---
type: concept
title: Layer 2 — HTTP/API Edge
aliases:
  - api edge
  - http edge
  - route layer
  - layer 2
modified: 2026-07-08
tags:
  - architecture
  - architecture-layer
  - api
  - tenant-isolation
  - suitecentral
---

# Layer 2 — HTTP/API Edge

> Express route setup, auth and tenant context, AI proxy routes, WorkflowCentral routes, configuration APIs, and gateway policy surfaces.

Every operator action and every external API call passes through this layer of the [[pages/concepts/suitecentral-code-architecture|seven-layer code architecture]] first. **Tenant identity is established here and propagated downward** — no layer below re-derives tenant identity from request headers. Production AI traffic flows exclusively through governed proxy routes; the natural-language action surface is gated by an allowlist-based action gate (see [[pages/concepts/nl-action-gate|Natural Language Action Gate]]).

## Questions this layer answers

- Where is tenant context established?
- Which API routes participate in governance?

Ask them live on the **[Code Architecture Dashboard](https://demo.kstratmdconsulting.com/code-architecture-dashboard.html)** — click the second layer of the infographic.

## Documentation & evidence

- [MCP Gateway architecture](https://demo.kstratmdconsulting.com/docs/architecture/MCP-GATEWAY-ARCHITECTURE.md) — the gateway policy surface in detail

## Related layers

- [[pages/architecture/user-operator-surfaces|Layer 1 — User & Operator Surfaces]] — the surfaces whose requests this edge receives
- [[pages/architecture/core-application-services|Layer 3 — Core Application Services]] — where validated requests become governed actions
- [[pages/architecture/governance-safety|Layer 5 — Governance & Safety]] — the vertical safety rail invoked at this edge's decision points

---

*Last refreshed: 2026-07-06*