Page MenuHomePhabricator
Create Task
Maniphest T235270

Wikimedia API Gateway
Closed, ResolvedPublic
Actions

Description

This project will curate a selection of APIs and present them in a favoured service to make it easier for client developers to work with our systems.

Related Objects
Search...

StatusSubtypeAssignedTask
 Resolved• eprodromouT235270 Wikimedia API Gateway
 Resolved• eprodromouT235271 Wikimedia public API domain
 Resolved• eprodromouT235274 Client Developer uses project paths
 Invalid• eprodromouT235275 Client Developer uses language paths
 Resolved• eprodromouT246266 Wikimedia API Gateway keys
 Resolved• eprodromouT246267 Client Developer uses OAuth 2.0 for authorization
 Resolved• eprodromouT246269 API Rate Limiting
 Resolved• ClarakosiT246379 Research rate limiter implementations and rate limiter-capable HTTP reverse proxies
 ResolvedapaskulinT247837 Create API Portal MVP
 ResolvedUrbanecmT246945 New Public Wiki for the API Portal
 Resolved• nskaggsT246946 Prepare and check storage layer for api.wikimedia.org
 ResolvedReedyT254185 Create new wiki on the beta cluster to test API Portal
 ResolvedBPirkleT247570 Provide specification of protocol interactions initiating from API Portal
 ResolvedapaskulinT249776 Define basic workflows
 ResolvedapaskulinT249780 Define log in/create account pages
 ResolvedapaskulinT249781 Define "Create app" flow
 ResolvedapaskulinT249783 Define "Manage apps" flow
 Resolved• CCicalese_WMFT249834 Configure permissions
 ResolvedReedyT254285 Add WikimediaMessages entries for docseditor group
 Resolved• eprodromouT249842 Define specification for retrieving API usage data
 ResolvedNoneT249846 Define footer content
 ResolvedapaskulinT249965 Investigate mobile experience
 ResolvedapaskulinT250303 Investigate talk pages
 Resolved• eprodromouT251063 Investigate issues with domain overlap
 ResolvedapaskulinT251279 Create API Portal skin
 Resolved• CCicalese_WMFT257959 Deploy WikimediaApiPortal to beta
 ResolvedReedyT246949 Security Review Request for WikimediaApiPortal Skin
 DeclinedNoneT252463 Determine how to host Chameleon skin and Bootstrap extension in gerrit while primary development happens in github
 Resolved• CCicalese_WMFT258758 Write unit tests for WikimediaApiPortal
 ResolvedapaskulinT258759 Document WikimediaApiPortal skin
 ResolvedKrinkleT252462 Performance review of WikimediaApiPortal skin
 ResolvedArt.tsymbarT251283 Create extension to provide functionality for creating and managing OAuth 2.0 clients from API Portal
 ResolvedapaskulinT251694 Document extension WikimediaApiPortalOAuth
 ResolvedReedyT254947 Security Review Request for WikimediaApiPortalOAuth Extension
 Resolved• PcheloloT261358 Review CORS strategy for WikimediaApiPortalOAuth extension
 Resolved• PcheloloT261696 MW REST Framework support for authenticated CORS
 ResolvedVlad.shapikT264102 Update Linting Rules
 ResolvedArt.tsymbarT264110 Missing error message wikimediaapiportaloauth-email-not-confirmed
 Declined• CCicalese_WMFT253321 Chameleon test failures on WMF CI
 Resolved• CCicalese_WMFT253322 Enable Phan on Chameleon Skin
 Resolved• CCicalese_WMFT253323 Enable Phan on Bootstrap Extension
 ResolvedReedyT253331 WikimediaApiPortal results in CI OOM-ing
 ResolvedArt.tsymbarT254305 WikimediaApiPortal skin doesn't play well with ULS
 ResolvedReedyT254948 Security Readiness Review For Enhancements to OAuth Extension
 Resolved• GillesT254951 Performance review of enhancements to OAuth extension
 ResolvedapaskulinT255040 Investigate a private launch for the API Portal
 ResolvedBPirkleT256766 Disallow public access to OAuth client ID management API
