API Domain

The API domain manages the full lifecycle of APIs within the Control Plane — from registration through exposure to subscription. It acts as an abstraction layer above the Gateway domain, handling the business logic of who can access which APIs and under what conditions.

Custom Resources

Api

Api is the Schema for the apis API

Group: api.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ApiSpec

Appears in: Api

ApiSpec defines the desired state of Api

Field	Type	Default	Validation
basePath	string	—	Required
category	string	—	Required
oauth2Scopes	string[]	—	Optional
specification	string	—	Optional
version	string	—	Required
xVendor	boolean	—	Required

ApiStatus

Appears in: Api

ApiStatus defines the observed state of Api

Field	Type	Default	Validation
active	boolean	—	Required
conditions	Condition[]	—	Optional

Condition

Appears in: ApiStatus, ApiCategoryStatus, ApiExposureStatus, ApiSubscriptionStatus, RemoteApiSubscriptionStatus

Field	Type	Default	Validation
lastTransitionTime	string	—	Required, Format: date-time
message	string	—	Required, maxLength: 32768
observedGeneration	integer	—	Optional, Format: int64, minimum: 0
reason	string	—	Required, minLength: 1, maxLength: 1024, pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
status	string	—	Required, Enum: True \| False \| Unknown
type	string	—	Required, maxLength: 316, pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

ApiCategory

ApiCategory is the Schema for the apicategories API

Group: api.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ApiCategorySpec

Appears in: ApiCategory

spec defines the desired state of ApiCategory

Field	Type	Default	Validation
active	boolean	—	Optional
allowTeams	AllowTeams	—	Optional
description	string	—	Optional, maxLength: 256
labelValue	string	—	Required, minLength: 1, maxLength: 20
linting	Linting	—	Optional
mustHaveGroupPrefix	boolean	true	Optional

AllowTeams

Appears in: ApiCategorySpec

Field	Type	Default	Validation
categories	string[]	—	Optional
names	string[]	—	Optional

Linting

Appears in: ApiCategorySpec

Linting configures OAS specification linting for APIs in this category.

Field	Type	Default	Validation
mode	string	Block	Optional, Enum: Block \| Warn \| None
ruleset	string	—	Required
whitelistedBasepaths	string[]	—	Optional

ApiCategoryStatus

Appears in: ApiCategory

status defines the observed state of ApiCategory

Field	Type	Default	Validation
conditions	Condition[]	—	Optional

ApiExposure

ApiExposure is the Schema for the apiexposures API

Group: api.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ApiExposureSpec

Appears in: ApiExposure

ApiExposureSpec defines the desired state of ApiExposure

Field	Type	Default	Validation
apiBasePath	string	—	Required
approval	Approval	—	Required
security	Security	—	Optional
traffic	Traffic	—	Required
transformation	Transformation	—	Optional
upstreams	Upstream[]	—	Required
visibility	string	—	Required, Enum: World \| Zone \| Enterprise
zone	Zones	—	Required

Approval

Appears in: ApiExposureSpec

Field	Type	Default	Validation
strategy	string	Simple	Required, Enum: Auto \| Simple \| FourEyes
trustedTeams	string[]	—	Optional, minItems: 0, maxItems: 10

Security

Appears in: ApiExposureSpec

Security defines the security configuration for the Rover Security is optional, but if provided, exactly one of m2m or h2m must be set

Field	Type	Default	Validation
m2m	M2M	—	Optional

M2M

Appears in: Security

M2M defines machine-to-machine authentication configuration

Field	Type	Default	Validation
basic	Basic	—	Optional
claims	Claims	—	Optional
externalIDP	ExternalIDP	—	Optional
scopes	string[]	—	Optional, maxItems: 100

Basic

Appears in: M2M, ExternalIDP, ApiSubscriptionM2M

Basic defines basic authentication configuration

Field	Type	Default	Validation
password	string	—	Required, minLength: 1
username	string	—	Required, minLength: 1

Claims

Appears in: M2M

Claims defines token claims that must be present in the token reaching the upstream. Only valid on the platform-managed LMS token.

Field	Type	Default	Validation
aud	Aud	—	Optional

Aud

Appears in: Claims

Aud defines the audience claim

Field	Type	Default	Validation
value	string	—	Optional, minLength: 1, maxLength: 256
valueFrom	string	—	Optional, Enum: ProviderClientId \| ConsumerClientId \| BasePath

ExternalIDP

Appears in: M2M

ExternalIDP defines external identity provider configuration

Field	Type	Default	Validation
basic	Basic	—	Optional
client	Client	—	Optional
grantType	string	—	Required, Enum: client_credentials \| authorization_code \| password \| refresh_token
tokenEndpoint	string	—	Required, Format: uri
tokenRequest	string	—	Required, Enum: client_secret_basic \| client_secret_post

Client

Appears in: ExternalIDP, ApiSubscriptionM2M

Client defines client credentials for the OAuth2 token request

Field	Type	Default	Validation
clientId	string	—	Required, minLength: 1
clientKey	string	—	Optional
clientSecret	string	—	Optional
refreshToken	string	—	Optional

Traffic

Appears in: ApiExposureSpec

Field	Type	Default	Validation
circuitBreaker	CircuitBreaker	—	Optional
failover	Failover	—	Optional
rateLimit	RateLimit	—	Optional

CircuitBreaker

Appears in: Traffic, ApiSubscriptionTraffic

CircuitBreaker defines the Kong circuit breaker configuration

Field	Type	Default	Validation
enabled	boolean	—	Optional

Failover

Appears in: Traffic

Failover defines the failover configuration for the API exposure.

