Request a Demo

QS Sentry

QS PLATFORM 10 · QS SENTRY

Available now / Built on Forum Sentry

Where AI meets
your enterprise.
Securely, at scale.

Without robust API middleware, AI is meaningless. QS Sentry connects agents and applications to every enterprise system, from HTTPS to IBM MQ, SOAP to REST and API keys to signed SAML.

Built on Forum Sentry, which secures more than 10 billion transactions every day. Protocols, identity, transformation and PKI live in the platform, not in your code.

Request a QS Sentry demoSee the architecture
Named a Leader in the KuppingerCole 2025 Leadership Compass for API security and management.
API MIDDLEWARE FOR THE AI ERA10
QSSentry

Protocols

HTTP(S) · MQ · SOAP

Identity

Keys · mTLS · SAML

PKI

FIPS 140-2

Threat protection · Validation · Data protection · Full-context logging
QS Cortex
Agents and toolsEnterprise systems
REST · SOAP · MQIdentity stores
Okta · LDAP
Security in the platform. Business logic in the code.
SECURITY IN THE PLATFORM.
LOGIC IN THE CODE.
Any protocol

From HTTP(S) to IBM MQ channel handling

Any identity

From API keys to mutual TLS and signed SAML

Any format

From legacy SOAP XML to REST JSON

01

WHERE AI MEETS THE ENTERPRISE

Without robust API middleware,
AI is meaningless.

Agents reason in the model, but they act through your APIs, into systems built over decades: message queues, SOAP services, mainframes and deep directory structures. Every one of those calls is a security decision. QS Sentry is where those decisions are made, consistently, for every agent and application.

Agents need real systems.

The answers enterprises care about live in systems of record. Reaching them means speaking their protocols, formats and security models.

Every call is a security decision.

Who is calling, with what credential, under which policy, carrying which data. QS Sentry decides once, in one place.

Hundreds of APIs, one control point.

Certificates, consumers and policies are managed centrally, so a change is made once instead of in every service and agent.

SEPARATION OF CHURCH AND STATE

Security, identity and transformation belong in the platform.
Business logic belongs in the code, whether a person or an AI wrote it.

02

THE HARD PARTS

The hard parts,
handled once.

This is the work that separates an enterprise platform from a prototype. QS Sentry does it in tested, certified product code, so no application or agent has to.

PROTOCOLS

Deep protocol mediation

From simple HTTP(S) to IBM MQ channel handling, with protocol break and translation between transports.

IDENTITY

Any-to-any identity

Basic auth, API keys, OAuth, OpenID, mutual TLS and signed SAML, integrated with Okta and other SaaS identity stores or deep LDAP structures.

CONTENT

Content transformation

Legacy SOAP XML to REST JSON and back, with header and body mapping, schema validation and XML signatures.

PKI

Built-in PKI

A PKI engine with FIPS 140-2 cryptography for keys, certificates, signing, encryption and TLS, managed centrally.

Transport security

Protocol break, built-in PKI, FIPS 140-2 and protocol translation

Message security

Bi-directional transaction correlation and full payload analysis

Threat mitigation

AV and malware scanning, OWASP Top 10, rate and size controls

Data integrity

Request and response schema validation, XML signatures

Data privacy

Encryption, decryption, encoding and redaction

Authentication and SSO

Any-to-any conversion across PKI, HTTP auth, SAML, OAuth and OpenID

Data translation

Header and body mapping between XML and JSON

Auditing

Full-context transaction logging and AI logs

03

ARCHITECTURE

One gateway between AI
and everything it touches.

Every request from a QS Cortex agent, an application or a partner passes the same pipeline: identity in, protection, transformation, protocol mediation and identity out. QS DevX catalogs and monitors it all.

CONSUMERSQS Cortex agentsGenerated tools via MCPBusiness applicationsREST and SOAP clientsPartners and SaaSB2B integrationQS SentryBuilt on Forum Sentry01Identity inAPI keysOAuth · OIDCmTLS · SAML02ProtectOWASP Top 10AV scanningRate and size03TransformSOAP XMLto REST JSONSchema checks04MediateHTTP(S)IBM MQProtocol break05Identity outToken mappingSigned SAMLmTLS outboundPKI engine · FIPS 140-2 cryptographyKeys, certificates, signing, encryption and TLS, managed centrallyPolicy and zero trustContinuous authentication, multi-factor authentication and SSOFull-context logging and monitoringEvery transaction correlated and recorded, including AI logsENTERPRISE SYSTEMSREST servicesJSON APIsSOAP servicesXML and WS-SecurityIBM MQQueues and channelsLegacy and mainframeSystems of recordIdentity storesOkta and other SaaS IdPsLDAP directoriesQS DevXAPI catalog · gateway registration · runtime statistics
Conceptual architecture. Policies, protocols and identity integrations are configured per API.
  1. 01

    Agents call tools

    QS Cortex agents call tools generated in QS DevX. Each call enters QS Sentry like any other governed request.

