Update api-gateway.md

docs/components/off-the-shelf-apps/api-gateway.md

 # API Gateway
 
-### TODO
+## Why Kong ?
 
-* Explain the reasons why Kong was chosen
-* Explain which features are used, in particular the AUTHN layer
+* it is Open Source
+* based on Nginx, a widely known Web Server / Reverse Proxy
+* it can be administrated via a dedicated admin REST API
+* it can be deployed in a High Availability fashion
+* it can be extended by various plugins; a Plugin Development Kit is provided
+* it provides several interesting features: load balancing (with active and passive healthcheck), 
+
+## Features
+
+* Load balancer with active healthchecks
+* Plugins : 
+    * jwt
+    * cors
+    * bot-detection (never tested!)
+    * prometheus
+    * key-auth, in order to let (micro-)services authenticate themselves with respect to other (micro-)services
+    * request-transformer, in order to issue authenticated requests towards Matomo
+    * acl, in order to:
+        - let (micro-)service use some potentially dangerous features exposed by other (micro-)services
+        - let the back-office team preview draft posts and access the Admin GUI
+
+## Setup
+
+A Python script allows the administrator to set up the proper configuration, according to the various environments.