Field	Type	Default	Validation
zones	Zones[]	—	Optional

Zones

Appears in: Failover, ApiExposureSpec, ApiExposureStatus, Requestor, ApiSubscriptionSpec, ApiSubscriptionStatus, RemoteApiSubscriptionStatus

Zones defines the list of zones that are eligible for failover. If empty, the Provider failover feature is disabled.

Field	Type	Default	Validation
name	string	—	Required
namespace	string	—	Required
uid	string	—	Optional

RateLimit

Appears in: Traffic

RateLimit defines request rate limiting for this API

Field	Type	Default	Validation
provider	Provider	—	Optional
subscriberRateLimit	SubscriberRateLimit	—	Optional

Provider

Appears in: RateLimit

Provider defines request rate limiting for this API

Field	Type	Default	Validation
limits	Limits	—	Required
options	RateLimitOptions	—	Optional

Limits

Appears in: Provider, Default, Overrides

Limits defines the actual rate limit values for different time windows

Field	Type	Default	Validation
hour	integer	—	Optional, minimum: 0
minute	integer	—	Optional, minimum: 0
second	integer	—	Optional, minimum: 0

RateLimitOptions

Appears in: Provider

RateLimitOptions defines additional configuration options for rate limiting

Field	Type	Default	Validation
faultTolerant	boolean	true	Optional
hideClientHeaders	boolean	false	Optional

SubscriberRateLimit

Appears in: RateLimit

SubscriberRateLimit defines request rate limiting for this API per subscriber

Field	Type	Default	Validation
default	Default	—	Optional
overrides	Overrides[]	—	Optional, maxItems: 10

Default

Appears in: SubscriberRateLimit

Default defines the rate limit applied to all consumers not specifically overridden

Field	Type	Default	Validation
limits	Limits	—	Required

Overrides

Appears in: SubscriberRateLimit

Overrides defines consumer-specific rate limits, keyed by consumer identifier

Field	Type	Default	Validation
limits	Limits	—	Required
subscriber	string	—	Required, minLength: 1

Transformation

Appears in: ApiExposureSpec

Transformation defines request/response transformations for an API This is shared object for both subscriptions and exposures

Field	Type	Default	Validation
request	Request	—	Optional

Request

Appears in: Transformation

Request defines transformations applied to incoming API requests

Field	Type	Default	Validation
headers	Headers	—	Optional

Headers

Appears in: Request

Headers defines HTTP header modifications for requests

Field	Type	Default	Validation
add	string[]	—	Optional, minItems: 1, maxItems: 5
remove	string[]	—	Optional, minItems: 1, maxItems: 5

Upstream

Appears in: ApiExposureSpec

Field	Type	Default	Validation
url	string	—	Required
weight	integer	—	Optional

ApiExposureStatus

Appears in: ApiExposure

ApiExposureStatus defines the observed state of ApiExposure

Field	Type	Default	Validation
active	boolean	—	Required
conditions	Condition[]	—	Optional
failoverRoutes	Zones[]	—	Optional
proxyRoutes	Zones[]	—	Optional
route	Zones	—	Optional

ApiSubscription

ApiSubscription is the Schema for the apisubscriptions API

Group: api.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ApiSubscriptionSpec

Appears in: ApiSubscription

ApiSubscriptionSpec defines the desired state of ApiSubscription

Field	Type	Default	Validation
apiBasePath	string	—	Required
organization	string	—	Optional
requestor	Requestor	—	Required
security	SubscriberSecurity	—	Optional
traffic	ApiSubscriptionTraffic	—	Required
zone	Zones	—	Required

Requestor

Appears in: ApiSubscriptionSpec

Field	Type	Default	Validation
application	Zones	—	Required

SubscriberSecurity

Appears in: ApiSubscriptionSpec, RemoteApiSubscriptionSpec

SubscriberSecurity defines the security configuration for the Rover SubscriberSecurity is optional, but if provided, exactly one of m2m or h2m must be set

Field	Type	Default	Validation
m2m	ApiSubscriptionM2M	—	Optional

ApiSubscriptionM2M

Appears in: SubscriberSecurity

M2M defines machine-to-machine authentication configuration

Field	Type	Default	Validation
basic	Basic	—	Optional
client	Client	—	Optional
scopes	string[]	—	Optional, maxItems: 100

