Security

HARP sits between your applications and the remote APIs they call, which makes it a natural place to apply security controls without touching application code. Its rules engine can inspect and rewrite every request and response, so you can redact sensitive fields, strip or inject headers, and block traffic that does not match your policies, all from one place.

Understanding the use case

When applications talk to APIs directly, security logic ends up scattered across many codebases. Each service handles secrets, headers, and sensitive payloads its own way, which makes policies inconsistent and hard to audit. Because HARP is a forward proxy on the path between your applications and remote APIs, it gives you a single point where traffic can be observed and controlled, so you enforce the same rules everywhere instead of relying on each application to get security right on its own.

What you can do with HARP

The rules engine matches traffic by endpoint, HTTP method, and lifecycle event, then runs Python to act on it:

• Redact sensitive data: mask or replace personally identifiable information (PII) in requests and responses with anonymization and pseudonymization rules, so it never reaches consumers that do not need it.
• Control headers: inject the headers an upstream requires, and strip ones that expose internal details, on either the request or the response.
• Filter unwanted traffic: pattern-match on endpoints and methods to reject or short-circuit requests before they are forwarded.
• Encrypt in transit: point your remote pools at HTTPS upstreams, so traffic between HARP and the API is protected by TLS.

Everything is configured centrally, so a single rule set applies to all traffic through the proxy, and every exchange is recorded in the audit log for review in the dashboard.

Benefits

• One place for policy: centralizing security logic keeps it consistent and easier to review than logic spread across many applications.
• No application changes: rules apply at the proxy, so you update policy without modifying the services that call the APIs.
• Less sensitive data exposed: masking PII in transit reduces what flows to consumers that do not need it, and the audit log shows exactly what was sent and received.