Overview
Tyk’s Virtual Endpoint is a programmable middleware component that is invoked towards the end of the request processing chain. It can be enabled at the per-endpoint level and can perform complex interactions with your upstream service(s) that cannot be handled by one of the other middleware components. Virtual endpoint middleware provides a serverless compute function that allows for the execution of custom logic directly within the gateway itself, without the need to proxy the request to an upstream service. This functionality is particularly useful for a variety of use cases, including request transformation, aggregation of responses from multiple services, or implementing custom authentication mechanisms. The Virtual Endpoint is an extremely powerful feature that is unique to Tyk and provides exceptional flexibility to your APIs.Use Cases
Aggregating data from multiple services
From a virtual endpoint, you can make calls out to other internal and upstream APIs. You can then aggregate and process the responses, returning a single response object to the originating client. This allows you to configure a single externally facing API to simplify interaction with multiple internal services, leaving the heavy lifting to Tyk rather than starting up an aggregation service within your stack.Enforcing custom policies
Tyk provides a very flexible middleware chain where you can combine functions to implement the access controls you require to protect your upstream services. Of course, not all scenarios can be covered by Tyk’s standard middleware functions, but you can use a virtual endpoint to apply whatever custom logic you require to optimize your API experience.Dynamic Routing
With a virtual endpoint you can implement complex dynamic routing of requests made to a single external endpoint on to different upstream services. The flexibility of the virtual endpoint gives access to data within the request (including the key session) and also the ability to make calls to other APIs to make decisions on the routing of the request. It can operate as a super-powered URL rewrite middleware.Working
The virtual endpoint middleware provides a JavaScript engine that runs the custom code that you provide either inline within the API definition or in a source code file accessible to the Gateway. The JavaScript Virtual Machine (JSVM) provided in the middleware is a traditional ECMAScript5 compatible environment which does not offer the more expressive power of something like Node.js. The virtual endpoint terminates the request, so the JavaScript function must provide the response to be passed to the client. When a request hits a virtual endpoint, the JSVM executes the JavaScript code which can modify the request, make calls to other APIs or upstream services, process data, and ultimately determines the response returned to the client.You will need to enable Tyk’s JavaScript Virtual Machine by setting
enable_jsvm
to true
in your tyk.conf
file for your virtual endpoints to work.Scripting virtual endpoint functions
The middleware scripting guide provides guidance on writing JS functions for your virtual endpoints, including how to access key session data and custom attributes from the API definition.Function naming
The virtual endpoint middleware will invoke a named function within the JS code that you provide (either inline or in a file). Both the filename and function name are configurable per endpoint, but note that function names must be unique across your API portfolio because all plugins run in the same virtual machine. This means that you can share a single function definition across multiple endpoints and APIs but you cannot have two different functions with the same name (this applies across all JavaScript middleware components). Inline mode is mainly used by the dashboard to make code injection easier on multiple node deployments.Virtual endpoint library
We have put together a library of JS functions that you could use in your virtual endpoints. We welcome submissions from the Tyk community so if you’ve created a function that you think would be useful to other users, please open an issue in the Github repository and we can discuss bringing it into the library.Virtual endpoints are not available in Tyk Cloud Classic.
Using Tyk OAS
The virtual endpoint middleware provides a serverless compute function that allows for the execution of custom logic directly within the gateway itself, without the need to proxy the request to an upstream service. This functionality is particularly useful for a variety of use cases, including request transformation, aggregation of responses from multiple services, or implementing custom authentication mechanisms. The middleware is configured in the Tyk OAS API Definition. You can do this via the Tyk Dashboard API or in the API Designer. If you’re using the legacy Tyk Classic APIs, then check out the Tyk Classic page.API Definition
The design of the Tyk OAS API Definition takes advantage of theoperationId
defined in the OpenAPI Document that declares both the path and method for which the middleware should be added. Endpoint paths
entries (and the associated operationId
) can contain wildcards in the form of any string bracketed by curly braces, for example /status/{code}
. These wildcards are so they are human readable and do not translate to variable names. Under the hood, a wildcard translates to the “match everything” regex of: (.*)
.
