to an API.

API Gateway lets you configure an API and to transform the request and response messages to suit your requirements. To do this, you can specify an XSLT file to transform messages during the mediation process. You can also configure an API to invoke Integration Server services to pre-process or post-process the request or response messages.

API Gateway provides filter capabilities to quickly find APIs of interest. API descriptions and additional documentation, usage examples, and information about policies enforced at the API level provide more details to the developers that help them decide whether to adopt a particular API. Developers can use the provided samples and expected error and return codes to see how the API works.

Multiple instances of API Gateway can be clustered together to provide scalability and high availability.

API Gateway provides information about Gateway-specific events and API-specific events, details about which APIs are more popular than others. The Gateway-specific events information is available by way of dashboards to users. With this information, providers can understand how their APIs are being used, which in turn can help identify ways of improving their users' experience and increase API adoption.

API Gateway provides capabilities to create and manage packages and plans. This helps the API providers in providing tiered access to their APIs to allow different service levels and pricing plans. Users can view the details of the package, such as included APIs and associated plans. Plans provide information about pricing and quality of service terms defined within them. Consumers can subscribe to any plan available under the package, based on their business needs.

API Gateway allows you to assign functional privileges to a user or group (LDAP or local) using teams. The functional privileges are grouped together to form an team, which is associated to a group. You must have a functional privilege assigned to perform any of the key API Gateway features.

API Gateway allows you to consolidate services and expose them as a single service. You can create API mashups that extend an API operation by grouping it with other API operations available in API Gateway.