  2. 02

    QS Sentry does the hard parts

    Identity, threat protection, transformation, protocol mediation and PKI are applied by policy, not by agent code.

  3. 03

    Systems see a trusted caller

    Back-end systems receive the protocol, format and credentials they expect, and every transaction is logged in full context.

04

PLATFORM VS. CODE

Generate it yourself?
Then you own it forever.

Imagine asking an AI to write MQ channel handling, SAML signing, mutual TLS and PKI into every application and agent. Even if it works on day one, you now maintain hundreds of copies, each with its own bugs and its own attack surface.

Security written into every app and agentApp or agentApp or agentApp or agentApp or agentRESTSOAPIBM MQMainframe16 integrations, each with its own auth, TLS, parsing and certificatesSecurity in QS SentryApp or agentApp or agentApp or agentApp or agentRESTSOAPIBM MQMainframeQS Sentryone control point8 governed connections, one tested platform
Illustrative. Connections grow with every app and system you add; a platform keeps them governed in one place.

SECURITY IN EVERY APP AND AGENT

Brittle, costly and unknown.

  • Protocol, identity and crypto code repeated across hundreds of services
  • Every certificate rotation or protocol change becomes a code change
  • An attack surface nobody can see as a whole
  • Maintenance cost that grows with every API
  • Security code no one has proven in production

SECURITY IN QS SENTRY

Tested, measured and managed.

  • Implemented once in hardened product code
  • Measured releases, tested and proven across many enterprises
  • Certificates rotated and consumers onboarded without code changes
  • One known, hardened control point
  • FIPS 140-2 cryptography and full-context audit trails
05

PROVEN IN PRODUCTION

This is what separates
a platform from a prototype.

QS Sentry is built on Forum Sentry, trusted by government and commercial enterprises worldwide for mission-critical traffic.

AT SCALE

10B+ a day

Mission-critical transactions secured daily across government and commercial enterprises.

RECOGNIZED

KuppingerCole Leader

Named a Leader in the 2025 Leadership Compass for API security and management.

CERTIFIED

FIPS 140-2

Federal-grade cryptography, with Common Criteria heritage for regulated environments.

DELIVERED

100% deployment success

A track record of successful deployments across Forum Systems customers.

06 · DEPLOY ANYWHERE

Deploy where your systems live.
On-premises, in the cloud or both.

QS Sentry runs in every major form factor, including air-gapped and federal environments, and hundreds of pre-built templates put common use cases into production quickly.

Already running Forum Sentry? Your APIs, policies and integrations become the QS Sentry foundation of QS Platform 10, extended to AI through QS Cortex and QS DevX.

Explore QS Platform 10
Hardware appliancesPurpose-built
VMwareVirtual image
DockerContainer image
AWSAmazon image
AzureAzure image
Windows and LinuxSoftware install

THE DETAILS

Questions,
answered.

Protocols, identity, transformation and how QS Sentry fits QS Platform 10.

Talk to our team
What is QS Sentry?

QS Sentry is the API gateway, integration and security layer of QS Platform 10. It connects AI agents and applications to enterprise systems with protocol mediation, identity, transformation and PKI handled by the platform.

Is QS Sentry the same as Forum Sentry?

QS Sentry is built on Forum Sentry. Existing Forum Sentry deployments become the QS Sentry foundation of QS Platform 10, so APIs, policies and integrations carry forward without re-platforming.

Why not let agents call APIs directly?

Because every agent would then carry its own protocol, identity and cryptography code. That multiplies the attack surface and the maintenance burden. QS Sentry keeps security in the platform and business logic in the code.

Which protocols does QS Sentry support?

From HTTP(S) to IBM MQ channel handling, with protocol break and translation between transports.

Which identity methods are supported?

Basic auth, API keys, OAuth, OpenID, mutual TLS and signed SAML, with integration to Okta and other SaaS identity stores and to LDAP directories.

Can QS Sentry convert SOAP to REST?

Yes. It transforms legacy SOAP XML to REST JSON and back, with header and body mapping, schema validation and XML signatures.

How does QS Sentry work with QS Cortex and QS DevX?

QS DevX catalogs APIs and gateways and generates the tools agents use. QS Cortex runs the agents. Every tool call reaches enterprise systems through QS Sentry.

Can QS Sentry replace our existing gateway?

Yes. Forum Systems has replaced gateways such as IBM DataPower, Axway, CA and MuleSoft. Talk to our team about a migration plan.

Is QS Sentry sold separately?

QS Sentry is included in every QS Platform 10 edition, alongside QS Cortex and QS DevX.

QS SENTRY · PART OF QS PLATFORM 10

Where AI meets your enterprise.
Securely, at scale.

See how QS Sentry connects agents to your hardest systems without putting security in their code.

Request a QS Sentry demoExplore QS Platform 10