 ResolvedArt.tsymbarT257982 Update the OAuth extension to support the API Portal
 ResolvedArt.tsymbarT251280 Add API endpoint to propose a new OAuth consumer
 ResolvedapaskulinT254200 Add API endpoint to reset OAuth client secret
 ResolvedapaskulinT259042 Document updates to the OAuth extension
 ResolvedArt.tsymbarT259043 Write unit tests for new endpoints in the OAuth extension
 ResolvedEevansT248543 Evaluate Envoy proxy for API gateway (and rate-limiter)
 Resolved• eprodromouT255030 Wikimedia API Gateway MVP
 ResolvedhnowlanT235277 Client Developer uses OAuth 2.0 for authorization
 Resolved• PcheloloT261428 Add support for iss claim in OAuth2 access tokens
 Resolved• PcheloloT261986 Upload WMF fork of oauth2-server to packagist and vendor it
 Resolved• eprodromouT235276 Client Developer uses MediaWiki REST API
 Resolved• eprodromouT246265 Client Developer uses Wikifeeds API
 Resolved• PcheloloT246270 Administrator sets flat rate limit for API calls
 ResolvedhnowlanT254907 Introduce Envoy rate limiting into API Gateway
 Resolved• PcheloloT246271 Administrator defines rate limit classes
 Resolved• ClarakosiT257603 Implement private JWT claims support in OAuth2 extension
 Duplicate• PcheloloT257604 Upstream private claims support to oauth2-server
 ResolvedNoneT257607 Develop OAuthRateLimiter extension
 Resolved• PcheloloT258423 Deploy OAuthRateLimiter extension to Wikimedia Production
 Resolved• KormatT258711 Review request for a new database table for OAuthRateLimiter
 Resolved• GillesT258824 Performance review of OAuthRateLimiter
 ResolvedReedyT257930 Security Readiness Review For OAuthRateLimiter
 ResolvedReedyT260587 Security Readiness Review For Wikimedia/oauth2-server
 ResolvedReedyT260588 Security Readiness Review For Adding Private Claims To OAuth Extension
 Resolved• eprodromouT246274 API Developer support universal rate limit
 ResolvedhnowlanT246277 Client Developer gets informative error when going over rate limit
 ResolvedhnowlanT235272 Client Developer has a preferred API server
 Resolved• eprodromouT254794 Envoy API Gateway Implementation
 ResolvedhnowlanT254908 API Gateway LVS Endpoint
 ResolvedhnowlanT254910 Metrics and dashboards for API Gateway
 ResolvedhnowlanT254913 Integrate Envoy API Gateway into critical path
 ResolvedhnowlanT254906 Basic Helm chart covering just Envoy, no rate limiting
 Resolved• eprodromouT246282 Administrator defines default rate limit class for new Client Developers
 Resolved• PcheloloT256769 Client Developer makes unauthenticated sample API calls
 Resolved• eprodromouT256771 Client Developer makes an API call from the Web browser
 Resolved• PcheloloT260795 Client Developer gets machine-readable results for failed routes
 Resolved• eprodromouT255032 Wikimedia API Gateway Public Launch
 Resolved• PcheloloT246276 Adminstrator sets API rate limit for clients without an API key
 Resolved• PcheloloT246280 Administrator assigns Client Developer to rate limit class
 ResolvedapaskulinT255480 API Portal: Create Core REST API reference docs
 ResolvedapaskulinT255481 API Portal: Create Wikifeeds API reference docs
 ResolvedhnowlanT256765 Client Developer reads pages on API Portal
 Resolved• eprodromouT258439 API Portal: Libraries for MediaWiki OAuth 2.0
 Resolved• eprodromouT257951 API Portal: App terms of service
 DeclinedNoneT255034 Wikimedia API Gateway Long-term Use
 Resolved• eprodromouT246260 API Developer mounts new API on path
 Resolved• eprodromouT246263 Administrator unmounts API from path
 Resolved• eprodromouT246264 Curator chooses available APIs
