What is the difference between an API gateway protection schema and a machine learning (ML) API protection schema?

An API gateway protection schema is configured by importing a formal specification, such as an OpenAPI file. This specification allows for the explicit definition and strict validation of diverse data types beyond simple strings, including integer, number, boolean, array, and object, along with specific formats (e.g., int32, date-time). This creates a rigid, contract-based validation.

In contrast, the machine learning (ML) schema learns from observing live traffic. While modern versions can infer basic types like "number", its core analysis is based on modeling patterns, character sets, and lengths of parameter values, which are fundamentally processed as strings. The gateway schema's reliance on a rich, predefined type system is a key architectural difference.

A. An API gateway protection schema does not preclude authentication; it is a validation layer that works alongside authentication and authorization policies to secure APIs.

B. Both API gateway and ML protection schemas in FortiWeb primarily focus on validating incoming API requests to protect the server, not on validating or handling response bodies.

D. Both schema types require administrator intervention to be updated. A gateway schema requires a new specification file to be uploaded, while an ML schema requires the administrator to initiate a relearning cycle.

1. FortiWeb 7.0 Administration Guide:

In the section "Configuring API protection using an OpenAPI file" (p. 478)

the guide states: "You can import an OpenAPI file to define the API to be protected... FortiWeb validates the API requests against the definitions in the OpenAPI file

including URL

parameters

data types

and so on." This confirms the use of explicit

predefined data types for gateway schemas.

In the section "Machine Learning for API Protection" (p. 492)

under "What FortiWeb learns for APIs

" the guide lists learned attributes like "Minimum and maximum length of the parameter value" and "Character set of the parameter value." This highlights its pattern-based analysis

which is fundamentally different from the strict type enforcement of a gateway schema.

2. OpenAPI Specification 3.0.3:

In the "Data Types" section

the specification details the primitive data types (string

number

integer

boolean

array

object) and format modifiers (float

double

int32

int64

date

date-time

etc.) that can be used. This demonstrates the rich

formal type system that an API gateway schema leverages for validation

a capability distinct from the inferential nature of ML-based protection. (Source: https://spec.openapis.org/oas/v3.0.3#data-types)