Tyk Virtual Endpoint
A tyk virtual endpoint lets you run custom JavaScript logic inside your API route. It processes requests and builds responses without calling an upstream backend service. Platform teams use this feature to mock responses, combine calls, or change payloads. Still, teams often grant broad permissions to the people who write and edit these scripts. If an engineer has wide dashboard roles, one bad script can expose sensitive data. How a tyk virtual endpoint works in practice In a standard API rou
Endpoint Detection & Response (EDR) + Virtual CISO Services: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
A tyk virtual endpoint lets you run custom JavaScript logic inside your API route. It processes requests and builds responses without calling an upstream backend service. Platform teams use this feature to mock responses, combine calls, or change payloads. Still, teams often grant broad permissions to the people who write and edit these scripts. If an engineer has wide dashboard roles, one bad script can expose sensitive data.
How a tyk virtual endpoint works in practice
In a standard API route, the router takes a request and sends it upstream. When you set up a tyk virtual endpoint, the router stops the request early. Instead of forwarding traffic, the router starts a built-in JavaScript engine. This engine runs a custom function that your team writes and stores in the route definition.
Your function receives the incoming request object, including headers, query values, and body data. It also receives a session object when the caller uses an active API key. Inside the script, your code can parse inputs, check headers, or run math. The script can also make separate HTTP requests to other internal or external services.
Teams use this flow to build composite endpoints. A single client call hits the route, and the script fetches data from three microservices. The script then merges those three payloads into one clean JSON response. Finally, the function returns a custom response object with a status code, headers, and body.
Planning your script workflow and permissions
Before you deploy custom route logic, you need a clear workflow for code changes. Teams can store script logic directly inside the API definition file or load it from a file. Storing scripts in version control helps teams review logic before it reaches production.
You also must plan how scripts handle secrets and internal service URLs. Because the JavaScript engine can make outbound HTTP calls, scripts often talk to private internal apps. If developers hardcode internal tokens inside the script, anyone who reads the route settings sees those keys. Teams should restrict who can read and write route definitions in the admin dashboard.
Endpoint Detection & Response (EDR) + Virtual CISO Services: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native routing solves and what it leaves open
Native virtual endpoints solve a real routing problem for platform teams. They let you mock APIs for frontend developers before the backend is ready. They also let you reshape legacy XML or JSON payloads without deploying a new microservice. At the network edge, API keys and rate limits control which external clients can call the route.
Still, this native setup leaves a major operational gap for internal operations and data safety. Admin roles decide who can log in and edit the route, not what individual requests do in flight. Once an engineer or script has permission to query an internal service, every returned field passes through.
If a virtual script fetches user records from an internal app, the payload may hold sensitive fields. Emails, phone numbers, card numbers, and national IDs can flow straight into debug logs or client responses. Native route settings do not inspect or mask specific data fields inside the payload at runtime. Similarly, when engineers debug the backend systems behind these routes, static role checks only gate initial login. They do not approve individual commands or redact sensitive fields in the query results.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
When should a team use a virtual endpoint instead of a microservice?
Use a virtual endpoint for light tasks like mocking responses, checking headers, or merging small payloads. Heavy business logic and long tasks belong in a dedicated backend service.
Can a virtual endpoint script call other internal APIs?
Yes, the built-in scripting engine includes an HTTP client helper. Your script can send requests to other services, wait for responses, and combine the results.
What are the main security risks of running custom route scripts?
Overbroad admin roles let too many people edit live route code and view internal URLs. Also, scripts that fetch internal records can expose unmasked emails or card numbers in responses.