Enterprise Search API Gateway

Replace direct provider connections with a single governed search endpoint. One POST /search routes each request to Elasticsearch, OpenSearch, or Algolia — enforcing per-tenant permissions, applying centralized query rewrites, normalizing every response into one shape, and logging every call.

Apps stop talking to three different search APIs and start talking to one governed contract. Xano owns the routing, the permissions, the query policy, and the audit; the providers stay the search engines. Push it and the whole validate → authorize → rewrite → route → normalize → log flow runs, with the provider calls doc-mocked so it works before you wire credentials.

Give every app a direct connection to Elasticsearch (and OpenSearch, and Algolia) and you've given up governance: each client re-implements search, there's no central tenant isolation, query policy is copy-pasted everywhere, response shapes differ per provider, and nobody can answer "who searched what." Swapping or adding a provider means touching every app.

This template puts one governed gateway in front of all of them. A single POST /search validates the request, checks the caller's tenant against a permissions table, applies any active query-rewrite rule, routes to the chosen provider's adapter, and returns one normalized envelope — writing a search log and a request log every time (including on validation failures, permission denials, and provider errors). Provider access, tenant isolation, and query policy live in one place, so changing them is one change, not N.

backend/
  api/
    search/
      api_group.xs
      search_post.xs
  function/
    esg_apply_query_rewrite.xs
    esg_check_permission.xs
    esg_search_algolia.xs
    esg_search_elasticsearch.xs
    esg_search_opensearch.xs
    esg_search.xs
    esg_validate_request.xs
  table/
    api_request_logs.xs
    search_logs.xs
    search_rules.xs
    tenant_search_permissions.xs
  workflow_test/
    esg_authorized_search.xs
    esg_validation_failure.xs
  workspace/
    templates.xs

POST /search runs a strict, governed sequence (esg_search):

1. Validate the request (esg_validate_request) — provider is one of elasticsearch / opensearch / algolia, plus the query/filter shape.
2. Authorize the tenant against tenant_search_permissions — a tenant may only query the indexes (and, optionally, the filter key/value) it's been granted.
3. Rewrite the query if an active rule in search_rules matches (centralized query policy).
4. Route to the selected provider's adapter (esg_search_elasticsearch / _opensearch / _algolia) — one branch per provider, the HTTP call wrapped so a provider error is caught, not fatal.
5. Normalize the provider response into one unified envelope.
6. Log a search_logs row and an api_request_logs row — validation failures, permission denials, and provider errors all still write the request log.

Validation and permission checks are explicit, non-throwing, so the unified error envelope carries the exact reason.

Start with your coding agent. Paste the prompt below into a local MCP-capable coding agent — Claude Code, Cursor, Windsurf, and others. It installs the Xano CLI, connects Xano, and imports this template.

Start building in Xano: Access the prompt at https://go.xano.co/start-xano-with-template-skill and run it here with enterprise-search-gateway-elasticsearch-opensearch-algolia as your template.

The agent will walk you through the setup below.

1. Push the backend to a Xano workspace (the CLI/agent flow below does this).
2. Call it — POST /search with a provider, query, optional filters, and the tenant_id / user_id the request is attributed to.
3. What runs without credentials. Validation, tenant authorization, query rewrite, normalization, and logging all run out of the box (with API_AUTH_SECRET unset the auth check is a no-op); the live provider search needs that provider's credentials. Set the environment variables to connect Elasticsearch, OpenSearch, and/or Algolia.

The one endpoint lives in the EnterpriseSearchGateway API group (canonical esg-search) and requires the API secret when API_AUTH_SECRET is set. Every call is logged.

• tenant_search_permissions — per-tenant grants: which index a tenant_id may query, optionally scoped to an allowed_filter_key / value.
• search_rules — centralized query-rewrite rules: match a query, send a rewritten one instead (active rules only).
• search_logs — one row per search reaching a provider: provider, post-rewrite query, filters, result count, response time, tenant, user.
• api_request_logs — one row per request (success or error), correlated to search_logs by request_id.

Run from a deployed workspace with xano workflow_test run_all:

• esg_authorized_search — an authorized tenant's request validates, passes the permission check, routes, and is logged (against a doc-mocked provider).
• esg_validation_failure — an invalid request is rejected by the validation gate with the exact reason, and still writes a request log.

These exercise the governance flow without provider credentials; the live provider call requires them.

Set the credentials for whichever provider(s) you route to. The gateway's governance (validation, permissions, rewrite, logging) runs without them.

• ELASTICSEARCH_URL, ELASTICSEARCH_API_KEY — Elasticsearch endpoint + API key.
• OPENSEARCH_URL, OPENSEARCH_USERNAME, OPENSEARCH_PASSWORD — OpenSearch endpoint + basic-auth credentials.
• ALGOLIA_APP_ID, ALGOLIA_SEARCH_API_KEY, ALGOLIA_INDEX_NAME — Algolia application, search key, and index.
• API_AUTH_SECRET — shared secret every request checks. When unset the check is a no-op so it runs out of the box; set it in production.