 Resolved• eprodromouT246268 API Developer uses OAuth 2.0 for authentication and authorization
 DeclinedNoneT253776 [API Gateway] Administrator defines burst limit
 DeclinedNoneT253777 [API Gateway] Administrator defines connection limit
 ResolvedapaskulinT250304 Add use case landing pages
 DeclinedNoneT250306 API Portal: Define programming language landing pages
 DeclinedNoneT253887 [API Gateway] Administrator limits number of client IDs per Client Developer
 DeclinedNoneT246275 [API Gateway] Client Developer get API usage data
 DeclinedNoneT246279 [API Gateway] Client Developer gets rate limit notification
 DeclinedNoneT259176 [API Gateway] Display client rate limit in the API Portal
 ResolvedakosiarisT251812 System administrator reviews API usage by client
 Resolved• PcheloloT259736 Unify access log schema for Action API and API Gateway/REST API
 ResolvedJMeybohmT260536 Package an up to date version of fluent-bit / td-agent-bit for buster
 Resolved• PcheloloT260626 Enable TLS for api-gateway -> eventgate access log delivery
 Resolved• PcheloloT260820 Followups to access logging after envoy 1.16
 Resolved• eprodromouT261002 Ingest api-gateway.request events to turnillo
 ResolvedNoneT258748 Client Developer has a cookie-free API call
 ResolvedhnowlanT259294 Configure API Portal to only send session cookie to its own routes
 ResolvedhnowlanT259296 Filter cookie headers for all API route requests
 ResolvedBCornwallT260943 Don't set cookies for api.wikimedia.org at the caching layer
 DeclinedNoneT259722 [API Gateway] Product Manager reads registered OAuth Client ID metrics
 DeclinedNoneT259724 [API Gateway] Product Manager reads Active OAuth Client ID metrics
 Resolved• PcheloloT246278 Client Developer gets rate limit headers
 Resolved• PcheloloT259544 Drop lua filter from api-gateway envoy
 OpenFeatureNoneT254190 Allow developers to disable their own OAuth clients
 Resolved• bd808T411176 Disable OAuth User-only consumer
 OpenNoneT261902 Rename OAuth consumer management endpoints
 DeclinedNoneT265145 [API Gateway] Client Developer reads Feed Availability Endpoint
 ResolvedJMeybohmT258934 [API Gateway] Move ratelimiter to its own chart outside of the api-gateway
 DeclinedhnowlanT260056 [API Gateway] Add validation of Envoy configuration to deployment-charts Rakefile
Resolved• ClarakosiT254914 Finalise Envoy configuration with completed Rate Limiter
 Resolved• ClarakosiT260591 Move rate limits configuration from route to virtual host
 Resolved• ClarakosiT261350 Envoy ratelimit config cleanups after 1.16
 DeclinedNoneT254917 Implement API Gateway solution for deployment-prep
 DeclinedNoneT269156 [API Gateway] Change how client credentials are handled in the rate limiter
 Resolved• PcheloloT268791 Allow Api-User-Agent header in API Gateway requests
 ResolvedapaskulinT255482 API Portal: Document stability policy
 ResolvedapaskulinT253067 API Portal: Document security best practices
 ResolvedapaskulinT255486 API Portal: Document authorization flows
 DeclinedNoneT259178 [API Gateway] Document process for client developers to request a higher rate limit
 ResolvedhnowlanT254916 Define base set of SLOs covering API Gateway
 DeclinedhnowlanT263727 Separate mediawiki latency metrics by endpoint
 ResolvedcolewhiteT263728 mtail 3.0.0-rc35 doesn't support the histogram type in -oneshot mode.
 DeclinedNoneT258757 Write unit tests for WikimediaApiPortalOAuth
DuplicatehasharT265407 Create a coverage job for skins
 ResolvedNoneT254950 Performance review of WikimediaApiPortalOAuth extension
 ResolvedapaskulinT259140 Decide if $wgRawHtml is needed, and if so, necessary mitigations

