canonical: https://jentic.com/apis/gravitee.io/gravitee

# Gravitee API Management

Jentic publishes the only available OpenAPI specification for Gravitee API Management, keeping it validated and agent-ready. This spec exposes the core resources of a Gravitee tenant - APIs, applications, and subscriptions - through four endpoints that allow agents and tools to inspect what is published, which clients consume it, and the active subscription relationships between them. Authentication is a single API key passed in the Authorization header.

## For AI agents

Inspect the APIs, applications, and subscriptions in a Gravitee API Management tenant via four read-style endpoints.

## Scope

Does not proxy traffic, enforce policies, or generate analytics dashboards - use for inspecting APIs, applications, and subscriptions in a Gravitee tenant only.

## Capabilities

- List the APIs published in the Gravitee tenant via /apis
- Retrieve the metadata for a specific API by id via `/apis/{apiId}`
- List the applications registered against the tenant via /applications
- List the subscription relationships between APIs and applications via /subscriptions
- Audit which applications hold an active subscription to a given API
- Build a catalogue of internal APIs from a Gravitee tenant for agent discovery

## Use cases

### Internal API Catalogue Generation

Platform teams pull the list of APIs from /apis and the relationships from /subscriptions to publish an internal catalogue showing which downstream applications consume each API. The result feeds developer portals, ownership dashboards, and incident routing.

Example prompt: GET /apis to list all published APIs and for each one filter /subscriptions by apiId to enumerate consuming applications

### Subscription Audit and Compliance

Security and compliance teams audit /subscriptions to confirm that no orphaned applications retain access to APIs they should no longer call. The endpoint returns the active relationships, which the team cross-references against their authoritative ownership records.

Example prompt: List all subscriptions and flag any whose application owner is no longer present in the company directory

### Application-to-API Mapping for Incidents

When an upstream API degrades, on-call teams use the API id to filter /subscriptions and identify every consuming application so the right downstream owners can be paged. Combining /applications with /subscriptions gives a fast blast-radius view.

Example prompt: GET `/apis/{apiId}`, then enumerate /subscriptions filtered by that apiId and join with /applications to produce a list of consumer contacts

### Agent-Driven Platform Assistant via Jentic

An AI platform assistant uses Jentic to discover the right Gravitee operation when a developer asks 'who calls my API?' or 'which apps are registered?'. Jentic injects the API key from the vault and returns structured Gravitee data the agent can summarise.

Example prompt: Search Jentic for 'list gravitee subscriptions', load the schema, and execute /subscriptions to summarize active consumers per API

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/apis` | List published APIs |
| GET | `/apis/{apiId}` | Retrieve a specific API by id |
| GET | `/applications` | List registered applications |
| GET | `/subscriptions` | List active subscriptions |

## Key resources

- **APIs** — List published APIs and read individual API metadata
- **Applications** — List applications registered in the Gravitee tenant
- **Subscriptions** — List the active subscription relationships between APIs and applications

## Why Jentic

- **Setup:** Wiring Gravitee API Management by hand means carrying its API key in the Authorization header and wiring the apis, applications, and subscriptions endpoints for your tenant yourself. Through Jentic you install once, import Gravitee API Management from the API Directory, store the API key once, and your agent calls it.
- **Permission scoping:** Gravitee puts the API id in the URL path (`/apis/{apiId}`), so a rule can pin your agent to inspecting one API: it can read that API and its related subscriptions and nothing else. You choose the operations it may call, so it stays within the inspection reads you allow and nothing more.
- **Credential handling:** Your Gravitee API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list APIs in the tenant' or 'check an application's subscriptions', and Jentic returns the matching Gravitee operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Tyk Gateway API** — Open-source API gateway with management API for the same problem space
- **Outlook Calendar** — Schedule platform-team reviews after a Gravitee subscription audit
- **Graylog** — Centralized log search to investigate API consumer behaviour discovered via Gravitee

## FAQ

### Why is there no official OpenAPI spec for Gravitee API Management?

Gravitee does not publish a single OpenAPI specification covering this surface. Jentic generates and maintains this spec so that AI agents and developers can call Gravitee API Management via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Gravitee API Management API use?

The endpoints in this spec accept an API key in the Authorization header. Through Jentic the API key is stored encrypted in the vault and injected on each request, so the agent never holds the raw key in its prompt or memory.

### Can I find every application that consumes a specific API?

Yes. Call GET `/apis/{apiId}` to confirm the API exists, then GET /subscriptions filtered by that apiId. The response lists active subscriptions, each one tying a Gravitee application to the API. Cross-reference against /applications to enrich the consumer with ownership metadata.

### What are the rate limits for the Gravitee API Management API?

Gravitee API Management is typically self-hosted or run on Gravitee Cloud, so the rate limits depend on the tenant's configuration. The four endpoints in this spec are designed for inspection rather than high-throughput data movement; use the webhook and event subscription mechanisms in Gravitee for change-driven flows.

### How do I list published APIs through Jentic?

Search Jentic for 'list gravitee apis', load the operation that maps to GET /apis, and execute it. The response is the array of published APIs in the tenant which the agent can summarise or feed into a catalogue generator.

### Does this API support creating new applications or subscriptions?

The four endpoints in this spec are read-style operations against /apis, `/apis/{apiId}`, /applications, and /subscriptions. Creating applications, plans, or subscriptions in Gravitee is typically done through the management console or the broader Gravitee management API. Confirm with the platform team whether your tenant exposes those write paths via the same gateway.

### Can I limit what my agent is allowed to do with the Gravitee API Management API?

Yes. Jentic One runs self-hosted, so you set the rules that decide which Gravitee operations and credentials your agent may use. Because Gravitee puts the API id in the URL path (`/apis/{apiId}`), you can pin the agent to inspecting a single API and its subscriptions, or grant only the read operations you choose across /apis, /applications, and /subscriptions. Your Gravitee API key stays with your own instance and is injected at execution time, so the agent never sees the raw key and can never call an operation you did not allow.