SaaS and APIs
Keep endpoints fast under volumetric load.
Shield public APIs, webhooks and SaaS microservices against HTTP floods, slowloris and credential abuse without adding latency for legitimate developers.
- Adaptive rate budgets per API token & IP
- Hardware-accelerated TLS termination
- Zero latency penalty for verified legitimate users
Legitimate API customers100% passed with zero delay
Edge intelligence for critical API endpoints.
Public endpoints invite unpredictable traffic. Orbitel Shield validates requests at the edge before they can consume backend compute or database capacity.
- 1
Route domain or prefix
Route your API domain via DNS proxy or announce your backend API IP range over BGP, directing requests to our global edge.
- 2
Edge TLS termination
Hardware-accelerated TLS termination absorbs handshake floods and validates HTTP headers before traffic touches your origin.
- 3
Adaptive rate limiting
Each API consumer, token, or IP is held to their fair-use budget. Malicious traffic is throttled while legitimate calls pass instantly.
- 4
Origin shielding
Only verified, rate-compliant API requests are proxied or tunneled to your cloud microservices or Kubernetes clusters.
Granular control over paths, methods, and rates.
Hold aggressive crawlers and malicious bots to strict budgets, while ensuring loyal users and paying enterprise customers experience zero delay.
Defend against API abuse without CAPTCHAs
API consumers cannot solve CAPTCHAs. Orbitel Shield uses cryptographic proof-of-work, TLS fingerprinting, and behavioral rate budgets to stop bot abuse transparently.
Protect backend microservices & databases
An unmitigated flood against an un-cached search or report endpoint can take down your database. Our edge stops malformed and abusive queries first.
Seamless Kubernetes & cloud integration
Works with AWS, Google Cloud, Azure, and bare-metal ingress controllers. Traffic arrives through encrypted tunnels with original client IP preserved.
Legitimate API customers100% passed with zero delay
Built for modern cloud architectures.
Comprehensive application-layer protection designed for developers and DevOps teams building on Kubernetes, cloud, and hybrid stacks.
Adaptive rate limiting
Enforce granular rate limits per API key, client IP, or path (such as /v1/auth/login or /v1/checkout) to prevent endpoint exhaustion.
TLS handshake flood defense
Absorbs resource-heavy SSL/TLS renegotiation and ClientHello floods at the edge, freeing your origin CPU from crypto overload.
Slowloris & slow POST protection
Identifies clients that send HTTP headers or bodies byte-by-byte to exhaust backend worker pools, dropping them immediately.
GraphQL & REST protection
Caps maximum payload size, deep pipelining, and recursive query floods that attempt to trigger database DOS conditions.
Edge caching for read APIs
Frequently queried GET endpoints can be safely cached at our global edge, dramatically cutting latency for global users.
Zero impact on real API users
Legitimate users and verified integration partners bypass rate throttling, maintaining reliable SLAs for enterprise clients.
Technical specifications.
Supported API protocols, TLS encryption, and rate-limiting features.
- Protocols
- HTTP/1.1, HTTP/2, WebSockets, gRPC, and REST/GraphQL APIs
- Rate limiting
- Dynamic token bucket per source IP, authorization header, or path prefix
- TLS offloading
- Modern TLS 1.2 and 1.3 with automated certificate provisioning and OCSP stapling
- Payload limits
- Configurable request line, header count, and maximum body size restrictions
- Timeout guards
- Aggressive timeouts for Slowloris, slow POST, and hanging HTTP keepalive connections
- Origin connection
- WireGuard/GRE tunneling or encrypted edge reverse proxy
Questions, answered.
Can’t find what you need? Talk to an engineer.
Can we protect GraphQL and WebSocket APIs?
Yes. Orbitel Shield fully supports persistent WebSocket connections, GraphQL POST endpoints, and gRPC streaming while enforcing depth, payload, and frame rate restrictions.
How do you preserve client IP addresses for our API logs?
For reverse-proxy traffic, original client IPs are forwarded via standard True-Client-IP and X-Forwarded-For headers. For tunneled BGP traffic, raw packets reach your routers with untouched original IP headers.
Can we whitelist webhooks and partner integrations?
Yes. You can define static IP whitelists and path exemptions for payment gateways (e.g. Stripe, PayPal), continuous integration webhooks, and enterprise partner endpoints.
What happens during a massive volumetric flood?
Volumetric floods (L3/L4 UDP/TCP floods and L7 HTTP floods) are scrubbed at our global edge. Your backend servers only receive clean, filtered API requests within your configured capacity.