API gateways

Policy-driven authorization at the WSO2 API Manager gateway

Enforce fine-grained Cerbos authorization policies at the WSO2 API Manager edge, before requests reach your services.

Native WSO2 support

Cerbos speaks WSO2's native protocol, no custom glue code required

Unified policies

The same CEL-based policies that govern your application layer extend to your infrastructure

Defense in depth

Authorization at every layer of your stack, managed from a single control plane

How Cerbos works with WSO2 API Manager

Enforcing authorization at the WSO2 API Manager gateway means unauthorized requests are rejected before they reach your services, reducing load, improving security posture, and simplifying backend code.

Cerbos provides fine-grained, context-aware authorization policies written in human-readable YAML. When integrated with WSO2 API Manager, these policies are evaluated at the edge for every incoming request.

The same Cerbos policies govern authorization at the gateway and within your services, one source of truth, one audit trail, and consistent enforcement across every layer.

Policy-as-codeHuman-readable YAML policies managed like source code Scalable PDPStateless policy decision point with sub-millisecond latency Centralized managementManage, test, and deploy policies from a single control plane

How Cerbos works with WSO2 API Manager

Deploy Cerbos alongside WSO2 API Manager, Run the Cerbos PDP as a sidecar or service accessible from your WSO2 API Manager gateway.
Configure the gateway plugin, Set up WSO2 API Manager to call Cerbos on incoming requests, passing identity and request metadata.
Define authorization policies in YAML, Write policies that control access based on routes, methods, roles, and request attributes.
Requests are authorized at the edge, Unauthorized requests are rejected before reaching your services, reducing load and improving security posture.

FAQ

How does Cerbos work with WSO2 API Manager?

WSO2 API Manager calls the Cerbos PDP for every incoming request. Cerbos evaluates your authorization policies using the request context (headers, claims, path) and returns an allow or deny decision, all at the gateway edge.

Does this replace backend authorization?

Gateway-level authorization provides defense in depth. You can enforce coarse-grained policies at the edge and fine-grained policies within your services, both managed by Cerbos.