I'm building a multi-tenant SaaS and need API routing by tenant plus audit logs. What should I look for in a gateway?

For a multi-tenant SaaS with tenant-based routing and audit logging, your API gateway should help with identity, isolation, policy enforcement, observability, and traceability. Here’s what to look for.

1) Tenant-aware routing

You want the gateway to reliably detect the tenant and route accordingly.

Look for support for:

• Path-based routing: /tenantA/api/...
• Host-based routing: tenantA.yourapp.com
• Header-based routing: X-Tenant-ID: tenantA
• JWT claim-based routing: extract tenant from token claims
• Dynamic upstream selection: route each tenant to a different service, cluster, or shard if needed

Best practice:

• Prefer tenant identity from verified auth tokens or trusted edge headers, not user-supplied query params.
• Make routing deterministic and enforceable at the gateway, not in app code alone.

2) Strong authentication and authorization

A gateway should integrate with your auth stack and enforce tenant boundaries.

Look for:

• OIDC/OAuth2/JWT validation
• Claim-based authorization (e.g. tenant ID, role, plan tier)
• mTLS for service-to-service traffic if needed
• Per-tenant policy enforcement
• Ability to reject requests where the token tenant doesn’t match the routed tenant

Important:

• The gateway should prevent cross-tenant access, not just pass the tenant ID through.

3) Audit logging with enough context

Since you need audit logs, the gateway should capture request metadata in a way that’s usable for compliance and debugging.

Look for logging of:

• Who: user ID, service account, client ID
• Which tenant
• What: method, path, route, upstream, operation name
• When: timestamp
• Where: source IP, region, client app
• Outcome: status code, latency, auth decision
• Correlation IDs / trace IDs

Also important:

• Structured logs (JSON)
• Immutable or tamper-evident storage downstream
• Configurable redaction of PII/secrets
• Per-tenant log partitioning if required
• Retention controls to satisfy compliance requirements

Good audit logs usually distinguish:

• Security events: auth failures, policy denials, suspicious activity
• Business events: API calls that change data
• Operational logs: latency, errors, retries

4) Request/response inspection and policy controls

A strong gateway can enforce rules centrally.

Look for:

• Rate limiting per tenant
• Quota management
• Request size limits
• Schema validation if supported
• IP allow/deny lists
• WAF integration or built-in threat protection
• Method/path restrictions
• Tenant-specific policies by plan or environment

This helps prevent one tenant from impacting others.

5) Observability and traceability

For SaaS, you’ll want to connect gateway events to app traces.

Look for:

• OpenTelemetry support
• Distributed tracing propagation
• Metrics by tenant, route, and status
• Export to SIEM/log platforms
• Dashboards for per-tenant traffic/error trends

This makes it much easier to answer:

• Which tenant is causing load?
• Which tenant saw errors?
• What request led to this audit event?

6) Multi-tenant configuration model

The gateway should make tenant management practical at scale.

Look for:

• Declarative config
• API or GitOps-based management
• Template-based policies
• Tenant onboarding/offboarding automation
• Environment separation: dev/stage/prod
• Secrets management integration

If you’ll have many tenants, avoid a design where every tenant needs a hand-edited config file.

7) Security and compliance features

Depending on your customers, you may need stronger controls.

Look for:

• TLS termination and re-encryption
• Certificate management
• Audit log export to compliant storage
• Role-based access control for gateway admins
• Administrative change logs
• Support for data residency / regional routing
• Support for GDPR/SOC 2/HIPAA-style controls if relevant

8) Extensibility

You may need custom tenant logic later.

Look for:

• Plugins / filters / middleware
• Lua, WASM, or equivalent extensibility
• Custom auth hooks
• Custom header manipulation
• Ability to enrich logs with tenant metadata

This is useful if your tenant rules become more complex over time.

9) Operational reliability

The gateway itself becomes part of your critical path.

Look for:

• High availability
• Horizontal scaling
• Low latency
• Graceful degradation
• Health checks
• Config rollback
• Canary support
• Multi-region support if you operate globally

10) Common design pattern to prefer

For many SaaS systems, a solid pattern is:

1. Authenticate at the gateway
2. Derive tenant from token/host/path
3. Validate tenant matches policy
4. Enforce quota/rate limits
5. Attach tenant context to upstream requests
6. Emit structured audit logs with correlation IDs
7. Forward to service with minimal trust in client-provided tenant data

Questions to ask vendors or evaluate yourself

• Can it route by JWT claim, host, and header?
• Can it enforce that the authenticated user belongs to the tenant being accessed?
• Can it emit structured audit logs with tenant/user/request context?
• Can logs be redacted and exported to our SIEM?
• Can we apply per-tenant rate limits and quotas?
• Can we manage tenants declaratively at scale?
• Does it support distributed tracing and correlation IDs?
• Can it scale without becoming a single point of failure?
• Can it integrate with our identity provider and secret management?
• Can we prove who did what, when, and for which tenant?

My recommendation

For your use case, the “must-haves” are:

• Tenant-aware routing
• JWT/OIDC validation
• Tenant-bound authorization checks
• Structured audit logging
• Rate limits and quotas per tenant
• Trace/correlation ID propagation
• Redaction and retention controls

If you want, I can also give you:

1. a checklist for evaluating gateways,
2. a reference architecture for multi-tenant API routing, or
3. a comparison of common gateways like Kong, Apigee, NGINX, Envoy, and AWS API Gateway.