# Gateways Proxies and Service Mesh

*MuleSoft Platform Architect Study Guide · Governing web APIs on Anypoint Platform · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-architect/governing-web-apis-on-anypoint-platform/gateways-proxies-and-service-mesh*

Compare embedded gateways, proxies, historical Service Mesh and Spring 2024 Flex modes while preserving runtime and policy compatibility boundaries.

- Certification: Salesforce MuleSoft Platform Architect
- Exam section: Governing web APIs on Anypoint Platform
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-architect

**Official exam objective:**

> Select an approach to API policy enforcement based on specific preferences and constraints, including, but not limited to, API proxies/API gateways and Anypoint Service Mesh.

## What the exam expects

- Select an enforcement point for Mule and non-Mule implementations.
- Compare direct embedded enforcement, a separate proxy and historical service-mesh interception.
- Explain Spring '24 Flex Gateway configuration modes and custom-policy portability.
- Diagnose the prerequisites of an existing Anypoint Service Mesh installation.

A **gateway** mediates requests before a backend; an **API proxy** forwards requests through a separately deployed enforcement application; **Mule Gateway** is embedded in Mule runtime; **Flex Gateway** is the Envoy-based gateway described by the Spring '24 references; an **Envoy sidecar** intercepts mesh service communication; the **Mule adapter** performs Anypoint policy checks for the historical mesh ([Mule Gateway](https://docs.mulesoft.com/mule-gateway/mule-gateway-overview), [Spring '24 gateways](https://raw.githubusercontent.com/mulesoft/docs-gateway/e2b1e79085235d8963c0c5a0e390a9456b2a6f03/gateway-home/modules/ROOT/pages/index.adoc), [Historical mesh](https://raw.githubusercontent.com/mulesoft/docs-service-mesh/e29687c3da135476c63722a50cfd94583bb7171c/modules/ROOT/pages/index.adoc)).

## Key facts

| Fact | Detail | Source |
| --- | --- | --- |
| Embedded gateway | Mule runtime includes Mule Gateway. | [Mule Gateway](https://docs.mulesoft.com/mule-gateway/mule-gateway-overview) |
| Non-Mule backend | A Mule proxy can supply the Mule enforcement hop. | [Mule Gateway](https://docs.mulesoft.com/mule-gateway/mule-gateway-overview) |
| Custom artifact portability | Mule Gateway policies do not run unchanged on Flex. | [Spring '24 gateways](https://raw.githubusercontent.com/mulesoft/docs-gateway/e2b1e79085235d8963c0c5a0e390a9456b2a6f03/gateway-home/modules/ROOT/pages/index.adoc) |
| Flex Connected Mode | API Manager supplies policy configuration. | [Historical Flex 1.5](https://raw.githubusercontent.com/mulesoft/docs-gateway/e2b1e79085235d8963c0c5a0e390a9456b2a6f03/gateway/1.5/modules/ROOT/pages/index.adoc) |
| Flex Local Mode | Local declarative files; connections for registration and usage metrics. | [Historical Flex 1.5](https://raw.githubusercontent.com/mulesoft/docs-gateway/e2b1e79085235d8963c0c5a0e390a9456b2a6f03/gateway/1.5/modules/ROOT/pages/index.adoc) |
| Mesh interception | Envoy, Istio mixer and Mule adapter participate in checks. | [Historical mesh](https://raw.githubusercontent.com/mulesoft/docs-service-mesh/e29687c3da135476c63722a50cfd94583bb7171c/modules/ROOT/pages/index.adoc) |
| Existing pods | Restart after injection labeling when the Envoy sidecar is missing. | [Mesh troubleshooting](https://raw.githubusercontent.com/mulesoft/docs-service-mesh/08af72f9135050ddc6c17d6e9aad50e1915b26c9/modules/ROOT/pages/troubleshoot-policy-enforcement-issues.adoc) |
| Policy catalog | Mesh supports a finite subset; XML Threat Protection uses Mule Gateway. | [Mesh policies](https://raw.githubusercontent.com/mulesoft/docs-service-mesh/978f4f4000c03fb2646c8d12d196e4ca87b79c69/modules/ROOT/pages/manage-apis-with-service-mesh.adoc), [XML protection](https://docs.mulesoft.com/mule-gateway/policies-included-xml-threat-protection) |

## Check yourself

- Why is a numeric port value insufficient in the historical mesh service definition?
- When policy traffic continues after binding deletion, which residual resource should be checked?
- When adapter logs confirm an expired-license failure, which recovery steps are documented?

## Sources

- [Historical Service Mesh 1.0](https://raw.githubusercontent.com/mulesoft/docs-service-mesh/e29687c3da135476c63722a50cfd94583bb7171c/modules/ROOT/pages/index.adoc)
- [Historical Service Mesh Policy Catalog](https://raw.githubusercontent.com/mulesoft/docs-service-mesh/978f4f4000c03fb2646c8d12d196e4ca87b79c69/modules/ROOT/pages/manage-apis-with-service-mesh.adoc)
- [Historical Service Mesh Troubleshooting](https://raw.githubusercontent.com/mulesoft/docs-service-mesh/08af72f9135050ddc6c17d6e9aad50e1915b26c9/modules/ROOT/pages/troubleshoot-policy-enforcement-issues.adoc)
- [Historical Flex Gateway 1.5](https://raw.githubusercontent.com/mulesoft/docs-gateway/e2b1e79085235d8963c0c5a0e390a9456b2a6f03/gateway/1.5/modules/ROOT/pages/index.adoc)
- [Spring 2024 Gateway Comparison](https://raw.githubusercontent.com/mulesoft/docs-gateway/e2b1e79085235d8963c0c5a0e390a9456b2a6f03/gateway-home/modules/ROOT/pages/index.adoc)
- [Dated Omni Gateway Naming Context](https://docs.mulesoft.com/gateway/latest/)
- [XML Threat Protection Policy](https://docs.mulesoft.com/mule-gateway/policies-included-xml-threat-protection)
- [Anypoint Mule Gateway](https://docs.mulesoft.com/mule-gateway/mule-gateway-overview)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Architect pack (USD $19): https://www.certifyforce.com/practice-exams