The Swift API Platform provides a secure, scalable, and standardised way for organizations to expose and consume APIs within the Swift ecosystem. This introduction explains the core roles, platform concepts, and shared capabilities that apply to all participants.

Core Roles in the Swift API Platform

API Consumers

API Consumers are applications or systems that invoke APIs exposed on the Swift API platform. As a consumer, you can consume a wide range of API services securely leveraging existing Swift identities and connectivities. Typical responsibilities include:

• Discovering and evaluating APIs available on the platform
• Understanding network exposure and security requirements
• Obtaining and managing credentials required for API access
• Integrating APIs into applications and handling responses and errors

API consumers interact only with the Swift API Gateway, which provides a consistent and secure interface regardless of the underlying API provider.

API Providers

API Providers are organizations that expose backend services as APIs through the Swift API platform enabling Swift customers to access your services in a secure way. Typical responsibilities include:

• Registering APIs and provider endpoints in the Swift Developer Portal and e-ordering forms
• Configuring web servers with Swift-issued certificates
• Accepting and validating authentication from the Swift API Gateway
• Implementing business logic and enforcing provider-side controls

API providers do not interact directly with API consumers; all traffic is mediated through Swift.

End-to-end API flow

The following diagram illustrates the end-to-end API flow, providing a visual overview of the key components, interactions, and data exchange across the entire integration lifecycle.

API Consumer (Client)

• Initiates API requests based on published API specifications
• Authenticates using the credentials required by the API
• Is responsible for secure storage and lifecycle management of consumer credentials

Swift API Gateway

• Acts as the single entry point for all API consumer traffic
• Authenticates API consumers and validates requests
• Expose standardised error handling with documented error codes
• Forwards only authosized traffic to appropriate downstream services or API providers
• Injects provider-facing security context, including the X-UserContext header
• Ensure consistent observability and operational behavior across APIs

API Provider API Gateway / Server

• Receives only validated and authosized requests from Swift
• Receive consumer context via mandatory headers including the X-UserContext header
• Processes requests according to published API specifications and business logic

Common Swift API Platform Concepts

The following concepts apply to both API consumers and API providers.

Network Options

Swift supports two network exposure models to meet different security and business requirements. Internet-facing APIs for broad accessibility and lower connectivity barriers and Swift's Secure IP Network (MV-SIPN) which provides private, restricted connectivity within the Swift network for higher security, confidentiality, and regulatory requirements. Each API explicitly documents which network option is used, as this impacts business requirements, technical connectivity, and deployment design.

Environments

Swift provides multiple environments to support the full API lifecycle. Sandbox is used for early stage evaluation and development which includes simulated response. Pilot testing environment is used for integration testing with user generated test data and business logic and production like provisioning to ensure gaps are mitigated as early as possible before production deployment. Live is used for operational traffic with live data, full security, compliance and availability requirements. API documentation clearly identifies which environments are available for each API.

Integrity and Non-Repudiation Headers

To support secure and auditable API interactions, Swift defines integrity and non-repudiation headers. Certain APIs require integrity or non-repudiation instrumentation. Header names, formats, and validation rules are standardised and documented. Both API consumers and API providers are responsible for implementing these headers when required.

Notification Services

Swift supports notification services that can be enabled for APIs to provide event-driven communication. Notifications can inform consumers or providers of important events. Notification configuration options are documented per API.