EXA19
— Defend critical infrastructure —
Schema-as-Firewall
OpenAPI 3.1 + JSON Schema 2020-12 contracts cryptographically enforced at the gateway — malformed payloads rejected without decryption.
The problem to solve
API gateways today face an architectural compromise. To validate input against an OpenAPI 3.1 / JSON Schema 2020-12 contract or a GraphQL schema, they decrypt. The point of decryption is the point of vulnerability — the moment plaintext exists in the gateway is the moment a misconfigured access control, a logging mistake, a memory dump, or a misrouted observability span leaks it. The OWASP API Security Top 10 lists this exposure pattern under multiple categories. Most gateways today accept the trade because the alternative — accept everything — is worse.
The solution it enables
Polymonial lets the gateway run OpenAPI / JSON Schema / GraphQL schema validation against the seal directly. Field types, value ranges and allowed enums — all verified without decryption. Non-conforming payloads are rejected cryptographically. The gateway no longer opens a plaintext window to validate; the attack surface shrinks to the operations the gateway can prove correct against the schema.
What it looks like
An API gateway receives sealed payloads from external partners under an OpenAPI 3.1 contract. Instead of decrypting to inspect (creating an attack surface), the gateway verifies a proof that the sealed payload satisfies the OpenAPI contract: correct field types, values within ranges, no unexpected fields. Non-conforming payloads are rejected when their proof fails. The gateway does not need the plaintext to make that decision, so a misrouted log line at the gateway has no payload to leak.
“The OpenAPI contract enforced cryptographically at the gateway. Malformed payloads rejected without ever decrypting them.”
Who’s this for you?
We have this problem.
Your organisation needs this for its own data, product or programme of work.
We deliver this for clients.
A consultancy, integrator, service provider, industry programme or technology vendor.