API gateway resides at the L7 layer. Irrespective of how it is implemented, the hosting service should serve as a gateway only. In the case of Spring Cloud Gateway, the underline technology is Spring Boot which means logically you can push other code as well but that will be against the single responsibility principle and must be avoided.