An API gateway (Kong, AWS API Gateway, Azure APIM, Apigee, Nginx, Traefik) sits in front of all backend services. Every external request goes through the gateway. The gateway enforces: authentication (valid token required), rate limiting (per consumer), routing (only to registered services/versions), logging (all requests centrally logged), and policy (WAF rules, CORS headers, TLS).
A properly configured API gateway makes inventory management tractable: the gateway’s registered routes are the inventory. A service that isn’t registered with the gateway can’t be reached from the internet. The gateway becomes the authoritative source of truth for what’s accessible — and discovery scanning compares live traffic and gateway registrations to catch anything that bypasses it.
Ask your architecture team whether all external API traffic flows through a single gateway. If individual backend services can be reached directly from the internet without going through the gateway, your security controls have blind spots.