Capabilities ApexAI Causeway
Capability · AI-native API gateway
One governed door for APIs, AI and agents.
Your applications talk through APIs, your teams call AI models, and AI agents now call tools on their own. Each of these is a door into your business. ApexAI Causeway brings them under one gateway with one policy, one audit trail and the Autonomous SOC behind it.
Status: In development ApexAI Causeway is being built and offered as early access; its architecture and open-source supply-chain review are complete, and the capabilities below are not yet generally available.
Three kinds of traffic, one door
Most organisations protect API traffic, AI traffic and agent traffic with different products, or not at all. An API gateway routes requests, a separate tool watches for API abuse, prompts to AI models go straight out from each application, and AI agents call internal tools through whatever connection was quickest to build. Every one of those paths has its own rules, its own logs and its own blind spots.
ApexAI Causeway is designed as one door for all of it, inbound and outbound. Requests from customers, partners and AI agents come in through it; calls from your systems out to AI models and outside services leave through it. One policy decides who may call what, sensitive data is protected on the way, and every call becomes evidence the Autonomous SOC can reason about.
What Causeway is built to do
API gateway and management
Routing, authentication, rate limits and a catalogue of your APIs with owners, versions and policies, managed in one place with history and rollback.
API security
Controls aligned with the OWASP API Security Top 10, from broken object-level authorisation to unsafe consumption of third-party APIs, with schema-based positive security.
API discovery
Endpoints that carry traffic but are missing from the catalogue are found and proposed for registration, so shadow and forgotten APIs come to light.
AI and prompt protection
Calls to AI models go through one scoped door, with ApexAI Parley Guard checking prompts for injection and sensitive data kept out of what leaves.
Protection for AI agents and tools
Tool servers are registered with an owner and an approved list of tools; agents get only the tools in their scope, and a changed tool waits for approval.
At your site
The same gateway can run on-premises, connecting outward only, and keep working on its last known good configuration if the link drops.
What travels through Causeway
| Traffic | Direction | What the gateway adds |
|---|---|---|
| Customer and partner APIs | Inbound | Authentication, schema checks, abuse limits, field protection, audit |
| AI model calls | Outbound | Model choice by policy, prompt checks, sensitive data kept in, cost limits |
| AI agents and MCP tools | Both | Tool registry, per-agent scope, short-lived scoped credentials, audit of every call |
| Calls to outside services | Outbound | Allow-listed destinations, response checks, one place to count and limit |
Built to be trusted
- Built on a high-performance Rust gateway, so security does not have to cost the latency your users notice.
- Post-quantum ready: designed for hybrid post-quantum transport and post-quantum signed configuration as these are verified.
- Configuration is published by version and can be rolled back to the previous one in a single step.
- Prompt and response content is not stored by default; only what is needed for audit is kept, masked.
- Gateway responses such as tightening a limit or blocking a client go through ApexAI Drawbridge: proposed first, approved by a person, time-limited and reversible.
- Every call through the gateway is evidence for the Autonomous SOC, joined to the same entities as your EDR and SIEM data.
Questions
What is an AI-native API gateway?
It is a gateway that treats AI model calls and AI agent tool calls as first-class traffic, next to ordinary APIs, with security, policy and audit for all three, and with an AI security platform that learns from the traffic behind it.
Does Causeway replace our API gateway or WAF?
It is designed to take over the API gateway role and add API, AI and agent security on top. How it fits next to your existing tools is decided with you during early access.
Can it run in our own data centre?
Yes, that is part of the design: the same gateway runs at your site, connects outward only and keeps working if the connection to ApexAI is lost.
When will it be available?
It is in development now and offered as early access. Ask us for a demo to discuss timing and your use cases.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.