Build APIs with Velox
Velox API Service can execute REST-enabled Flows. Designer groups those Flows into API modules and generates OpenAPI descriptions. A separate, approved gateway or front end must provide the public TLS, authentication, authorisation and network boundary.
The API capability has three distinct layers:
| Layer | Responsibility | Important boundary |
|---|---|---|
| REST-enabled Flow | Endpoint path, method metadata, request/response Definitions, execution and status mapping | The reviewed core dispatcher executes GET and POST only. Flow logic owns business validation and side effects. |
| API module | Groups REST Flows and creates the OpenAPI document | Document generation does not deploy routes or enforce security. |
| Gateway/front end | Public route, TLS, authentication, authorisation, limits and documentation UI | This must be designed and operated as the untrusted-network security boundary. |
Implementation path
- Define the document identity and server metadata in API module properties.
- Configure a REST-enabled Flow and test it locally with fictional data.
- Generate and export OpenAPI, then validate the document against actual behaviour.
- Deploy the API safely behind an approved boundary.
- Where approved, publish through the Velox API front end.
- Use API troubleshooting without exposing credentials or payloads.
Do not expose Velox API Service directly to an untrusted network. OpenAPI security declarations describe a contract; they do not create runtime enforcement by themselves.