Event Timeline

• eprodromou created this task.Oct 11 2019, 3:04 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 11 2019, 3:04 PM
• eprodromou moved this task from Inbox to Initiatives on the Platform Engineering board.Oct 11 2019, 3:04 PM
• eprodromou updated the task description. (Show Details)Oct 11 2019, 3:40 PM
• eprodromou updated the task description. (Show Details)
• eprodromou updated the task description. (Show Details)
• eprodromou edited projects, added: Core Platform Team Initiatives (API Gateway); removed: Platform Engineering.Oct 11 2019, 4:00 PM
tstarling mentioned this in T237555: Config change to enable MW REST API.Nov 6 2019, 10:24 PM
• eprodromou renamed this task from Wikimedia REST API to Wikimedia API Gateway.Feb 26 2020, 7:14 PM
• eprodromou updated the task description. (Show Details)Feb 26 2020, 7:53 PM
• eprodromou triaged this task as Medium priority.Mar 10 2020, 8:43 PM
• eprodromou added a project: Platform Engineering.
• eprodromou mentioned this in T246379: Research rate limiter implementations and rate limiter-capable HTTP reverse proxies.Mar 11 2020, 5:35 PM
• eprodromou added a project: Platform Team Workboards (Initiatives).Mar 17 2020, 3:22 PM
• eprodromou moved this task from Later to Now on the Platform Team Workboards (Initiatives) board.
• CCicalese_WMF added a subtask: T247837: Create API Portal MVP.Mar 18 2020, 4:20 PM
• CCicalese_WMF removed a project: Platform Engineering.Mar 18 2020, 5:06 PM
Eevans added a subtask: T248543: Evaluate Envoy proxy for API gateway (and rate-limiter).Mar 26 2020, 12:54 AM
Eevans closed subtask T248543: Evaluate Envoy proxy for API gateway (and rate-limiter) as Resolved.Apr 10 2020, 3:43 PM
Naike subscribed.Apr 14 2020, 4:51 PM
• eprodromou mentioned this in T210790: Allow cross-origin requests by default in the Action API.Apr 16 2020, 7:02 PM
• eprodromou closed subtask T235271: Wikimedia public API domain as Resolved.Jun 10 2020, 3:43 PM
• eprodromou mentioned this in T235271: Wikimedia public API domain.
• eprodromou closed subtask T246266: Wikimedia API Gateway keys as Resolved.Jun 10 2020, 3:49 PM
• eprodromou mentioned this in T246266: Wikimedia API Gateway keys.
• eprodromou closed subtask T246269: API Rate Limiting as Resolved.Jun 10 2020, 4:51 PM
• eprodromou mentioned this in T246269: API Rate Limiting.
Xinbenlv subscribed.Jul 8 2020, 6:46 PM
Reedy changed the status of subtask T259138: WikimediaApiPortal skin Bootstrap 5.x upgrade from Open to Stalled.Jul 29 2020, 2:59 PM
WMDE-leszek subscribed.Aug 25 2020, 1:07 PM
• eprodromou removed a subtask: T259138: WikimediaApiPortal skin Bootstrap 5.x upgrade.Aug 25 2020, 4:01 PM
Reedy mentioned this in T260587: Security Readiness Review For Wikimedia/oauth2-server.Aug 27 2020, 9:23 PM
apaskulin closed subtask T259140: Decide if $wgRawHtml is needed, and if so, necessary mitigations as Resolved.Aug 31 2020, 8:57 PM
• eprodromou closed subtask T255030: Wikimedia API Gateway MVP as Resolved.Oct 7 2020, 2:38 AM
• eprodromou closed subtask T255032: Wikimedia API Gateway Public Launch as Resolved.Dec 15 2020, 6:57 PM
apaskulin closed subtask T247837: Create API Portal MVP as Resolved.Dec 18 2020, 10:50 PM
apaskulin closed this task as Resolved.Jan 8 2021, 12:48 AM
apaskulin subscribed.

The API Gateway and Portal are both deployed to production

Krinkle closed subtask T255034: Wikimedia API Gateway Long-term Use as Declined.Jul 12 2026, 10:08 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits