ApiCrux

ApiCrux is the API gateway that serves as the secure, metered entry point for all programmatic access to the CueCrux platform. Every request from external clients, whether originating from SDKCrux, custom integrations, or third-party applications, flows through ApiCrux, which handles authentication, authorisation, budget enforcement, rate limiting, and request routing.

Authentication is the first layer of defence. ApiCrux validates OAuth2 bearer tokens on every request, verifying the token's signature, expiration, and scope claims. Tokens are short-lived and must be refreshed through the platform's identity provider, ensuring that compromised tokens have a limited window of exploitability. For server-to-server integrations, ApiCrux also supports API key authentication with IP-based access restrictions.

Budget enforcement operates through the CRUX credit system. Every API operation has a defined credit cost that varies by assurance mode, query complexity, and corpus scope. ApiCrux tracks credit consumption in real-time against per-tenant budget allocations, rejecting requests that would exceed the allocated budget with clear error messages explaining the budget state and options for obtaining additional credits. This prevents runaway costs and ensures fair resource distribution across tenants.

Rate limiting protects the platform from abuse and ensures quality of service for all tenants. ApiCrux enforces configurable rate limits at multiple levels: per-tenant, per-user, per-endpoint, and per-assurance-mode. Rate limits are implemented using a sliding window algorithm that smooths burst traffic while allowing legitimate high-throughput use cases. When limits are approached, response headers communicate the remaining capacity and reset timing.

Request routing directs incoming requests to the appropriate backend service based on the endpoint, tenant configuration, and current system load. ApiCrux can route queries to different Engine instances based on the assurance mode requested, direct ingestion requests to FactoryCrux, and route verification requests to the receipt validation service. Load balancing ensures even distribution across available instances, and circuit breakers prevent cascading failures when individual services experience issues.

OpenAPI documentation is generated automatically from the platform's type definitions, ensuring that the documentation always matches the actual API behaviour. Developers can explore the API through an interactive documentation interface, try out requests with their credentials, and generate client code for languages not covered by SDKCrux. The documentation includes detailed descriptions of every endpoint, request and response schemas, error codes, and usage examples.

ApiCrux also provides comprehensive request logging for audit and debugging purposes. Every request is logged with its authentication context, parameters, response status, latency, and credit cost. These logs feed into the Performance Metrics system and are available to operators through OpsCrux dashboards.

For the CueCrux platform, ApiCrux is the trusted boundary between the internal service mesh and the outside world. It ensures that every interaction with the platform is authenticated, authorised, metered, and documented.