API Manager is a Platform Tools feature that wraps your automations, AI models, external APIs, and event streams as governed REST APIs — with authentication, policies, rate limits, and monitoring included. It acts as a wrapper layer: any resource you have built becomes a secure, observable API without extra infrastructure.
Overview
The API Manager gives you a managed gateway between your internal work on UnifyApps and the outside world. It wraps whatever you have built — an automation, a model, a third-party API — and exposes it as a governed REST endpoint that callers can reach with standard credentials. Instead of wiring integrations by hand, you expose an endpoint, group it inside a collection, decide who can call it via a client and access profile, and apply policies that enforce authentication, rate limits, and transformations. The platform then handles the public URL, auth validation, traffic rules, and the Insights dashboard automatically.
_-new.png&w=1920&q=75)
_-new.png)
Building Blocks
Five pieces work together to form a managed API:
Collection — a group of related endpoints published under one base path and version (for example, "Orders API v1").
Endpoint — a single REST operation (a path + HTTP methods) backed by something you built.
Client — an external application or partner that consumes your APIs.
Access profile — how a client authenticates and which collections or endpoints it may call.
Policy — a reusable rule applied to requests or responses: rate limits, validation, CORS, transformations, and more.
A managed API is the combination: endpoints grouped in a collection, exposed to clients through access profiles, governed by policies.
Publishing an API End to End
The typical path from idea to live API:
Create a collection — set its base path, version, and any collection-level policies.
Add endpoints — for each, set the path, HTTP methods, the backing resource (Callable, Webhook, LLM Model, External API, or Event Stream), and the request and response schemas.
Apply policies — attach rate limits, request validators, or other rules at the collection or endpoint level.
Register a client and create an access profile — pick an authentication method and scope it to the right collections and endpoints.
Share the URL and credentials with the consumer, or export an OpenAPI spec, and watch traffic on the Insights dashboard.
What You Can Expose as an Endpoint
An endpoint can front one of five resource types, and each is invoked differently:
Resource Type | How It Is Invoked |
|---|---|
Callable | A synchronous automation: the call runs it and waits for its output. |
Webhook | An asynchronous automation: the call is accepted immediately and the automation runs in the background. |
LLM Model | A large language model exposed as an API; the call passes the payload and returns the model's response. |
External API | An upstream third-party API the platform proxies to, adding your own auth, rate limits, and monitoring. |
Event Stream | An event topic; the call publishes the request payload as an event. |
Notes
Create one client per external consumer so you can grant, monitor, and revoke access independently.
Apply policies at the collection level for broad rules, then tighten per endpoint or per access profile.
Export an OpenAPI spec from any collection to share a machine-readable contract with consumers.
Check the Insights dashboard after publishing to confirm traffic is flowing and to catch early errors.
The same endpoint mechanics — auth, policies, monitoring — apply to all five resource types.