API management · Kong Konnect
API management platform in Saudi Arabia: what it covers and how Kong Konnect delivers it
An API management platform is the set of tools that lets an organisation publish, secure, observe and retire its APIs in one place: a gateway every call passes through, a developer portal where consumers register, security policies, traffic analytics and lifecycle rules. Interkey implements it on Kong, with Kong Konnect as the control plane where that suits, in the shape your data allows: on infrastructure you operate in the Kingdom, or with configuration managed as a service.
In short, for executives
- What it is: one platform for every API you expose: gateway, developer portal, security, analytics and lifecycle.
- What Interkey implements: Kong Gateway, managed from Kong Konnect or a self-managed control plane. Kong Inc. is one of Interkey's technology partners.
- Where it runs: traffic can stay on infrastructure you operate in Saudi Arabia in every option; where configuration lives is a classification decision.
- What it costs: Kong licensing at the vendor's terms, plus Interkey's work, on separate lines.
- What it does not do: fix an unsafe service behind it.
At a glance
| Question | Answer |
|---|---|
| What it covers | Gateway, developer portal, security policies, traffic analytics and API lifecycle |
| Product Interkey implements | Kong Gateway, with Kong Konnect or a self-managed control plane |
| Where traffic is handled | Data planes on your servers, in a cloud account you control, or on Kubernetes |
| Where configuration is held | A self-managed control plane in the Kingdom, or Konnect, Kong's hosted control plane |
| How it is licensed | At Kong's terms; some features need the Enterprise edition |
| From Interkey | API inventory, design, deployment, migration of consumers, support from Riyadh and operation |
What a full API management platform covers
Buyers often compare platforms on the gateway alone. A working API management solution has five parts, each with an owner.
| Part | What it does | How Kong provides it |
|---|---|---|
| Gateway | Routes every call to the right service and applies the same rules to each one | Kong Gateway, deployed traditional, DB-less or with a separate control plane and data planes |
| Developer portal | Lets internal teams and partners find APIs, read their documentation and register for access | The Kong Konnect Developer Portal, including Dynamic Client Registration, as Kong describes it |
| Security | Checks who is calling, what they may call and how often | Plugins such as Key Auth, JWT, OAuth 2.0, ACL and Rate Limiting; OpenID Connect and Mutual TLS in the Enterprise edition |
| Analytics | Shows traffic, errors and latency per API and per consumer | Logging and metrics from the gateway, sent to your observability platform |
| Lifecycle | Moves each API from design to versions to retirement without breaking consumers | Configuration as code with Kong's decK tool, and request validation against the API specification (OAS Validation, Enterprise) |
Which features need the Enterprise edition changes over time, so we check Kong's current terms against your list before quoting.
API management platform, API gateway and APIM: what each term means
Proposals use these terms loosely. The API gateway is the runtime every call passes through, covered on our API gateway page. API management, or APIM, is the practice around it: inventory, written policy, onboarding and deprecation. Our API management practice page explains why these come before any product.
The API management platform is the product set that carries that practice: the gateway plus the portal, analytics and lifecycle tools. Without the practice, a platform only exposes the gaps faster.
RelatedAPI management practice page
Where Kong Konnect and the gateway run
Kong separates the control plane, which holds configuration, from the data planes, which carry traffic. Kong documents Konnect as its control plane, offered in several regions including one labelled Middle East, with data planes in your environment.
| Option | Control plane | Data planes | Suits |
|---|---|---|---|
| Self-managed in the Kingdom | On infrastructure you operate in Saudi Arabia | On your servers or virtual machines in Saudi Arabia | Neither payloads nor configuration may leave, and a team will own the platform |
| Konnect with on-premise data planes | Konnect, hosted by Kong as a service | In your own data centre | Payloads must stay; configuration metadata may leave; the operating team is small |
| Konnect with cloud data planes | Konnect, hosted by Kong as a service | In a cloud account you control, for example in a cloud provider's region inside the Kingdom | Workloads already run in a cloud region and the APIs serve them there |
| Kubernetes ingress | Either of the above | Inside the cluster, through Kong Ingress Controller | Services already on Kubernetes; combines with any option above |
The Saudi question is what leaves the Kingdom. The data plane reads every request and response, so it runs where your classification allows payloads to be processed. Configuration and usage metadata go to the control plane: settle where that sits with your security team before design. If the control plane goes offline, data planes keep running on their last known configuration. Our Kong implementation page compares what each option costs to operate.
API lifecycle management, from design to retirement
Most API problems are lifecycle problems: an API nobody owns, a version changed without notice, an old route left open for years. The platform helps only when the lifecycle is written down and the tools enforce it.
