Admission control
POST /admit asks the edge whether a candidate path is admissible for a tenant — it matches the route, applies the per-tenant rate limit, and returns the resolved upstream and decision.
SS-07 · API Gateway
Every external call to the mesh enters here. An Envoy edge terminates TLS, validates the SS-01 JWT, strips inbound claim headers, applies the WAF and per-tenant rate limits, and proxies to the right upstream. Admit-probe a path, publish routes, shift weight for a canary, set entitlement-driven limits and register webhook providers — with the live /edge and /webhook data-plane running the same logic.
What it does
POST /admit asks the edge whether a candidate path is admissible for a tenant — it matches the route, applies the per-tenant rate limit, and returns the resolved upstream and decision.
Publish routes and shift traffic with weights — a weighted canary or blue/green cutover expressed as route weights.
Set the per-tenant, entitlement-driven rate limits that GW06 enforces at the edge.
Register webhook providers so inbound provider callbacks land on a verified, tenant-scoped /webhook/{provider} path.
The /edge/{rest...} proxy (verify JWT → strip claim headers → admit → proxy) and the webhook edge are transport, not request-shaped ops — the same admission logic, live.
Worked examples
Auth on every call is the platform standard: an SS-01 Bearer token plus your X-Tenant-Id. $BASE is the service's /api/v1 base; ${H[@]} carries the auth headers.
Admit is the probe form of the live edge decision. Route weights express a canary without touching the data plane config by hand.
# Will this path be admitted for tenant acme?
curl -sX POST "$BASE/admit" "${H[@]}" \
-d '{ "path":"/api/v1/mesh" }'
# → { "admit": true, "route":"network", "upstream":"ss-26-network:8026",
# "rate_remaining": 4980 }
# Shift 10% of the network route onto a canary upstream
curl -sX POST "$BASE/routes/weights" "${H[@]}" -d '{
"route":"network",
"weights":[ {"upstream":"network-stable","weight":90},
{"upstream":"network-canary","weight":10} ]
}'Endpoints
Method · path from services/07's openapi.json. The complete catalog for every group is on the docs page.
/api/v1/admitProbe whether a path is admissible for the tenant (route + rate limit)/api/v1/routesList edge routes/api/v1/routesPublish an edge route/api/v1/routes/weightsShift traffic weight across routes (canary/cutover)/api/v1/entitlementsSet the per-tenant entitlement-driven rate limit/api/v1/webhooks/providersRegister a webhook provider/api/v1/edge/{rest...}Live data-plane proxy (verify JWT, strip claims, admit, proxy)/api/v1/webhook/{provider}Live provider webhook ingressArchitecture placement
SS-07 is the only public entrypoint to the fabric (ADR-0058, TrustMesh=false at the edge). It verifies the SS-01 JWT, strips any inbound claim headers so a caller can't forge identity, admits the request against a route + entitlement-driven rate limit (GW06), then proxies east-west over mTLS. The /admit endpoint is the admin/probe form of the same decision the live /edge/{rest...} proxy runs.
Keep exploring
ZTNA, the sovereign mesh, native WireGuard coordination, SD-WAN and the UPO policy compiler — one fabric.
Open deep-dive →Authoritative DNS, GeoDNS steering, health-checked answers and a DNSSEC ceremony — the resolution layer under the mesh.
Open deep-dive →Detections-as-code, guard-railed containment, threat intel, and the Zeek mesh chaos-rig auditor.
Open deep-dive →Metrics, logs, traces, SLOs with burn-rate routing, synthetic probes and the signed audit index for the whole fabric.
Open deep-dive →