A named API that is not exposed on any port and can only be invoked by other APIs within the gateway using the internal://name URL scheme. Use it to factor out shared flow logic that multiple APIs call.

Example Configuration

internal:
   name: shared-auth
   flow:
     - setHeader:
         name: X-Api-Key
         value: downstream-secret
   target:
     url: https://api.example.com

 ---
 api:
   port: 2000
   target:
     url: internal://shared-auth

 ---
 api:
   port: 3000
   target:
     url: internal://shared-auth

internal:
   name: shared-auth
   flow:
     - setHeader:
         name: X-Api-Key
         value: downstream-secret
   target:
     url: https://api.example.com

 ---
 api:
   port: 2000
   target:
     url: internal://shared-auth

 ---
 api:
   port: 3000
   target:
     url: internal://shared-auth

Syntax

internal:
  '$ref': <string>
  flow:
    - <flow>
  host: <string>
  ip: <string>
  name: <string>
  path: {}
  port: <int>
  ssl: {}
  target: {}

internal:
  '$ref': <string>
  flow:
    - <flow>
  host: <string>
  ip: <string>
  name: <string>
  path: {}
  port: <int>
  ssl: {}
  target: {}

Attributes

Name	Required	Default	Description	Examples
$ref	false	-	Reference a component defined under components.	-
host	false	not set	Restricts to requests whose `Host` header matches one of the given hostnames. Separate multiple hostnames with spaces. The asterisk `*` matches any number of characters, including zero, for basic globbing.	predic8.de *.predic8.de
ip	false	not set	If present, binds the port only on the specified IP. Useful for hosts with multiple IP addresses.	127.0.0.1
name	false	By default, a name will be automatically generated from the target host, port, etc.	The name as shown in the Admin Console.	-
port	false	80	The port Membrane listens on for incoming connections.	8080

Child Structure

Element	Cardinality	Description
flow	0..*
path	0..1	Restricts to requests whose path matches, either by prefix (starts-with) or, when enabled, by regular expression. In a `soapProxy`, setting a path also rewrites the paths of SOAP requests and the service addresses in the WSDL accordingly.
ssl	0..1	Configures a TLS context: the identity (key and certificate) presented to the peer, the certificates trusted from it, and handshake parameters such as protocol, ciphers, and client-certificate policy. Attach it to a `serviceProxy`/`api` to terminate inbound TLS, or to a `target` to make an outbound connection over TLS; most attributes and child elements apply to both directions, but a few - such as `clientAuth` and `useAsDefault` - only take effect on an inbound context. See `tutorials/ssl-tls/10-TLS-Termination.yaml` for inbound termination and `tutorials/ssl-tls/20-Central-SSL-Config.yaml` for sharing one `ssl` across several APIs via `$ref`.
target	0..1	The backend server that requests are forwarded to after passing through the flow.

Can be used in

No parent elements.