Artificial Intelligence

MoEngage Integrates 400 APIs With AgentCore Gateway

MoEngage utilized Amazon Bedrock AgentCore Gateway to transform roughly 400 private REST APIs spanning seven AWS Regions into permission-scoped agent tools, bypassing the need for extensive custom infrastructure.

Radwan AbdulhadiEditor and technology writer

Published: October 29, 2026 · Updated: October 29, 2026 · 4 min read

MoEngage Integrates 400 APIs With AgentCore Gateway — Image: AWS Machine Learning Blog

Overcoming the Private API Integration Challenge

When engineering teams initiate the development of AI agents, the underlying operational capabilities often already exist as internal APIs handling tasks like campaign creation, segment queries, and delivery statistics. For customer engagement platforms supporting thousands of brands, the primary hurdle is not developing fresh functionality, but rather making numerous private APIs safely accessible to agents without exposing them to the public internet.

MoEngage encountered this exact engineering challenge across its ecosystem, where roughly 400 internal REST APIs are managed by 25 engineering teams and operate inside private virtual private clouds across seven distinct AWS Regions. Because these APIs are isolated regionally to comply with specific data residency mandates, achieving secure, scalable reachability required a specialized strategy detailed in reports on the <A>AWS Machine Learning Blog</A>.

Rejecting Decentralized Model Context Protocol Servers

The Model Context Protocol establishes a standard method for agents to discover and call tools, and the most straightforward initial adoption path typically involves individual teams exposing their own protocol servers. However, deploying over 20 separate protocol servers would introduce significant maintenance overhead, requiring continuous monitoring, patching, and protocol-compatibility management as standards evolve.

Furthermore, cross-domain agents that perform complex multi-step workflows would need to connect to numerous servers simultaneously and reconcile their responses. To prevent this complexity from falling onto individual product developers, MoEngage established a core architectural principle: product teams continue building standard REST APIs and defining OpenAPI specs, while the central AI Platform team manages the integration layer end-to-end.

Architectural Constraints and Core Requirements

Before evaluating potential solutions, MoEngage outlined four strict architectural constraints that any prospective system needed to satisfy simultaneously. First, no internal APIs could receive public endpoints, ensuring all underlying services remained strictly private by policy without relying on complex, multi-region networking workarounds.

Second, identity management had to remain completely out of reach for the language models. Because internal API calls require precise tenant, user, role, and database contexts, allowing an LLM to control these parameters directly introduces security and reliability risks. Third, the architecture had to address context window limitations, as transmitting a full catalog of 400 tool definitions on every single connection would quickly overwhelm available token budgets.

AgentCore Gateway architecture: agent services reach the gateway through a private VPC interface endpoint, which evaluates Cedar policies and routes calls over Amazon VPC Lattice to internal APIs — Image related to the report from AWS Machine Learning Blog · Source: AWS Machine Learning Blog

Leveraging Amazon Bedrock AgentCore Gateway

To solve these structural challenges without building custom tool-generation pipelines or policy file formats from scratch, MoEngage turned to Amazon Bedrock AgentCore Gateway. This fully managed solution allows engineering teams to register standard OpenAPI specifications as targets, automatically generating protocol tools and routing calls directly to the backing services.

Developers can review official documentation resources such as the <A>Amazon Bedrock AgentCore documentation</A> to understand how OpenAPI specs translate directly into dynamic tool definitions without requiring separate deployment artifacts or custom protocol expertise.

Enforcing Access Control with Cedar Policies

A crucial element of the AgentCore integration is the use of the policy engine to handle authorization before the tool catalog is serialized. By authenticating each agent as its own distinct role, the system applies server-side scoping to filter available operations based on specific permissions.

Organizations exploring similar governance models can reference the <A>Cedar policy language reference</A> to see how partial evaluation restricts tool visibility before responses are generated, ensuring that agents only receive operations they are authorized to execute.

Managed Egress and Operational Efficiency

In addition to policy enforcement, the gateway manages secure connectivity to internal services through managed egress capabilities rather than custom networking constructs built by the platform team. Detailed implementation specifications for this networking layer can be found within the <A>Amazon VPC Lattice documentation</A>.

By adopting this managed architecture, MoEngage saved an estimated six months of internal platform engineering effort, streamlining the onboarding process for new APIs from days down to mere hours. Teams requiring further guidance or enterprise support can also <A>reach out to AWS</A> directly for additional technical assistance.