You can now control network access to and from API gateways using security rules defined for one or more network security groups (NSGs) that you specify (up to a maximum of five network security groups).

You can use security rules defined for NSGs instead of, or as well as, those defined for security lists. NSGs can belong to the same compartment as an API gateway, but do not have to.

For more information, see Creating an API Gateway.