Every piece a translation layer needs. Nothing it doesn't.
REST↔SOAP. gRPC↔REST. JSON↔XML. Route chains, canary rollouts, the Cloud Connector, in three deployments, one codebase.
Any protocol in.
Any protocol out.
trAPIoka speaks five protocols natively, in both directions. A REST caller can reach a SOAP service. A GraphQL client can fan out to gRPC. The route defines which goes where, neither end knows the other exists.
- WSDL imported and indexed automatically, operations exposed as REST paths
- gRPC reflection or .proto descriptors picked up on startup
- GraphQL queries resolved across multiple typed backends
- JSON-RPC bridged to and from any of the above
| in ↓ out → | REST | gRPC | SOAP | GraphQL | JSON-RPC | SSH single-shot | SSH interactive | SQL | Mongo | PowerShell |
|---|---|---|---|---|---|---|---|---|---|---|
| REST | ||||||||||
| gRPC | ||||||||||
| SOAP | ||||||||||
| GraphQL | ||||||||||
| JSON-RPC |
caller speaks →
// REST · the modern caller GET /v2/payments/482 Accept: application/json // response { "id": "482", "amount": 2400, "status": "posted" }
→ target hears
<!-- SOAP · the legacy core --> <soap:Envelope> <soap:Body> <GetPmt> <id>482</id> </GetPmt> </soap:Body> </soap:Envelope>
// transformations.lua · reusable, hot-reloadable function redact_pii(body) body.ssn = mask.last4(body.ssn) body.dob = nil body.email = redact.email(body.email) body.address.zip = body.address.zip:sub(1,3).."**" return body end function flatten_soap(xml) local r = xml.path("//GetPmtResponse/result") return { id = r.id, amount = tonumber(r.amount_cents) / 100, status = r.state:lower(), posted_at = iso8601(r.txn_ts) } end
Reshape, redact, validate, in flight.
Most transformations are declarative, rename, drop, retype, validate against a schema. For everything else, run a Lua or JavaScript function. Hot-reload in under five seconds, no restart, no traffic interruption.
- Format conversion: JSON ↔ XML ↔ Protobuf ↔ raw text, in any direction
- Schema validation against OpenAPI, XSD, or .proto before forwarding
- Parse free-form text (SSH output, mainframe records) into typed JSON
- Sandboxed scripting, no filesystem, no network egress, CPU-bounded
A WAF and an auth layer in one binary.
Block SQL injection, XSS, and your own threat signatures before they reach an upstream. Redact PII automatically on responses. Authenticate inbound and outbound, with totally different schemes, in the same route.
- Inbound auth: API key, JWT (any IdP), mTLS, OAuth2, basic, SigV4, custom
- Outbound auth: same set, freely mixed per upstream
- Threat signatures: OWASP CRS bundled, custom rules in YAML
- PII redaction: jsonpath, regex, or callout to your DLP service
# guard.yaml · applies to every upstream call timeout: connect: 500ms read: 2s total: 5s retry: max_attempts: 3 backoff: exponential jitter: "full" retry_on: [502, 503, 504, timeout, conn-reset] idempotency: auto # GET/HEAD/PUT/DELETE circuit_breaker: window: 60s error_threshold: 0.5 min_volume: 20 half_open_after: 30s fallback: on_circuit_open: strategy: cached-or-static ttl: 300s
Failure modes that fail well.
Every upstream call is wrapped in a configurable safety net. Retry with full jitter. Per-route circuit breakers. Fallback responses when the upstream is genuinely dead. Hard timeout enforcement at the gateway, the transformer, and the upstream client, not just one of them.
- Idempotency-aware retries, never duplicates a POST you didn't mark safe
- Hedged requests for latency-sensitive read paths
- Static, cached, or scripted fallbacks per route
- Breaker state visible in metrics, audit log, and the console
See every byte that changed, and why.
Every request is logged with its full transformation history. Diff the inbound payload against the outbound. Read the route version that handled it. Trace the upstream call by ID. Audit who changed the route last and when.
- OpenTelemetry traces and metrics, OTLP, Prometheus, Tempo, Jaeger
- Structured JSON logs with full diff payloads (PII redacted)
- SLA monitoring with breach detection and consumer notifications
- Tamper-evident audit log, SHA-256 hash chain, append-only at the DB layer
Deprecations that enforce themselves.
Mark a version deprecated. Set the sunset date. trAPIoka inserts a Deprecation header on every response, tracks which consumers are still calling, fires reminders on your schedule, and serves 410 GONE with a migration link at cutoff.
- Per-consumer migration tracking, by API key, JWT subject, or mTLS cert
- Reminders by webhook, email, Slack, or PagerDuty
- Soft cutoff (warning header) or hard cutoff (410 with redirect target)
- Migration assistants, replay v1 traffic against v2 to find behaviour drift
Beyond translation.
Route chains
One inbound request, many backends, one clean result. Validate, transform, fan out, recombine.
REST → SOAP + cache merge
each step individually observable
Canary deployments
Roll a version to a slice of traffic, watch the metrics, widen or roll back. No restart.
automatic rollback on SLA breach
per-route, per-version
Cloud Connector
Reach systems behind a firewall without opening one. Outbound-only agent, no inbound ports, no VPN.
named routes only, never the network
on-prem DB · mainframe · PLC
Same product. Three ways to run it.
The Sidecar binary, the SaaS platform, and the on-prem Helm chart all ship the same capability surface. Routes you write today are portable.