<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Gateway Security Architecture — API Reference

## agent.js CLI

```bash
# Analyze API surface from OpenAPI spec
node scripts/agent.js --action analyze --openapi openapi.json

# Generate gateway security policies
node scripts/agent.js --action policies --openapi openapi.json --output gw-policies.json

# Validate security posture
node scripts/agent.js --action validate --policies gw-policies.json

# Generate rate limit configuration
node scripts/agent.js --action ratelimit --endpoints endpoints.json --output limits.json
```

## Gateway Policy JSON Schema

```json
{
  "endpoint": "GET /api/v1/users",
  "authentication": {
    "type": "oauth2",
    "jwks_uri": "https://idp.example.com/.well-known/jwks.json",
    "audience": "https://api.example.com"
  },
  "rate_limit": {
    "requests_per_minute": 600,
    "burst": 1000,
    "key": "oauth2_client_id"
  },
  "threat_protection": {
    "sql_injection": true,
    "xss": true,
    "xxe": false,
    "path_traversal": true
  }
}
```

## Security Headers Applied

| Header | Value |
|--------|-------|
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | DENY |
| Content-Security-Policy | default-src 'none' |
| Cache-Control | no-store |
