FAQ
Product and editions
What scenarios is ApiGo suitable for?
For enterprises that need to securely expose data from existing business systems (ERP, CRM, SRM, etc.) to AI agents or external systems, covering the full lifecycle of API building, governance, exposure, and monitoring.
What is the difference between the Subscription and Enterprise editions?
The Subscription edition provides all platform features and the deployment package; the Enterprise edition additionally provides source code package licensing, dedicated technical services, feature training, and custom development. See Pricing on the home page.
Data sources
Which databases are supported?
18+: MySQL, Oracle, PostgreSQL, SQL Server, TiDB, OceanBase, OpenGauss, TDSQL, StarRocks, Doris, DM (Dameng), KingBase, as well as MongoDB, Elasticsearch, Hive, ClickHouse, TDengine, and DolphinDB.
How do I troubleshoot a failed data source connection?
- Verify network connectivity (open firewall ports for cross-subnet access)
- Verify the database account, password, and access permissions
- Check the specific driver error in the platform logs
API development
What syntax does SQL mode support?
Standard SQL plus MyBatis dynamic tags (<if>, <where>, <foreach>, etc.), with dynamic parameter binding and conditional filtering; supports SELECT / INSERT / UPDATE / DELETE / stored procedures.
How do I run Mock tests on an API?
After configuring Mock rules for an API, access it through the /mock/{envCode}/** path to get simulated responses, so no real backend is needed during joint debugging.
What are the limitations of orchestration mode?
The orchestration graph (DAG) supports serial, parallel, conditional branching, and data merging; API nodes can recursively call other APIs, with a maximum depth limit to prevent circular calls.
Calls and authentication
What should I do about a 40013 signature verification failure?
Check each item in the signature troubleshooting checklist. The most common causes are the query string not being included in the signature or the request body being re-serialized by the HTTP library.
Getting a 40010 timestamp expired error?
Check client-server clock synchronization (NTP); make sure you use a millisecond (13-digit) timestamp.
Can a nonce be reused?
No. The gateway uses AppKey + SM3(nonce) for replay protection, and a duplicate nonce is judged as a replay. When retrying, you must regenerate the timestamp and nonce.
Platform architecture
Do configuration changes require a service restart?
No. After configuration is written to MySQL, it is synced to the Redis runtime configuration hub, which incrementally notifies the gateway and execution services via Pub/Sub, taking effect in real time.
Where are call logs stored?
MySQL by default; for large-scale scenarios you can switch to Elasticsearch, depending on the configuration.
How do I scale horizontally?
The gateway and execution services are stateless (configuration comes from Redis + Nacos) and can be scaled horizontally directly; Sentinel rules stay consistent across the cluster via Redis.
Release and synchronization
The API is released, but calls still return 40001. Why?
Check in order: whether the target environment has been synced (development environment snapshots are not automatically synced to test/production), whether the environment is enabled, whether the API is online, and whether the gateway received the route change. If necessary, run a manual reconciliation. See Configuration sync and release pipeline.
How long does a configuration change take effect?
It normally takes effect within seconds: after the admin writes to Redis, it notifies the gateway via Pub/Sub. If a message is lost, the gateway reconciles by version number every 5 minutes. Flow control/circuit breaking use incremental updates, while routes use full-table refresh.
Can release snapshots be modified?
No. Snapshots are immutable historical versions; after modifying the design state you need to release again to generate a new revision number. Rollback only sets a historical snapshot as the current version again.
AI and MCP
Can AI data query perform write operations?
No. The data query path enforces read-only validation; DDL, write statements, and multi-statement queries are blocked. When writes are needed, they should be executed through the AI assistant's confirmation card or controlled tools, leaving an audit trail.
Why can't I see an API in the app's MCP?
All of the following must be true: the release protocol includes MCP, the API is released to prod and online, the authentication method is app_key, the app has been authorized for the API, and MCP is enabled for the app. If any condition is not met, the API does not appear in tools/list.
Why do some actions appear in raw English in the AI logs?
The UI filters only cover common actions such as generation, optimization, and query; agent-related actions (such as AGENT_TURN, AGENT_CONFIRM) are displayed as raw actions. This is a display-scope limitation of the current UI and does not affect data integrity.
How do I locate an AI call failure?
Filter by question keyword or time range in the AI call logs, and check failReason and duration; the success rate report aggregates by scenario, helping you quickly determine whether the issue is in the model, the SQL, or the tool call. See AI call logs.
Security governance
Why is API caching not taking effect?
Caching only applies to APIs with "JSON responses + SELECT queries + an associated cache rule + a response body within the limit"; MCP and admin calls bypass the cache. Rule changes do not proactively clear old cache entries; you must wait for the TTL to expire. See API cache.
Why are alerts not triggered in real time?
Alerts are scanned by a scheduled job every 10 minutes and are subject to the time window, minimum request count, and frequency limits; the same log is not alerted again within 24 hours. For second-level detection, use flow control/circuit breaking and external monitoring. See Alert rules and alert records.
What is the difference between the IP whitelist and the app IP whitelist?
The app credential IP whitelist is checked during authentication (error code 40018) and applies to all authorized APIs; API-level IP rules are checked after authentication (error code 40012) and can set allow/deny lists for individual APIs. See IP access control and WAF.
Deployment and licensing
What happens to the service after the License expires?
A startup validation failure directly blocks startup; a failed daily runtime validation logs L007 and exits gracefully (exit code 1). Restart the service after updating the License file. See Deployment topology and License.
Where should the License state file be placed in container deployments?
It must be mounted to a persistent volume. With strict=true, the service refuses to start if the state file is unavailable; this is designed to prevent bypassing clock rollback detection by deleting the state file.
Can one License be used for multiple services?
It depends on the serviceIds whitelist. When non-empty, only the services in the list can pass validation; when empty, there is no restriction. The node count upper limit applies only to the CLUSTER type.