Self-hosted

The hosted service is the same gateway we ship as a container. Teams whose security review ends with "traffic does not leave the network" run the data plane themselves; the console, drift dashboards and alerting stay hosted, fed only by the fingerprint stream described in What leaves your network.

The whole gateway is a file:

# apip.ymlspec:     openapi.jsonupstream: https://api.internal:8443mode:     observe            # record drift; enforce rejects itlisten  - port: 443    tls_cert: /etc/apip/tls.crt    tls_key:  /etc/apip/tls.key  - port: 80    redirect_https: 443

And a handful of commands:

apip check apip.yml    # config, spec compile, upstream reachable
apip run   apip.yml
apip explain GET /orders/{id}   # what will be checked, and what happens if it fails
apip tail --violations          # the live drift feed, as it happens

apip check is designed to be a CI gate: it exits non-zero on an invalid config key, a spec that does not compile, or an unreachable upstream - each with a message naming the fix - so a broken contract fails the deploy instead of the traffic.

apip explain answers the question people actually ask before turning enforce on: for this operation, what is checked, and what happens to a request that fails it.

These four are about a gateway you are running and need no account. The commands that talk to your account - apip proxies, apip specs, apip env, apip violations, apip alert - need a token, and are described in The API and the CLI.

Secrets in the config are references, never literals: { $env: KEY } reads the environment, { $file: path } reads a mounted secret. The resolved values are redacted from every place the config might be printed.

Reporting, and turning it off

A self-hosted gateway ships drift to the hosted console with one stanza:

report  url:   https://openapi-proxy.com/ingest/violations  token: { $env: APIP_REPORT_TOKEN  environment: production      # which contract this deployment is held to

Leave the block out and nothing leaves at all: the gateway still aggregates in-process, apip tail still shows you the feed, and the drift report is yours alone inside your walls. What you lose is the console - history, rates, alerts and the version diff all live where the data is.

environment does two things at once: it labels every violation this deployment reports, and it selects which environment's version this gateway serves. One name, so the two can never disagree.

Batches are aggregated, gzipped, and spooled to disk when the control plane is unreachable, then replayed when it comes back. Replays are recognised and counted once - the pipeline's own retry cannot look like your traffic getting worse.

The honest trade

Self-hosting is on the Business plan, and it is the answer to a real constraint, not an upsell: TLS keys stay in your network, bodies never leave it, and our outage cannot touch your traffic because we are not in its path. What you give up is us operating it - upgrades, capacity and the on-call are yours.