API Gateway
Quick Reference
# List REST APIs (v1)
aws apigateway get-rest-apis --query 'items[].[name,id]' --output table
# List HTTP APIs (v2)
aws apigatewayv2 get-apis --query 'Items[].[Name,ApiId,ApiEndpoint]' --output table
# Get API details
aws apigateway get-rest-api --rest-api-id n6wwdwmk2m
# List resources/routes for a REST API
aws apigateway get-resources --rest-api-id n6wwdwmk2m --query 'items[].[path,id]' --output table
# List routes for HTTP API
aws apigatewayv2 get-routes --api-id {api-id} --query 'Items[].[RouteKey]' --output table
Invoking with IAM Auth (Control Plane Gateway)
The control plane gateway uses IAM auth. Requires aws-requests-auth:
python3 -c "
import requests, json
from aws_requests_auth.boto_utils import BotoAWSRequestsAuth
host = 'n6wwdwmk2m.execute-api.us-east-1.amazonaws.com'
auth = BotoAWSRequestsAuth(aws_host=host, aws_region='us-east-1', aws_service='execute-api')
resp = requests.post(f'https://{host}/prod/v2/indexes/list', auth=auth,
json={'systemAccountId': 'fnqm9psx'})
print(json.dumps(resp.json(), indent=2))
"
Key Gateways
| Gateway | Type | Purpose | Auth |
|---|---|---|---|
| Control Plane Gateway | REST (v1) | Data plane cell operations | IAM |
| Console API | REST (v1) | Console frontend + monolith proxy | Custom authorizer |
| Ecom API | HTTP (v2) | Ecommerce API (Shopify etc.) | Lambda authorizer |
| Admin Internal API | HTTP (v2) | Admin dashboard backend | JWT (Cloudflare Access) |
Data Plane Cell Gateways
Cell config is in infra/*/config/{env}.json under data_plane_cells:
| Cell | Gateway ID | Account | Region |
|---|---|---|---|
| S (staging) | n6wwdwmk2m | 468036072962 | us-east-1 |
| PP (preprod) | me25xyukr9 | 010928202142 | us-east-1 |
| P1 (prod) | m6j1teqnte | 023568249301 | us-east-1 |
Endpoint pattern: https://{gateway_id}.execute-api.{region}.amazonaws.com/prod{path}
Key Endpoints
| Method | Path | Body | Description |
|---|---|---|---|
| POST | /v2/indexes/list | {"systemAccountId": "..."} | List indexes for a system account |
| POST | /account/key/validate | {"key": "..."} | Validate an API key |
What to Look For
| Symptom | Check |
|---|---|
| 5XX errors | CloudWatch metrics: 5XXError for the API |
| 4XX errors | CloudWatch metrics: 4XXError, check WAF logs |
| Latency | CloudWatch metrics: Latency, IntegrationLatency |
| Auth failures | Check authorizer Lambda logs (if custom) |
| Rate limiting | WAF WebACL logs (2000 req/5min per IP/API key) |