OAG provides a standards-based, policy-driven, standalone solution for exposing and securing enterprise APIs, and for managing them and their consumers in a scalable and highly available environment. OAG provides a runtime execution environment for APIs, providing key capabilities such as authentication and authorization, virtualization, and multi-protocol exchange.

When APIs are exposed to multiple consumers outside of an organization's trust boundary, organizations can be left vulnerable to external threats such as denial of service attacks, XML bombs, brute-force attacks, to name but a few. OAG provides a standard-based and policy-driven way to secure these exposed APIs. This goes further than just promoting the usage of a secure channel; it provides several layers of standards-based tools for authentication, authorization, confidentiality, and integrity, protecting all externally exposed APIs.