Read more
- Design. Each API starts from a specification that the gateway validates against and the portal publishes.
- Publish. Routes, plugins and consumers are declared in version-controlled configuration with decK, never edited by hand on a node.
- Onboard. Consumers register through the portal and receive credentials and limits once the API's owner approves. Our developer portal guide covers this step.
- Version. A breaking change becomes a new version, and consumers of the old one are told in writing.
- Retire. The old version has a date, and on that date its route is closed.
Relateddeveloper portal guide
Security and analytics on the platform
Security on the platform means one identity source, the identity platform you already run, and the same authentication, access control and rate limits on every API. Limits are set per consumer from the inventory, as our rate limiting guide explains. A gateway cannot see broken authorisation inside a service or excess data in a response; our API security page maps each risk to the gateway or the service.
Analytics should answer plain questions: which consumer calls which API, how often, with what errors and how fast. We send the gateway's logs and metrics to your observability platform, such as Datadog, with an owner for each alert.
Relatedrate limiting guide
Where organisations in the Kingdom use an API platform, and who supports it
- Partner and government integrations: each outside party gets its own credentials, limits and log trail.
- Mobile and web back ends: one gateway protects many services from public traffic.
- Banking and fintech APIs: the gateway is the API layer inside a wider programme, as our open banking page explains.
- Internal microservices: teams stop building authentication and limits into each service.
- Calls to large language models: Kong AI Gateway applies token budgets and prompt rules.
Read more
Support from Riyadh. Interkey's engineers work from Riyadh, in Arabic and English, on the Sunday-to-Thursday week. We test Arabic and mixed-script payloads through the gateway before go-live, so right-to-left data passes unchanged. Afterwards we either support your platform team or operate the gateway as a managed service under a written scope, with each upgrade rehearsed and a rollback plan agreed.
What drives the cost of an API management platform
Kong licensing, where the Enterprise edition or Konnect is needed, is quoted at Kong's terms. This page prints no prices, because the number depends on choices you make first:
- Features. Whether you need Enterprise-only plugins such as OpenID Connect, Mutual TLS or Rate Limiting Advanced.
- Deployment option. Self-managed means operating a control plane and its database; Konnect moves that work to Kong.
- Environments and sites. Each production, test and recovery environment adds gateways to run.
- Consumers to move. Effort grows with the consumers and direct routes to close.
- Operation. Support for your team, or full operation by Interkey.
Our quote shows the licence, the implementation and any operation scope on separate lines.
How Interkey delivers an API management platform
-
Inventory and policy.
List the APIs, their owners and consumers, and write the rules the platform will enforce.
-
Choose the option.
Self-managed or Konnect, where each plane runs, and whether Kubernetes ingress is part of it.
-
Build as configuration.
Gateways, plugins, portal and telemetry as version-controlled configuration, tested before production.
-
Move consumers.
Each consumer onboarded through the gateway, its direct route closed.
-
Operate and hand over.
Support from Riyadh, a managed service, or runbooks and training.
Questions buyers ask
What does an API management platform include beyond the gateway?
A developer portal where consumers find and register for APIs, security policies on every call, analytics per API and per consumer, and tools to version and retire APIs. The gateway enforces the rules; the rest publishes, measures and changes them.
Can Kong Konnect keep our API traffic inside Saudi Arabia?
The data planes that carry traffic run in your environment, so they can sit in your data centre or a cloud account in the Kingdom. Konnect itself, the control plane, is hosted by Kong and receives configuration and usage metadata. If that may not leave the Kingdom, a self-managed control plane keeps both planes on your infrastructure.
How is Kong licensed, and what drives the cost of an API platform in KSA?
Kong licensing is quoted at Kong's terms and depends on the edition and features you need, such as Enterprise-only plugins. The rest comes from the deployment option, the number of environments, the consumers to move and the operation scope.
How long does it take to roll out an API management platform?
It depends on the APIs and consumers in scope, whether an inventory exists, your security review and the number of environments. Deploying the gateway is the short part; moving consumers takes longer. We give an estimate after the inventory, not before it.
Do we need a developer portal if our APIs are only internal?
Often yes, once more than a few teams consume them. A portal gives each team one place to find documentation and request access. For a small internal estate, specifications in a repository may be enough to start.
Who supports our Kong API platform once it is live, and in which language?
Kong supports the product under its licence. Interkey supports your platform from Riyadh, in Arabic and English: configuration, upgrades, onboarding and incidents, backing your team or operating the gateway under a written scope.
Next
Read next
Next step
Plan your API management platform
Tell us roughly how many APIs you expose, who consumes them, where the data must stay and what you run today. We will propose a deployment option and the first steps of an API inventory.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia