I lead the integration practices in my organization and have been working in integration for the past 16 years, managing API integrations with various API manager tools such as Kong Enterprise.
We are primarily using Kong for the API gateway functionality. For example, we've had a couple of mobile applications with outbound traffic where we would use the Kong Enterprise gateway to expose the API by applying authorization, authentication, and other security policies.
We have also used Kong for role-based access control mechanism (RBAC) and integrated it with our enterprise directory in order provide it with this form of access control.
There was another particular use case in which we performed some customization, as well. In that scenario, we wrote a Lua script on top of Kong to add an AppDynamics plugin to our web server, for observability and monitoring purposes.
Kong has been used over a large user base, not only because it's an enterprise application, but also because the mobile applications we worked with were B2C-based in the retail industry, so the number of users was quite high.