Asstgr — Outbound API Gateway

A self-hosted Django platform to manage, proxy, and rate-limit calls to third-party APIs — with OAuth 2.0 support, per-user quota, and a unified REST interface.

---

🌐 SaaS Version Available

Don't want to deploy and maintain the infrastructure yourself? A fully managed SaaS version of Asstgr is available at:

👉 https://www.asstgr.com/home/

It offers a complete management interface:

• Dashboard with an overview of your APIs, endpoints, headers, parameters, and methods
• API key management (creation, revocation, automatic masking)
• Monthly quota tracking with progress bar and visual alerts
• Usage statistics (requests-per-API chart over the last 30 days)
• Account management: paginated call logs, filtering by date range, targeted deletion
• Per-API OAuth2 configuration (client credentials, authorization code, password grant)
• Dark / light mode with automatic system preference detection

No need to install PostgreSQL, run Django migrations, or configure a .env file — just create an account and start registering your APIs.

The self-hosted version (this repository) remains available for users who want full control over their infrastructure and data.

---

Author

Built with Django + DRF. Contributions welcome.

• Follow on X: @asstgrio

---

⭐ Like this project?

If Asstgr saved you time or gave you ideas, a GitHub star goes a long way — it helps other developers discover the project and keeps me motivated to build more.

⭐ Star it on GitHub — it takes 2 seconds and means a lot. Thank you!

---

What is Asstgr?

Asstgr is an API Abstraction Layer: instead of integrating third-party APIs directly into your apps, you register them once in Asstgr, describe their endpoints and parameters, and call them through a single, secured interface.

Think of it as your own private RapidAPI — self-hosted, fully programmable via REST, with fine-grained quota control.

Your app  ──►  Asstgr (/api/v1/...execute/)  ──►  Stripe / OpenWeatherMap / GitHub / any API
                  │
                  ├─ Auth (API Key or OAuth2)
                  ├─ Quota enforcement
                  ├─ Request logging
                  └─ Response formatting

---

Features

• API Registry — Register any third-party API with its base URL, authentication, and endpoints
• Endpoint modeling — Describe paths, parameters (query / path / body), HTTP headers, and methods
• Unified execution — Call any registered endpoint via /api/v1/.../execute/ with parameters
• OAuth 2.0 — Full support for client_credentials, authorization_code, and password flows, with automatic token refresh
• API Key auth — Generate and revoke personal API keys (sk-...) to authenticate against Asstgr
• Quota system — Per-user monthly credit budget; each API has a configurable quota_cost
• Rate limiting — Burst (30/s) and sustained (1000/day) throttling per API key
• Response formatting — JSON, compact, standard, or verbose (human-readable) output modes
• Full audit logs — Every call is logged with user, endpoint, status code, and response size
• Django Admin — Complete back-office to manage APIs, quotas, keys, and logs

---

Tech Stack

---

Project Structure

asstgrv7/
├── asstgrv7/               # Django project (settings, urls, asgi)
│   ├── settings/
│   │   └── dev.py
│   └── urls.py
│
├── api_management/         # Core: API registry, models, OAuth service
│   ├── models.py           # API, Endpoint, Parameter, Header, Method, APILog, APICallQuota
│   ├── utils.py            # Request building, response formatting (JSONCleaner)
│   ├── oauth_service.py    # OAuthService: fetch, refresh, save tokens
│   ├── views_oauth.py      # OAuth authorize / callback views
│   └── admin.py
│
├── api_public/             # Public REST API (v1)
│   ├── views.py            # All API views (CRUD + Execute + OAuth)
│   ├── models.py           # PublicAPIKey
│   ├── serializers.py
│   ├── authentication.py   # APIKeyAuthentication
│   ├── permissions.py      # IsAPIKeyAuthenticated, HasSufficientQuota
│   ├── throttling.py       # Burst + Sustained throttles
│   ├── limits.py           # LIMITS constants
│   └── urls.py
│
└── users/                  # Custom user model (AbstractUser)
    ├── models.py
    └── admin.py

---

Data Model

Asstgr's database is organized around a hierarchy of objects. Here's a quick overview of the core models and their key fields:

API

The top-level object representing a third-party API.

