canonical: https://jentic.com/apis/broadcom.com/broadcom

# Broadcom Layer7 API Gateway Management API

Jentic publishes the only available OpenAPI specification for Broadcom Layer7 API Gateway Management API, keeping it validated and agent-ready. The Layer7 RESTMAN API exposes the gateway's configuration plane so platform engineers can manage published services, policies, cluster-wide properties, trusted certificates, JDBC connections, encapsulated assertions, identity providers, and folder structures without using the GUI. It also supports bundle import and export, making it the foundation for promoting gateway configuration between dev, staging, and production environments via CI/CD.

## For AI agents

Manage published services, policies, certificates, and cluster properties on a Broadcom Layer7 API Gateway. Useful for platform engineers automating gateway configuration and CI/CD promotion of policy bundles.

## Scope

Does not handle runtime API traffic, log analytics, or developer-portal management - use for Layer7 gateway configuration management only.

## Capabilities

- Publish and update services on the gateway, including their backend URLs and resolution paths
- Author and version policies that gate inbound traffic with authentication, throttling, and transformation rules
- Set cluster-wide properties to configure gateway behaviour across all nodes in a cluster
- Import and export configuration bundles to promote services and policies between environments
- Trust new CA certificates on the gateway for mutual TLS to upstream services
- Register JDBC connections so policies can query backend databases as part of routing decisions
- Define encapsulated assertions to package reusable policy fragments shared across services

## Use cases

### CI/CD Promotion of Gateway Configuration

Platform teams treat their Layer7 gateway configuration as code by exporting bundles from a lower environment via GET /bundle and importing them into the next environment via PUT /bundle. The agent diffs the exported XML, opens a pull request for review, and on merge replays the bundle into staging and then production. This eliminates GUI clickops and gives every gateway change an audit trail.

Example prompt: GET /bundle from the staging gateway, store the XML, then PUT /bundle to the production gateway to promote the configuration

### Automated Service Onboarding

When a new microservice is ready to expose externally, the agent calls POST /services with the service definition, attaches a standard policy template via POST /policies, and registers the routing path. New services get the team's baseline auth, rate limiting, and logging policies applied automatically - no GUI work required and no risk of inconsistent configuration between teams.

Example prompt: POST /services with the service name, resolution path, and backend URL for a new microservice, then POST /policies to attach the standard auth policy

### Certificate Rotation

Security teams rotate trusted CA certificates regularly to satisfy compliance and to handle backend services moving to new issuers. The agent uploads the new certificate via POST /trustedCertificates, validates that services depending on the issuer still authenticate, and deletes the previous certificate via DELETE `/trustedCertificates/{certId}.` This makes rotation a scripted, repeatable operation instead of a manual GUI task.

Example prompt: POST /trustedCertificates with the new CA certificate PEM, verify dependent services still pass mutual TLS, then DELETE `/trustedCertificates/{old-cert-id}`

### AI Platform Engineering Agent Through Jentic

An AI platform engineer agent uses Jentic to drive the Layer7 gateway during runbook execution without holding the gateway admin password. The agent searches for 'publish a service on the API gateway', loads the RESTMAN schema, and executes the call. Because Layer7 RESTMAN uses HTTP basic auth, isolating the credential in Jentic's vault is particularly valuable.

Example prompt: Use Jentic to search 'publish a service on the Layer7 gateway', load the broadcom.com operation, and execute it for a new internal service

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/services` | List published gateway services |
| POST | `/services` | Publish a new service on the gateway |
| PUT | `/services/{serviceId}` | Update a service definition |
| POST | `/policies` | Create a new policy |
| GET | `/bundle` | Export a configuration bundle |
| PUT | `/bundle` | Import a configuration bundle |
| POST | `/trustedCertificates` | Add a trusted certificate |
| POST | `/clusterProperties` | Create a cluster-wide property |

## Key resources

- **Services** — Published gateway services and their resolution paths
- **Policies** — XML policy fragments that govern service behaviour
- **Cluster Properties** — Gateway-wide configuration values
- **Trusted Certificates** — CA and server certificates trusted by the gateway
- **JDBC Connections** — Database connections available to policies
- **Encapsulated Assertions** — Reusable policy fragments shared across services
- **Bundle** — Import and export of full configuration sets

## Why Jentic

- **Setup:** Wiring the Broadcom Layer7 RESTMAN API by hand means supplying basic-auth admin credentials, targeting the right gateway host on port 8443, and threading service, policy, and bundle ids through the management paths yourself. Through Jentic you install once, import the Layer7 API Gateway Management API from the API Directory, store the credentials once, and your agent calls it.
- **Permission scoping:** RESTMAN puts the service id in the URL path (`/services/{serviceId}`), so a rule can pin your agent to one gateway service: it can read and update that service and nothing else. You choose the operations it may call, so writes like importing a configuration bundle or adding trusted certificates are not included unless you add them.
- **Credential handling:** Your Layer7 gateway admin username and password are stored once, encrypted, by your own Jentic One instance and injected as the basic-auth header at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'publish a service on the API gateway' or 'import a configuration bundle', and Jentic returns the matching RESTMAN operation with its parameter schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Tyk Gateway** — Open-source API gateway with a REST management API
- **Apigee API Registry** — Google Apigee's API and gateway registry
- **WSO2 Identity Server** — Open-source identity provider with SCIM and OAuth APIs

## FAQ

### Why is there no official OpenAPI spec for Broadcom Layer7 API Gateway Management API?

Broadcom does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Broadcom Layer7 API Gateway Management API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Layer7 RESTMAN API use?

RESTMAN uses HTTP basic authentication with a gateway admin user. Through Jentic, the username and password are stored encrypted in your Jentic One instance and the agent receives a scoped execution token, so the raw credentials never enter agent prompts.

### Can I import a configuration bundle through the API?

Yes. PUT /bundle accepts an XML configuration bundle and applies it to the gateway. Combined with GET /bundle to export, this is how teams promote services, policies, and cluster properties between dev, staging, and production gateways without GUI clicks.

### How do I publish a new service through Jentic?

Search Jentic for 'publish a service on the Layer7 gateway', load the broadcom.com Layer7 schema, and call POST /services with the service definition and resolution path. Then call POST /policies to attach the policy XML that should govern the service.

### What are the rate limits for the Layer7 RESTMAN API?

RESTMAN runs on the gateway itself, so there is no vendor-imposed rate limit - capacity is bound only by the gateway's hardware sizing. For bulk operations, prefer bundle import/export over many small calls so the gateway does not have to recompile policies repeatedly.

### Does Layer7 RESTMAN cover runtime traffic?

No. RESTMAN is the management plane only. It configures services, policies, certificates, and cluster properties; runtime API traffic still flows through the gateway's data plane on its published listeners. Use RESTMAN to deploy or rotate configuration, not to serve client requests.

### Can I limit what my agent is allowed to do with the Broadcom Layer7 API Gateway Management API?

Yes. Jentic One is self-hosted by you, so your own rules decide which RESTMAN operations and credentials the agent may use. Because the service id sits in the URL path (`/services/{serviceId}`), a rule can pin the agent to a single gateway service so it only reads and updates that one service and nothing else. You choose the operations it may call, so writes like importing a configuration bundle via PUT /bundle or adding trusted certificates via POST /trustedCertificates stay off limits unless you explicitly grant them.