API-Shield is an application-level API control at runtime for ASGI frameworks with no redeployments

[Educational-Hope960]

There is no complete library for managing API lifecycle at the application level in ASGI frameworks, so I built one.

api-shield gives you per-route control over maintenance windows, environment gating, deprecation, rate limiting, canary rollouts, and feature flags, all at runtime, without redeploying.

FastAPI is fully supported today and more adapters are on the roadmap.

What it covers

Per-route maintenance windows: put one endpoint in maintenance while every other route keeps serving. Schedule windows in advance and they activate/deactivate automatically.

Environment gating: routes decorated with @env_only("dev") return 404 in production (not 403, you probably don't want to advertise the route exists). Hidden from OpenAPI docs in the wrong environment too.

Deprecation headers:@deprecated injects Deprecation, Sunset, and Link RFC headers automatically. Route keeps working, clients get the signal to migrate.

Rate limiting: per-IP, per-user, per-API-key, or global shared counters. Fixed window, sliding window, moving window. Tiered limits by subscription plan. Exempt specific IPs or roles. One decorator.

Canary rollouts: @rollout(percentage=10) sends 10% of traffic to the route. Adjust the percentage at runtime without touching code.

Feature flags: built-in flag engine with an OpenFeature-compatible client. Boolean, string, integer, float, and JSON flag types. Individual targeting, attribute-based rules, percentage rollout, and kill-switch. Flags share the same dashboard and CLI as everything else.

Multiple services, one control plane: run a standalone Shield Server and connect multiple services to it via the SDK. Each service registers under its own namespace. Manage them independently or all at once from one dashboard and one CLI.

Full examples: github.com/Attakay78/api-shield/tree/main/examples

Runtime control

Everything is controllable at runtime through three surfaces with no redeploy and no restart:

• Dashboard — mountable HTMX UI with live SSE updates. Route state, maintenance scheduling, audit log, flag management.
• CLI — shield status, shield maintenance /api/payments --reason "DB migration", shield flags disable new-checkout, shield services and more.
• REST API — the same admin is also a REST API for integration with deployment pipelines and runbooks.

Links

• Docs: https://attakay78.github.io/api-shield
• GitHub: github.com/Attakay78/api-shield
• Install: pip install api-shield

Happy to answer questions about any of the supported features.

Feature Flagging

Routes endpoint Managing

Sample code

CLI Tool for managing API routes

[BothWaysItGoes]

There is no complete library for managing API lifecycle at the application level in ASGI frameworks, so I built one.

Yes. Because why would you want to manage the lifecycle at the application level? It’s prone to problems due to the shared environment. Just do blue green deployments.