Endpoint

A path under an API (e.g. /weather).

Parameter

A parameter attached to an endpoint.

Header

A fixed HTTP header sent with every call to an endpoint (e.g. Content-Type, X-Api-Version).

Method

The HTTP method(s) allowed on an endpoint (GET, POST, PUT, DELETE).

OAuthConfig

OAuth 2.0 configuration attached to an API (one per API).

APICallQuota

Per-user monthly credit tracking.

APILog

Audit record created after every executed call — stores the user, endpoint, HTTP method, request/response data, status code, and response size.

---

Quick Start

1. Clone & install

git clone https://github.com/asstgr/asstgropensource.git
cd asstgropensource
python -m venv venv && source venv/bin/activate
pip install -r requirements.txt

2. Configure environment

Create a .env file at the project root:

DJANGO_SECRET_KEY=your-secret-key

DB_NAME_local=asstgr_db
DB_USER_local=postgres
DB_PASSWORD_local=your-password
DB_HOST_local=localhost
DB_PORT_local=5432

3. Run migrations & create superuser

python manage.py migrate --settings=asstgrv7.settings.dev
python manage.py createsuperuser --settings=asstgrv7.settings.dev

4. Start the server

python manage.py runserver --settings=asstgrv7.settings.dev

The API is available at http://localhost:8000/api/v1/.

---

API Usage

Authentication

All requests to /api/v1/ must include your API key:

Authorization: Api-Key sk-xxxxxxxxxxxxxxxxxxxxxxxx

Generate a key from the admin panel or via:

POST /api/v1/keys/
Content-Type: application/json

{ "name": "My production key" }

---

Workflow: Register and call an API

Step 1 — Register an API

POST /api/v1/apis/
{
  "name": "OpenWeatherMap",
  "url": "https://api.openweathermap.org/data/2.5",
  "auth_required": true,
  "quota_cost": 1
}

Step 2 — Add an endpoint

POST /api/v1/apis/{api_id}/endpoints/
{
  "path": "/weather",
  "description": "Current weather by city"
}

Step 3 — Add parameters

POST /api/v1/apis/{api_id}/endpoints/{endpoint_id}/parameters/
{
  "name": "q",
  "param_type": "query",
  "data_type": "STRING",
  "required": true,
  "description": "City name"
}

Step 4 — Add HTTP method

POST /api/v1/apis/{api_id}/endpoints/{endpoint_id}/methods/
{ "method": "GET" }

Step 5 — Execute

POST /api/v1/apis/{api_id}/endpoints/{endpoint_id}/execute/
{
  "method": "GET",
  "params": { "q": "Paris" },
  "display_format": "standard"
}

Response:

{
  "status_code": 200,
  "result": "...",
  "quota": {
    "used": 3,
    "remaining": 97,
    "limit": 100,
    "usage_pct": 3.0
  }
}

---

API Reference

API Keys

Quota & Limits

APIs

Endpoints / Parameters / Headers / Methods

All follow the same nested pattern under /api/v1/apis/{api_id}/endpoints/... — see the full reference in the developer documentation at /docs/.

Execute

Body:

{
  "method": "GET",
  "params": { "key": "value" },
  "display_format": "json"
}

display_format options: json · compact · standard · verbose

OAuth 2.0

---

Quota System

Each user has a monthly credit budget managed by APICallQuota. Each API has a configurable quota_cost (default: 1).

User budget: 100 credits/month
API quota_cost: 5
→ User can make 20 calls to this API per month

Superusers can set monthly_limit = NULL for unlimited access.

---

Resource Limits

---

Rate Limiting

Applied per API key via DRF throttling:

Exceeded limits return 429 Too Many Requests.

---

Response Formats

The JSONCleaner engine transforms raw API responses into readable output:

---

Environment Variables

---

License

MIT — feel free to use, modify, and distribute.