The virtual endpoint middleware (virtualEndpoint
) can be added to the operations
section of the Tyk OAS Extension (x-tyk-api-gateway
) in your Tyk OAS API Definition for the appropriate operationId
(as configured in the paths
section of your OpenAPI Document).
The virtualEndpoint
object has the following configuration:
-
enabled
: enable the middleware for the endpoint -
functionName
: the name of the JavaScript function that will be executed when the virtual endpoint is triggered -
body
: [optional] abase64
encoded string containing the JavaScript code -
path
: [optional] the relative path to the source file containing the JavaScript code -
proxyOnError
: [optional, defaults tofalse
] a boolean that determines the behavior of the gateway if an error occurs during the execution of the virtual endpoint’s function; if set totrue
the request will be proxied to upstream if the function errors, if set tofalse
the request will not be proxied and Tyk will return an error response -
requireSession
: [optional defaults tofalse
] a boolean that indicates whether the virtual endpoint should have access to the session object; iftrue
then the key session data will be provided to the function as thesession
variableOne of eitherpath
orbody
must be provided, depending on whether you are providing the JavaScript code in a file or inline within the API definition. If both are provided thenbody
will take precedence.
GET /anything
endpoint. We have also configured the following custom attributes in the pluginConfig
section of the API definition:
body
field value is a base64
encoded string containing this JavaScript code, which will be invoked by the virtual endpoint middleware:
GET /anything
endpoint returns:
API Designer
Adding a Virtual Endpoint to your API endpoints is easy when using the API Designer in the Tyk Dashboard, simply follow these steps:-
Add an endpoint
From the API Designer add an endpoint that matches the path and method to which you want to apply the middleware.
-
Select the Virtual Endpoint middleware
Select ADD MIDDLEWARE and choose Virtual Endpoint from the Add Middleware screen.
-
Configure the middleware
Now you can provide either the path to a file containing the JavaScript function to be run by the middleare, or you can directly enter the JavaScript in the code editor.
For both sources, you must provide the function name that should be called when the middleware executes.
You can also optionally configure the behavior required if the function should return an error and also indicate to Tyk whether the virtual middleware requires access to the key session metadata.
- Save the API Select ADD MIDDLEWARE to save the middleware configuration. Remember to select SAVE API to apply the changes.
Using Classic
The virtual endpoint middleware provides a serverless compute function that allows for the execution of custom logic directly within the gateway itself, without the need to proxy the request to an upstream service. This functionality is particularly useful for a variety of use cases, including request transformation, aggregation of responses from multiple services, or implementing custom authentication mechanisms. This middleware is configured in the Tyk Classic API Definition. You can do this via the Tyk Dashboard API or in the API Designer. If you’re using the newer Tyk OAS APIs, then check out the Tyk OAS page. If you’re using Tyk Operator then check out the configuring the middleware in Tyk Operator section below.API Definition
If you want to use Virtual Endpoints, you must enable Tyk’s JavaScript Virtual Machine by settingenable_jsvm
to true
in your tyk.conf
file.
To enable the middleware you must add a new virtual
object to the extended_paths
section of your API definition.
The virtual
object has the following configuration:
path
: the endpoint pathmethod
: the endpoint HTTP methodresponse_function_name
: this is the name of the JavaScript function that will be executed when the virtual endpoint is triggeredfunction_source_type
: instructs the middleware to look for the JavaScript code either in afile
or in a base64 encodedblob
; the actual file location (or base64 encoded code) is provided infunction_source_uri
function_source_uri
: iffunction_source_type
is set tofile
, this will be the relative path to the source file containing the JavaScript code; iffunction_source_type
if set toblob
, this will be abase64
encoded string containing the JavaScript codeuse_session
: a boolean that indicates whether the virtual endpoint should have access to the session object; iftrue
then the key session data will be provided to the function as thesession
variableproxy_on_error
: a boolean that determines the behavior of the gateway if an error occurs during the execution of the virtual endpoint’s function; if set totrue
the request will be proxied to upstream if the function errors, if set tofalse
the request will not be proxied and Tyk will return an error response
GET /anything
endpoint. For any call made to this endpoint, Tyk will invoke the function myUniqueFunctionName
that is base64
encoded in the function_source_uri
field. This virtual endpoint does not require access to the session data and will not proxy the request on to the upstream if there is an error when processing the myUniqueFunctionName
function.
