Governed API Gateway — The Platform as Governed APIs

The whole platform, as governed APIs.

Everything Prove7 does — agents, workflows, trust, policy, evidence — is a full-fledged, OpenAPI-documented API. The Governed API Gateway puts one default-deny plane in front of all of it: scoped credentials, distributed rate limits, quotas, entitlements, and a sealed audit line per call.

How it fits your estate

Your applications, scripts, portals, and partners drive the platform programmatically. Nothing is reachable by default; everything callable is scoped, limited, metered — and on the record.

Default-deny: every route is classified by exposure tier; only customer-tier, scoped, entitled routes answer. Same plane, same record, whether the caller is your portal or your partner.

API protection that reads like a spec sheet

Default-deny, tiered exposure. Every endpoint carries an exposure tier; admin surfaces are issuance-forbidden on customer credentials. What you can’t call doesn’t exist for you.
Two credential styles. Typed, resource-scoped API keys (create, rotate with grace windows, suspend, revoke — shown once, stored hashed) or OAuth2 client-credentials over the same keys, with narrowing-only token scopes.
Distributed rate limiting. Token-bucket RPM with burst headroom plus daily quotas — enforced fleet-wide, not per node, with honest 429s and retry headers.
Entitlement-aware. API access follows your edition and per-route module entitlements; READ_ONLY mode caps every credential for evaluation estates.
Metered and billable. Per-tenant request metering feeds pre-committed or usage-based billing — the same meter your invoice reads.
Documented like a product. Full OpenAPI/Swagger reference, stable error contracts, and governance verdicts in the response envelope — the developer surface our category conspicuously lacks elsewhere.

Frequently asked

What is the Governed API Gateway?

It is the single governed entry plane for the entire Prove7 platform API surface: every capability — agents, workflows, trust scores, policies, evidence — is exposed as OpenAPI-documented endpoints behind default-deny authentication, scoped keys or OAuth2, distributed rate limits, quotas, and per-call sealed auditing.

How is this different from the MCP Gateway + SDK?

The MCP Gateway and SDK govern your agents’ executions — they bring outside agents under governance. The Governed API Gateway exposes Prove7 itself as APIs, so your applications, scripts, and partners can drive the platform programmatically with API-grade protection and limits.

How are API rate limits enforced?

With a distributed token-bucket per credential: requests-per-minute with burst headroom plus a daily quota, enforced consistently across the whole fleet. Exceeding a limit returns a clean 429 with retry headers — and the event is recorded like everything else.

Accountable Autonomy™ — answers as it acts.

See it govern an agent end-to-end in 30 minutes.

If you’re the one who answers when the machine acts — a CISO, a CFO, a COO — watch Prove7 Control Vector™ take an agent from discovered to governed to proven, live.

Schedule a Demo →