API producers
Register ownership, submit OpenAPI contracts, resolve validation findings and promote approved versions through environments.
API lifecycle control
DevPortal
Turn API intent into governed, versioned and observable gateway delivery.
- OpenAPI-first
- Contract admission
- GitOps-native
- Auditable changes
- Gateway-aware
- Kong and Gloo
The product
One operating model for every API change.
DevPortal gives producers, consumers and platform teams a shared workflow without collapsing their responsibilities into one service.
Every request is admitted against ownership, policy and gateway capabilities before it can create infrastructure change.
Shared platform, clear responsibilities
Every team sees the same delivery, from its own point of view.
DevPortal coordinates the API lifecycle without turning governance into a central bottleneck.
Design to publication
API consumers
Discover available APIs, register applications, request subscriptions and follow access decisions without opening infrastructure tickets.
Platform teams
Define policies, qualify gateway capabilities, supervise reconciliation and retain evidence for every production change.
Lifecycle
Intent becomes evidence.
Each stage produces a durable result that can be inspected, approved and replayed.
- 01
Define
OpenAPI contract, exposure target and policy intent.
- 02
Validate
Ownership, semantics, secret references and provider capabilities.
- 03
Approve
Policy gates and production decisions remain explicit.
- 04
Deliver
Versioned manifests flow through GitLab and Argo CD.
- 05
Operate
Health, drift, events and rollback stay observable.
Product capabilities
A control surface for the complete API lifecycle.
Human workflows and automation use the same durable operations, policies and audit trail.
Contract governance
Validate OpenAPI structure, semantic rules, ownership metadata and organization-specific extensions before publication.
Publication management
Prepare, approve, publish, promote and roll back versioned APIs with an explicit history of every decision.
Consumer self-service
Manage applications, managed identities, subscriptions, credentials and access requests within tenant boundaries.
Gateway lifecycle
Preview compatibility, provision or adopt instances, assign zones and decommission infrastructure deliberately.
GitOps execution
Materialize desired state in GitLab, reconcile it with Argo CD and expose the resulting resources and revisions.
Operational evidence
Inspect operation steps, events, health and drift in a human view, with JSON and YAML available when needed.
Composable architecture
Deploy only the control planes you need.
Portal API
The product and consumer control plane.
- Application and managed identity registration
- API validation, publication, promotion and rollback
- Subscriptions, credentials and policy waivers
- Durable Operations and audit evidence
Portal Operator
The gateway fleet control plane.
- Compatibility preview before provisioning
- Gateway deployment or adoption
- GitOps reconciliation and drift inspection
- Zone-level lifecycle and decommissioning
Independent by design. Portal API remains useful without gateway provisioning. Portal Operator can be introduced when the platform is ready to manage gateway instances.
Provider-aware delivery
A portable intent, a faithful target.
CapabilityKongGloo Gateway
RoutingGateway API and Kong resourcesGateway API and Gloo policies
Traffic policyOSS and Enterprise-aware pluginsTrafficPolicy materialization
ProvisioningDeploy or adopt Kong instancesDeploy or adopt Gloo instances
SafetyReject unsupported semanticsReject unsupported semantics
Fits the platform you operate
Integrate the lifecycle instead of replacing your toolchain.
DevPortal connects identity, source control, delivery and runtime concerns through explicit boundaries. Each integration remains observable and replaceable.
OpenAPIPortable source of API intent
KeycloakAuthentication, tenants and roles
GitLabVersioned change and approval
Argo CDReconciliation and deployment health
KubernetesDeclarative runtime resources
Kong or GlooProvider-specific gateway outcomes
Operational outcomes
Built for change, recovery and proof.
Version every publication
Restore a known successful API version without reconstructing intent.
See execution, not just status
Follow validation, merge requests, resources, reconciliation and events.
Keep secrets out of contracts
Use managed references while Keycloak enforces tenant-aware access.
Adopt progressively
Start with governance. Add infrastructure control when it creates value.
Portal API
Govern products and consumer access
Use contract admission, publication, applications and subscriptions while existing platform processes continue to provision gateways.
- OpenAPI catalog and version history
- Policy-driven publication workflow
- Applications, credentials and subscriptions
- Operations and audit trail
Portal API + Portal Operator
Extend governance to gateway fleets
Add instance provisioning, adoption, zone assignment and GitOps reconciliation without changing the producer or consumer experience.
- Everything in Portal API
- Gateway capability qualification
- Instance and zone lifecycle
- Drift visibility and controlled decommissioning
Frequently asked
Practical answers before adoption.
Does DevPortal replace an API gateway?
No. It governs API intent and delivery while Kong or Gloo Gateway remains responsible for runtime traffic.
Can Portal API run without Portal Operator?
Yes. Product governance, publication and consumer self-service remain available independently. Operator capabilities can be introduced later.
How are unsupported provider features handled?
Compatibility is evaluated before infrastructure change. Unsupported semantics are rejected explicitly instead of being silently ignored.
Can a publication be rolled back?
Yes. Publications are versioned so operators can restore a known successful state with its associated evidence.
Where are credentials and secrets stored?
Contracts contain managed references rather than secret values. Access is constrained by Keycloak roles and tenant boundaries.
A controlled path to production