I'm studying for the CCSP exam and am confused on the difference between an "API gateway" and "XML gateway". The training material I have states:
API gateways are also an important part of a layered security model. They can be used to impose such controls on API activity as
- Acting as an API proxy so as to not directly expose the API.
- Implementing access control to the API
- Limiting connections so that bandwidth is available for all applications, which can also help in the event of an internal DoS or DDoS attack.
- Allowing for API logging
- Allowing for metrics to be assembled from API access logs.
- Providing for additional API security filtering.
XML gateways work in much the same way, except they work around how sensitive data and services are exposed to APIs. They can be either software- or hardware-based and can implement some types of data loss prevention (DLP).
And that's it. I still don't get a good sense of what the difference is here. Can someone elaborate, ideally with a practical example?
I asked Mr. Google and got results for an Oracle product/feature but this seems much more like a generic industry tool.