Open source · Written in Rust · AGPLv3

The light, zero-trust API gateway.

Barbacane compiles your OpenAPI or AsyncAPI spec into a signed artifact and enforces it on every request. Only what the spec declares gets through. One static binary, no database, no sidecar.

Get started View on GitHub
Route lookup, 1,000 routes
~83 ns
Full request validation
~1.2 µs
Static gateway binary
~30 MB

Criterion micro-benchmarks on an Apple M4. Run them yourself.

Light. Robust. Zero trust.

A gateway sits in front of everything you run. It should be the smallest, most predictable and most suspicious component in the path.

Light

Nothing on the request path that your API does not need.

  • One static binary of about 30 MB, shipped in a distroless, non-root image
  • No database, cache or sidecar: a data plane needs only its compiled artifact
  • Rust, Tokio and Hyper, with no garbage collector to pause your traffic
  • Route lookup in about 83 ns and full request validation in about 1.2 µs

Robust

Mistakes fail the build, and the gateway holds up under pressure.

  • Unknown plugins, invalid configs, route conflicts and broken schemas are compile errors, not runtime surprises
  • A connection cap with load shedding, plus header-read and TLS handshake timeouts
  • Plugins run with memory, fuel and wall-clock limits, so a faulty one cannot take the gateway down
  • Data planes keep serving their last artifact when the control plane is unreachable

Zero trust

Every request is checked against the contract. Nothing is assumed.

  • Only declared operations route, and every parameter, header and body is validated
  • Request headers the spec does not declare are dropped before any plugin sees them
  • Identity headers come only from the auth plugins: a client cannot forge them
  • Artifacts are signed with Ed25519, and a pinned key makes the gateway refuse anything else

Only what the spec declares gets through

There is no separate gateway configuration to drift from your API. The operation you document is the operation the gateway enforces, and anything you did not document is refused. 

# Applies to every operation
x-barbacane-middlewares:
  - name: oidc-auth
    config:
      issuer_url: https://auth.example.com
      audience: orders-api

paths:
  /orders/{orderId}:
    get:
      operationId: getOrder
      security:
        - bearerAuth: []
      parameters:
        - name: orderId
          in: path
          required: true
          schema: { type: string, format: uuid }
        - name: x-tenant-id
          in: header
          required: true
          schema: { type: string, pattern: "^[a-z0-9-]{3,32}$" }
      x-barbacane-middlewares:
        - name: rate-limit
          config:
            quota: 100
            window: 60
            partition_key: "context:auth.sub"
      x-barbacane-dispatch:
        name: http-upstream
        config:
          url: https://orders.internal.example

Only this route exists

Any path or method the spec does not declare gets a 404 or 405. There is no catch-all to forget about.

Inputs match the schema

orderId must be a UUID and x-tenant-id must match its pattern. Anything else is a 400, before the upstream sees it.

The caller is verified

oidc-auth validates the bearer token against the issuer and audience. No valid token, no request.

Undeclared headers never arrive

Headers outside the declared parameters, the security scheme and a fixed baseline are stripped at ingress, including any x-auth-* a client tries to send.

Limits follow the identity

The rate limit partitions on the authenticated subject, which a client cannot spoof.

How the trust model works, control by control

Spec in, signed artifact out

Checks happen when you build, not when a request fails in production.

1

Write the spec

Your OpenAPI or AsyncAPI document, with x-barbacane-* extensions for middlewares and upstreams. It stays a standard spec that every other tool can read.

2

Compile and sign

barbacane compile validates every route, schema and plugin config, seals the plugins and WAF rules into one .bca artifact, and signs it.

3

Verify and serve

barbacane serve checks the artifact's integrity and signature before it serves a single request, then hot-reloads new versions without dropping connections.

A WAF that compiles with your spec

A ModSecurity and OWASP CRS compatible rule set runs as a native stage in the pipeline, with no sidecar. Rules are checked at compile time and sealed into the artifact, so an unknown directive fails the build instead of silently never firing.

OWASP CRS, native

Stock Core Rule Set v4 compiles in full. SQL injection and XSS detection runs on a memory-safe libinjection port that matches the C library on all 163,275 inputs of its test corpus.

Both directions

Requests and responses are inspected, so a leaked credential or stack trace is caught on the way out, not just an attack on the way in.

Bound to the signature

The rule set and its policy are part of the artifact hash, so a signed artifact cannot be switched from blocking to detection-only without breaking the signature.

Audit log

One structured record per transaction with the matched rules, anomaly scores and verdict, ready for your SIEM.

Everything an API gateway needs

Declared in the spec, checked at compile time, enforced on every request.

Request validation

JSON Schema validation for paths, query strings, headers, cookies and bodies, with $ref resolution and format checks.

Authentication

JWT, OIDC, OAuth2 introspection, API keys, Basic and LDAP, wired to the security schemes in your spec.

Authorization

Consumer ACLs, inline CEL expressions and Open Policy Agent, evaluated per operation.

Web application firewall

OWASP CRS compatible rules compiled into the artifact, inspecting requests and responses.

Traffic control

Sliding-window rate limits, IP restriction, bot detection, request size limits and response caching.

Transformation

Declarative rewrites of headers, query parameters, paths and JSON bodies, in both directions.

Observability

Prometheus metrics, OpenTelemetry traces with W3C Trace Context, and structured JSON logs.

Events and storage

AsyncAPI specs bridge HTTP to Kafka, NATS and AWS Lambda. S3 and WebSocket upstreams are first-class.

FIPS 140-3 ready

TLS through rustls and AWS-LC, a NIST-certified FIPS 140-3 module. No OpenSSL dependency.

Provenance

Every artifact records its content hash and Git commit, and drift detection flags data planes running anything else.

WebAssembly plugins

29 official plugins, and your own in any language that compiles to WebAssembly, each confined to the host functions it declares.

Control and data planes

A control plane compiles and distributes artifacts. Data planes hot-reload them without dropping connections.

Data planes that stand on their own

The control plane builds and distributes artifacts. The data planes serve traffic, and nothing on the request path depends on the control plane.

Control plane

  • REST API for specs, builds and deployments, behind an admin token
  • Plugin registry with config schema validation
  • Spec compilation and artifact builds
  • Pushes new artifacts to connected data planes
  • Artifact provenance and drift detection

Data planes

  • Run from a single artifact file, with or without a control plane
  • Hot reload without restarts or dropped connections
  • Keep serving the last artifact if the control plane goes away
  • TLS termination, mTLS to upstreams and FIPS 140-3 mode
  • Admin endpoints for health, metrics and provenance

Built for teams who take APIs seriously

Platform teams

Give every team the same enforced baseline: authentication, validation and limits that come from the spec, not from tickets.

  • Self-service API publishing
  • Policies enforced, not reviewed
  • One observability story

API product companies

The contract you publish is the contract you enforce, so your documentation and your gateway can never disagree.

  • Contract-first development
  • Documentation that cannot lie
  • Deprecation and sunset headers

Regulated environments

Signed artifacts, provenance and audit logs give you evidence of what ran, built from components you can inspect.

  • FIPS 140-3 ready TLS
  • Air-gapped and on-prem deployments
  • Audit-ready WAF logging
Open source

No feature gating. No hidden enterprise tier.

Barbacane is open source under the AGPLv3, and every feature is available to everyone. Small teams and non-profits get a free commercial license. Larger organisations can buy one: see pricing.

Star on GitHub

Put your spec in front of your APIs

Write the spec, compile it, serve it. Minutes, not a migration project.

# Try the playground with Docker
git clone https://github.com/barbacane-dev/playground
cd playground && docker-compose up -d

# Or install from source
cargo install barbacane
barbacane compile --spec api.yaml --manifest barbacane.yaml --output api.bca
barbacane serve --artifact api.bca
Read the docs Need help? Talk to us