API Gateways are hackers wet dreams; internal redirects bypass therm entirely and their caches do not handle RBAC/ABAC and thus elevate privileges

https://medium.com/@apiexpert/why-api-gateways-are-dead-7c9e324ff70a

If you understand ANYTHING about API Security, you will NEVER use an API Gateway