Decoding the value in function_source_uri
we can see that the JavaScript code is:
HTTP 200
as follows:
HTTP 500 Internal Server Error
as follows:
proxy_on_error
to true
and keep the error in the Javascript, the request will be forwarded to the upstream and Tyk will return the response received from that service.
API Designer
You can use the API Designer in the Tyk Dashboard to configure a virtual endpoint for your Tyk Classic API by following these steps.-
Add an endpoint for the path and select the plugin
From the Endpoint Designer add an endpoint that matches the path for which you want to trigger the virtual endpoint. Select the Virtual Endpoint plugin.
-
Configure the middleware
Once you have selected the virtual endpoint middleware for the endpoint, you need to supply:
- JS function to call
- Source type (
file
orinline
)
file
you must provide the path to the file: If you selectinline
you can enter the JavaScript code in the Code Editor window. -
Save the API
Use the save or create buttons to save the changes and activate the Virtual Endpoint middleware.
The Tyk Classic API Designer does not provide options to configure
use_session
orproxy_on_error
, but you can do this from the Raw Definition editor.
Tyk Operator
The process for configuring a virtual endpoint using Tyk Operator is similar to that explained in configuring the middleware in the Tyk Classic API Definition The example API Definition below configures an API to listen on path/httpbin
and forwards requests upstream to http://httpbin.org
. The Virtual Endpoint middleware has been configured for requests to the GET /virtual
endpoint. For any call made to this endpoint, Tyk will invoke the function myVirtualHandler
that is base64 encoded in the function_source_uri
field. This virtual endpoint does not require access to the session data and will not proxy the request on to the upstream if there is an error when processing the myVirtualHandler
function.
function_source_uri
we can see that the JavaScript code is:
proxy_on_error
to true
and keep the error in the Javascript, the request will be forwarded to the upstream and Tyk will return the response received from that service.
Examples
Accessing Tyk data objects
In this example, we demonstrate how you can access different external Tyk objects (API request, session key, API definition).- Enable the Virtual Endpoint middleware on an endpoint of your API and paste this JavaScript into the API Designer (or save in a file and reference it from the middleware config):
-
Make a call to your API endpoint passing a request body, a value in the
Authorization
header and a query parameterparam1
. - The virtual endpoint will terminate the request and return this response:
- The gateway logs will include:
Accessing custom attributes in the API Definition
You can add custom attributes to the API definition and access these from within your Virtual Endpoint.- Add the following custom attributes to your API definition:
- Enable the Virtual Endpoint middleware on an endpoint of your API and paste this JavaScript into the API Designer (or save in a file and reference it from the middleware config):
- Make a call to your API endpoint.
- The virtual endpoint will terminate the request and return this response:
Advanced example
In this example, every line in the script gives an example of a functionality usage, including:- how to get form param
- how to get to a specific key inside a JSON variable
- the structure of the request object
- using
TykMakeHttpRequest
to make an HTTP request from within the virtual endpoint, and the json it returns -.Code
and.Body
.
Running the Advanced example
You can find a Tyk Classic API definition here that includes the advanced example, with the JS encodedinline
within the middleware config for the GET /headers
endpoint.
Create a new Tyk Classic API using that API definition and then run the following command to send a request to the API endpoint:
Checking the Tyk Gateway Logs
Thelog
and rawlog
commands in the JS function write to the Tyk Gateway logs. If you check the logs you should see the following: