Gateway Federation with API Scanners
What is Gateway Federation?
Gateway Federation is MuleSoft’s model for bringing APIs from external gateways — Amazon API Gateway, Azure API Management, Kong, and Google Apigee — under a single governance plane in Anypoint Exchange.
Instead of logging into four different consoles to find out what APIs your organisation runs, you register each gateway once. A scanner polls each gateway on a configurable interval, discovers every API definition, imports it into Exchange as a versioned asset, and keeps it in sync as APIs change.
┌─────────────────────────────────────────────────────────────┐
│ External Gateways │
│ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ Amazon API │ │ Azure │ │ Kong │ ... │
│ │ Gateway │ │ APIM │ │ Gateway │ │
│ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │
└─────────┼─────────────────┼─────────────────┼──────────────┘
│ │ │
▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ API Scanners (poll on schedule) │
│ │
│ Discover API definitions → import to Exchange as assets │
└────────────────────────────┬────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Anypoint Exchange │
│ │
│ Unified API catalog │ Source tags │ Version history │
└────────────────────────┬────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ API Governance │
│ │
│ Rulesets │ Governance profiles │ Violation reports │
└─────────────────────────────────────────────────────────────┘
Why it matters
Most enterprises run more than one API gateway. Sprawl is real: a team builds on AWS API Gateway, another team standardises on Kong, and an acquired company brings its own Azure APIM instance. Without federation:
- No single place to see all APIs
- Governance policies applied inconsistently (or not at all)
- Duplicate APIs discovered only during incidents
With Gateway Federation, every API from every gateway flows into Exchange automatically. Governance teams can apply MuleSoft API Governance rulesets to the entire portfolio — regardless of which gateway hosts each API.
What you’ll build
By the end of this workshop you will have:
- Understood the polling model and what data each scanner collects
- Configured a scanner for at least one external gateway (AWS, Azure, Kong, or Apigee)
- Verified that imported APIs appear as assets in Anypoint Exchange with correct source tags
- Applied an API Governance profile to the imported APIs and reviewed the governance report
- Performed common scanner management tasks: manual resync, edit credentials, pause/delete
Prerequisites
Before starting, make sure you have:
- A MuleSoft Platform account with Exchange Administrator permission
- At least one external gateway (AWS, Azure, Kong, or Apigee) with APIs deployed
- Credentials for that gateway (IAM keys, service principal, or admin token — details in each scanner section)
- Correct business group placement in Anypoint Platform for where imported APIs should land
Note: You do not need all four gateways to complete this workshop. Work through the scanner sections that apply to your environment; the governance and management sections apply to any scanner.
Estimated time
| Section | Duration |
|---|---|
| Concepts & prerequisites | 15 min |
| Add a scanner (per gateway) | 10–15 min each |
| Govern federated APIs | 20 min |
| Manage scanners | 10 min |
Ready? Start with Prerequisites →