Architecture

How Ramkin works

Ramkin’s architecture is built on three core principles: capture metadata, analyze behavior, surface insights — without ever storing sensitive payload data.

Collector

The collector runs as a sidecar, DaemonSet, or standalone process. It captures:

• HTTP method and path
• Headers (names and values, excluding body content)
• Status codes
• Timing and latency
• Source and destination metadata

Analysis engine

The analysis engine processes metadata streams to:

• Discover and catalog every endpoint
• Detect sensitive data in headers and fields
• Identify behavioral anomalies
• Map data flows across services

Dashboard

The Ramkin dashboard provides a real-time view of your API surface, including:

• Live inventory of all discovered endpoints
• Sensitive data flow maps
• Anomaly alerts and timelines
• Compliance-ready reporting