We verify whether the current gateway deployment aligns with recommended reference architecture: node roles, clustering model, environment separation (dev/test/prod), traffic routing, network placement, load balancing strategy, sizing assumptions, and HA design. The goal is to validate that the platform is built for redundancy, controlled growth, and predictable failover behavior under real operational conditions.

We assess the configuration and enforcement of authentication and authorization flows, including OAuth2/OIDC patterns, key and certificate lifecycle automation, TLS/cipher configuration, JWT handling, API key rotation, threat protection assertions, and integration with IAM/IDP systems. Findings often include gaps that create exposure risk, block zero-trust adoption, or complicate audit compliance.

We review gateway system properties, assertion structure, reusable fragments, naming and versioning conventions, deployment automation, and cross-environment parity to identify configuration drift, undocumented overrides, or legacy logic carried forward from earlier releases. This category frequently reveals maintainability issues and root causes for “it works in test but not in production” behavior.

We analyze policy execution flow, caching decisions, JDBC and connection pool settings, thread utilization, latency trends, log overhead, metric exposure, SIEM forwarding and alert thresholds. This determines whether the platform can sustain traffic growth, handle burst workloads, and support effective troubleshooting without adding unnecessary processing or storage overhead.

We identify technical blockers such as deprecated assertions, unsupported policy extensions, incompatible JAR dependencies, hard-coded endpoints, manual deployment processes, or undocumented customizations. The assessment provides forward-looking recommendations that reduce upgrade effort, enable automated delivery pipelines, and prepare the platform for scaling, cloud migration, or API program expansion.

If a Layer7 Developer Portal is deployed, we assess its alignment with the API Gateway and its readiness to support internal, partner, or external API consumers. The review includes version and connectivity validation, subscription and application creation workflows, role-based access, catalog visibility, and governance policies. The goal is to ensure that the Portal is correctly configured for controlled API onboarding, credential issuance, and usage monitoring — and that no version, configuration, or architectural gaps block future upgrades, scaling, or API program growth.