Membrane API Gateway

for REST, OpenAPI, and GraphQL with first-class Legacy Support for XML, SOAP, and WSDL

Built on the Java platform, Membrane bridges legacy and modern APIs. It supports XML-to-JSON transformation, WSDL-to-OpenAPI conversion,SOAP-to-REST integration, and validation against OpenAPI and WSDL.

For modern APIs, Membrane supports technologies such as OAuth 2, JWT, and AI, along with a broad range of transformation, and observability features. It is easy to set up and deploy, either as a container or as a Java application.

Try Membrane in 5 Minutes

Start the API Gateway

Run Membrane as a container or as a Java application:

docker run --rm -it -p 2000:2000 predic8/membrane

Open these URLs in your browser to access sample APIs:

• http://localhost:2000 (Actual time)
• http://localhost:2000/api-docs (API deployed from OpenAPI)

Or call an API from the command line:

curl http://localhost:2000/shop/v2/products

Proxy Your First API

Create a file apis.yaml with the following content:

api:
  port: 2000
  target:
    url: https://apibin.io

Start Membrane with your configuration:

Linux/macOS:

docker run --rm -p 2000:2000 -v "$(pwd)/apis.yaml:/opt/membrane/conf/apis.yaml" predic8/membrane

Windows PowerShell:

docker run --rm -p 2000:2000 -v "${PWD}/apis.yaml:/opt/membrane/conf/apis.yaml" predic8/membrane

Requests to http://localhost:2000 are now forwarded to https://apibin.io.

Make the Getting Started Tutorial

1. Download the Membrane distribution
2. Unzip
3. Open tutorials/getting-started/10-First-API.yaml in your text editor and follow the instructions.

Why Membrane

From OpenAPI and OAuth to SOAP, XML, LLMs, and MCP, Membrane bridges modern APIs and enterprise integration.

Native OpenAPI Support

Deploy APIs directly from OpenAPI documents, validate messages against them and even generate OpenAPI specifications from legacy WSDL. In addition to OpenAPI 3.0, and 3.1, Membrane also supports OpenAPI 3.2.

Legacy XML and Web Services Integration

wsdl2openapi transforms a Web Service's WSDL into an OpenAPI and uses the underlying XSD schema for the conversion between XML and JSON. Deploy a WSDL, and Membrane exposes the service as an API with an OpenAPI description.

XML and JSON are deeply integrated into Membrane. XPath and JSONPath expressions provide direct access to message data for routing, filtering, and transformation.

Templates and XSLT allow for flexible message transformation and SOAP-to-REST conversion.

XML and Web Services Security

Secure legacy services with WSDL and XSD message validation, XML message protection, and XML signatures.

OpenAPI, JSON Schema, XSD, and WSDL Validation

Validate messages against API and service specifications. Don't let invalid messages slip into your organization.

API Orchestration

Orchestrate calls to external APIs and process collections with loops and conditional flows.

Easy Configuration and Extensibility

Take a look at the samples below and the tutorials to see what just a few lines of configuration can do.

When you need more flexibility, extend Membrane with expressions and scripting using JSONPath, XPath, Groovy, or SpEL, or write your own plugin in Java. In most cases, custom Java code is not necessary.

Speed & Footprint

Although Membrane is written in Java, it delivers high performance with a low memory footprint. HTTP streaming, Keep-Alive, and non-blocking processing enable efficient resource utilization and high throughput. The Membrane distribution is only about 55 MB, making it smaller than many other API gateways.

On a single server Membrane can process 39,000 requests per second. However, raw throughput benchmarks often measure only simple proxying without message protection or transformation.

Membrane is implemented entirely in Java, from the HTTP engine to OpenAPI processing. This avoids the overhead of crossing between a native proxy core and a separate scripting runtime for plugins.

As a result, Membrane can maintain high performance even when multiple plugins for validation, security, and transformation are active. What matters is not performance in reduced benchmark setups, but performance under realistic gateway configurations.

What Can You Do With Membrane?

• Expose and protect APIs for partners over the public Internet.
• Secure APIs with OAuth 2.0, JWT, API keys, TLS, and message validation.
• Modernize legacy services by integrating SOAP, XML, and WSDL with REST, JSON, and OpenAPI.
• Transform messages between JSON, XML, SOAP, HTTP headers, query parameters, and other formats.
• Route and control traffic with flexible rules, rate limiting, load balancing, and conditional processing.
• Use Membrane as an outgoing gateway to control access to partner and public APIs.
• Observe API traffic with logging, metrics, Prometheus, and OpenTelemetry tracing.
• Use Membrane as an AI Gateway for LLM providers and MCP servers.
• Replace maintenance-intensive Backend for Frontend (BFF) services with declarative gateway configuration where appropriate.
• Embed Membrane into your own Java applications and products.
• Deploy Membrane in containers, virtual machines, private clouds, or public clouds.

Membrane Features with Examples

For a quick overview of what you can do with Membrane, the sections below provide a selection of short examples and configuration snippets.

1. OpenAPI Deployment, Validation and Swagger UI
2. Legacy Web Services with SOAP and WSDL
   • WSDL to OpenAPI Conversion
   • API Configuration from WSDL
   • Message Validation against WSDL and XSD
   • Web Services Security (WSS)
3. AI and LLM Gateway
   • MCP Protection
   • LLM Gateway
4. Routing
5. Message Transformation
   • POST to GET with Query Parameters
   • Templates
6. Orchestration and Call Outs
7. Scripting
   • Conditional Processing With the 'if'-Statement
8. Security
   • API Keys
   • JSON Web Tokens
   • OAuth2
   • SSL/TLS
   • XML, JSON, JSON-RPC and GraphQL Protection
9. Traffic Control
   • Rate Limiting
   • Load Balancing
10. Operation

• Monitoring with Prometheus and Grafana
• OpenTelemetry Integration

1. OpenAPI Deployment, Validation and Swagger UI

OpenAPI is a native feature in Membrane. The gateway supports OpenAPI 3.0, 3.1, and 3.2, including the QUERY HTTP method.

Membrane can deploy an API directly from an OpenAPI description. It uses the defined paths, schemas, operations, and backend URLs to configure routing and, optionally, validate incoming requests and outgoing responses.

api:
  port: 2000
  openapi:
    - location: openapi/fruitshop-v2-2-0.oas.yml
      validateRequests: true

Membrane lets you explore APIs deployed from OpenAPI APIs in a single overview page.

For documentation and testing the gateway hosts also a Swagger UI for the deployed APIs.

See: [OpenAPI tutorial](distribut