Anypoint Platform supports three main policy enforcement models depending on runtime architecture and API placement:
1. Mule API Gatekeeper (Mule 4 Runtime)
In standard Mule 4 applications, the API Gateway component is built directly into the runtime engine:
The Gatekeeper mechanism ensures that the HTTP listener blocks incoming traffic until all managed policies (rate limiting, OAuth token enforcement, client ID enforcement) are successfully downloaded from the Anypoint control plane and activated.
2. API Proxy Protecting a Non-Mule API
When protecting legacy services or non-Mule backends without embedding logic, a lightweight standalone Mule API Proxy is deployed in front:
3. Flex Gateway (Connected Mode)
For microservices, Kubernetes clusters, and non-Mule services requiring ultra-low latency, Anypoint Flex Gateway operates as an Envoy-based reverse proxy:
Flex Gateway connects to the Anypoint control plane to synchronize policies and report metrics while processing traffic at sub-millisecond speeds.