[nickmancol]

Maybe you can take a look of an api gateway like apiman which can leverage the auth & authz to keycloak, or perhaps kong may be the one.