When Gateways Start Solving the Wrong Problem
When Kong released version 3.1.0, it introduced an enterprise feature that customers had been asking about for years: Request Callout. On paper it looks powerful. The gateway can call an external service during the request flow, enrich headers, validate tokens, or even decide routing on the fly. For many teams this feels like the missing piece.
But the truth is that this feature exists not because the API Gateway pattern required it but because customers insisted on it. And customers insisted not because they had a deep understanding of gateways but because they were looking for shortcuts. They wanted a way to push business logic out of their services and into the infrastructure.
Kong is not alone in this. Almost every vendor in the API management space has responded to similar demands. Features are often added because “the market asked for it,” even when they blur the line between platform and product. Over time this erodes the very boundaries that patterns like the API Gateway were supposed to establish.
The role of a gateway is clear. It handles cross-cutting concerns such as security, quotas, token introspection, tenant context, and consent checks. These rules are broad, relatively stable, and belong at the edge. The moment gateways are asked to check inventory, calculate discounts, or route premium customers differently, they stop being gateways and start becoming containers for hidden business logic.
We have seen what happens when infrastructure absorbs responsibilities it should not carry. In the past, integration middleware and ESBs became overloaded with business rules. The result was brittleness, opacity, and a loss of agility. Vendors did not set out to create that complexity, but they delivered it because customers asked loudly enough.
The uncomfortable truth is that Request Callout is not a breakthrough. It is a compromise. Vendors like Kong build what customers demand, even when those demands run against the purpose of the gateway pattern. And the customers who celebrate these features often pay the price later in higher latency, complex debugging, and unclear ownership of logic.
A gateway is not a product. It is not a workflow engine. It is not the place to hide business rules. Vendors will continue to deliver what the market asks for, but it is up to us to stop asking for the wrong things.