ApiSubscriptionTraffic

Appears in: ApiSubscriptionSpec

Field	Type	Default	Validation
failover	CircuitBreaker	—	Optional

ApiSubscriptionStatus

Appears in: ApiSubscription

ApiSubscriptionStatus defines the observed state of ApiSubscription

Field	Type	Default	Validation
activeScopes	string[]	—	Optional
approval	Zones	—	Optional
approvalRequest	Zones	—	Optional
conditions	Condition[]	—	Optional
consumeRoute	Zones	—	Optional
failoverConsumeRoutes	Zones[]	—	Optional
failoverRoutes	Zones[]	—	Optional
gatewayUrl	string	—	Optional
idpIssuer	string	—	Optional
remoteApiSubscription	Zones	—	Optional
route	Zones	—	Optional

RemoteApiSubscription

RemoteApiSubscription is the Schema for the remoteapisubscriptions API

Group: api.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

RemoteApiSubscriptionSpec

Appears in: RemoteApiSubscription

RemoteApiSubscriptionSpec defines the desired state of RemoteApiSubscription

Field	Type	Default	Validation
apiBasePath	string	—	Required
requester	Requester	—	Required
security	SubscriberSecurity	—	Optional
sourceOrganization	string	—	Optional
targetOrganization	string	—	Required

Requester

Appears in: RemoteApiSubscriptionSpec

Requester is the entity that is requesting the subscription

Field	Type	Default	Validation
application	string	—	Required
team	Team	—	Required

Team

Appears in: Requester

Team is the team that is requesting the subscription

Field	Type	Default	Validation
email	string	—	Required
name	string	—	Required

RemoteApiSubscriptionStatus

Appears in: RemoteApiSubscription

RemoteApiSubscriptionStatus defines the observed state of RemoteApiSubscription

Field	Type	Default	Validation
apiSubscription	Zones	—	Optional
application	Zones	—	Optional
approval	RemoteApiSubscriptionApproval	—	Optional
approvalRequest	RemoteApiSubscriptionApproval	—	Optional
conditions	Condition[]	—	Optional
gatewayUrl	string	—	Required
route	Zones	—	Optional

RemoteApiSubscriptionApproval

Appears in: RemoteApiSubscriptionStatus

Field	Type	Default	Validation
approvalState	string	—	Required
message	string	—	Required

Reconciliation Flow

Rover file applied
    │
    ├──▶ Api created (registered)
    ├──▶ ApiExposure created (gateway route configured)
    │
    └──▶ ApiSubscription created (by subscribing team)
            │
            ├──▶ Approval created (if strategy ≠ auto)
            ├──▶ Approval granted
            └──▶ Gateway ConsumeRoute created (access granted)

Route Provisioning

When an ApiExposure is reconciled, the API operator provisions the gateway routes that make the API reachable — including across zone boundaries. It decides which routes to create based on where the API's subscribers live:

Route created	When	Created from
Primary route	Always — one per exposure, in the provider's zone	ApiExposure.Spec.Upstreams
Proxy route	For each zone that has a subscriber but is not the provider's zone	The subscriber's zone + the provider zone's gateway URL
Secondary route	For each provider failover zone (failover.zones)	A copy of the provider's upstreams, placed in the backup zone

A matching ConsumeRoute is then created for each approved subscription to grant the consumer access to the correct route (primary or proxy, depending on the consumer's zone).

For the meaning of each route type and how they forward traffic, see Gateway Domain: Route Types & Cross-Zone Meshing.

Subscription Readiness

An ApiSubscription reports Ready=False / PreconditionNotMet while the exposure is missing the required primary, provider-failover, or proxy route reference. This also clears a previously successful readiness condition.

After provisioning, local and remote subscriptions check condition-bearing resources created or updated during reconciliation for explicit Ready=False conditions. This includes the primary and any subscriber-failover ConsumeRoutes, and, where applicable, the ApprovalRequest, RemoteApiSubscription, and locally created proxy Route. An explicit child Ready=False keeps the subscription at Ready=False / SubResourceNotReady. Missing or unknown Ready conditions and child ObservedGeneration are not checked. Child status changes trigger reconciliation. Once the check passes, the subscription reports Ready=True / Provisioned.

Domain Interactions

• Rover domain — Creates Api, ApiExposure, and ApiSubscription resources.
• Gateway domain — The API operator creates Route (primary, proxy, secondary) and ConsumeRoute resources on the gateway.
• Admin domain — Zones provide the gateway URLs and identity issuers used to wire up cross-zone proxy and failover routes.
• Approval domain — Subscriptions trigger approval workflows.
• File Manager — OpenAPI specifications are stored and retrieved for API metadata.

Related Pages

• User Journey: Exposing APIs
• User Journey: Subscribing to APIs