General specifications
Refer to the following table for technical APEX Cloud specifications.
| Feature | Defaults | Can be increased/decreased? (Quotas) |
|---|---|---|
| Authentication | Inbound: JWT Authentication API Key (for non-sensitive APIs) OAuth 2.1 (for G2B* consent flow) Outbound: API Key, MTLS, AWS Signature v4, custom policies |
Not Applicable |
| Data-in-Transit | Inbound: TLS v1.2 Outbound: TLS v1.2 |
Not Applicable |
| OpenAPI Specification (OAS) Compatibility | Up to 3.0.2 | Not Applicable |
| JWT Authentication - JWT Issued At Time Drift |
5 seconds | No |
| JWT Authentication - JWT Expiry Time |
180 seconds | No |
| Authorization | Token-based AuthZ with OAuth, OAuth with Singpass/Corppass |
Not Applicable |
| Protocols Supported | SOAP, REST, JSON, XML | Not Applicable |
| Payload Size Limit (Send) | 10 MB | No |
| Payload Size Limit (Receive) | 10 MB | No |
| Concurrent connections | 128 | Yes |
| Connection timeout | 30 seconds | Yes (to max 60 seconds) |
| Active timeout | 30 seconds | Yes (to max 60 seconds) |
| Max Transaction Per Second (API) | 20 (Staging only) | Yes |
| Max Transaction Per Second (Application) | 20 (Staging only) | Yes |
| API Deprecation Header | x-api-deprecated | Not Applicable |
| API Retirement Date Header | x-api-retire-time (in UTC) | Not Applicable |
| Supported Data Classification | Confidential Cloud Eligible (CCE) or lower | Not Applicable |
| Supported Data Sensitivity | Sensitive (Normal) or lower | Not Applicable |
*Government-to-Business. i.e. Business consuming government APIs.
About Payload Handling and Data Protection
Important: API providers remain responsible for application-level security, including validation and protection against malicious or malformed payloads, and should not rely on the API Gateway for comprehensive threat detection.
