Doorman

API management

Stop rebuilding auth, limits, and logging in every service.

Put REST, GraphQL, SOAP, and gRPC services behind one self-hosted gateway, then manage access, traffic policy, and versions from one dashboard.

Run the demoSee pricing

Catalog and lifecycle

Know which APIs exist and which versions are live.

Register APIs by hand, build them in the visual builder, or import a Swagger definition. Semantic versions resolve by major line, with deprecation and sunset built in.

  • Import Swagger definitions
  • Semantic versions with major-line resolution
  • Deprecation and sunset lifecycle
  • Schema validation and API discovery
Doorman API registry with versioned APIs and protocol filters

Access

Decide who can call what, in one place.

Manage users, roles, groups, and subscriptions in the gateway, so individual services don’t each need their own version of the same rules.

  • Users, roles, and groups
  • Subscriptions, credits, tiers, and quotas
  • JWT authentication
  • Audit and security controls
Doorman roles and permissions list

Observability

See what happened to a request without adding a tool.

Analytics, monitoring, and request logs come with the gateway. Search by time and request, then download what you need as JSON or CSV.

  • Request logs with JSON and CSV export
  • Latency percentiles and error rates
  • Usage analytics by API and user
  • Bandwidth reporting
Doorman request log table

Traffic policy

Change traffic policy without touching application code.

Rate limits
Cap how often callers can make requests.
Throttling
Slow traffic down before it overwhelms an upstream.
Bandwidth limits
Control how much data callers can move.
Retries
Recover from transient upstream failures at the gateway.
Circuit breaking
Stop sending traffic to an upstream that keeps failing.
Routing
Send callers to the right upstream by routing key.

Deployment

Start small, then scale out.

Start with one container and in-memory storage. When you need more than one instance, switch to shared mode. MongoDB holds durable configuration, and Redis holds caches, counters, revocations, routing state, and analytics.

Protocols
REST, SOAP, GraphQL, gRPC, gRPC-Web
Single instance
In-memory with encrypted snapshots
Multiple instances
MongoDB and Redis
Packaging
Docker Compose
License
Apache 2.0

Move one API behind Doorman first.

You don't need a migration plan to find out if it fits. Start with one service and see how it runs.

View on GitHubRead the docsTalk to us