Apiman

Apiman is open-source software for managing APIs and governing access through a self-hosted gateway. It is best suited to teams that want policy control and Java extensibility; its HTTP focus and support boundaries make it a less natural fit for broader protocol needs or unsupported releases.

Overview

Apiman covers API lifecycle management, from secure access to discovery and governance. Its management layer combines a REST API, Manager UI, and standalone Developer Portal with multi-tenancy, permissions, approvals, events, and notifications. That breadth suits organizations coordinating APIs across teams, rather than those looking only for a gateway.

The Apache License 2.0 Community Edition has no feature paywalls. The tradeoff is self-hosting: teams operate the software themselves unless they arrange commercial support. Apiman also offers access policies, API analytics, an API catalog, and lifecycle management.

Key features

Governance and security

Runtime policies let teams govern API use, while multiple plans can provide different service levels for the same API. Standard policies include authorization, BASIC authentication, IP allowlisting and blocklisting, HTTP security headers, and OAuth2/JWT authentication through the Keycloak plugin. This gives teams a practical baseline for access control without requiring every rule to be custom-built.

Extensibility and gateway deployment

Developers can create policies and components as Java plugins, which can be loaded dynamically without restarting. That is useful when an organization needs bespoke behavior, though it assumes Java development capacity. Gateways scale independently from the Manager and can keep running if it goes down, reducing the operational dependence of live traffic on the management layer.

Supported gateway platforms are Vert.x, WildFly, and Tomcat; the project identifies Vert.x as the best-performing option. Keycloak supports identity management, while gateway metrics can be emitted to Elasticsearch, Prometheus, InfluxDB, and JDBC.

Protocol and monetization limits

Apiman is primarily an HTTP API gateway. WebSockets lack explicit testing or support, and raw TCP, raw UDP, and messaging protocols are unsupported, so teams with those requirements should choose another approach. Metrics can support post-hoc billing or monetization, but Apiman does not provide explicit up-front billing or payment capture.

Pricing

The Community Edition costs nothing and is self-hosted under Apache-2.0, with no features behind paywalls. It suits teams prepared to operate the platform and manage support themselves. The paid support packages are custom pricing; they add 24/7 support, CVE patching and alerts, plus differing capacity and service allowances:

Essentials gives up capacity and service days compared with the larger packages; Advanced provides the most cores and development time. No seat or API quotas are specified in these plans.

Platforms

Apiman is available for API use on Linux and the web, with a self-hosted deployment model. Its gateway can run on Vert.x, WildFly, or Tomcat. This is a fit for teams that want deployment control, not buyers looking for a hosted service.

Who it's for

Choose Apiman if you need self-hosted API lifecycle management, policy-based governance, a developer portal, and the option to extend behavior with Java. Its independently scaling gateways are also valuable when live API traffic should continue during a Manager outage. Look elsewhere if your gateway must handle raw TCP, UDP, messaging, or depend on explicitly supported WebSockets, or if you need built-in up-front payment capture.

For support, version 3.x is community-supported; versions 2.x and 1.x are unsupported. Teams relying on community help should use a supported release, while organizations needing 24/7 assistance and CVE patching can consider Black Parrot Labs' commercial packages.

Pros and cons

• Pros: Apache-2.0 licensing with no feature gates avoids a paid-feature ceiling for self-hosters.
• Pros: Independent gateway scaling and continued operation during Manager outages help separate API traffic from management availability.
• Pros: Dynamic Java plugins and multiple governance plans allow tailored policies and service levels.
• Cons: Support for community releases is limited to version 3.x; versions 1.x and 2.x are unsupported.
• Cons: The HTTP focus excludes raw TCP, raw UDP, and messaging, while WebSockets lack explicit support.
• Cons: Metrics enable post-hoc monetization, not up-front billing or payment capture.

Alternatives

Consider Gravitee API Gateway if you want another Apache 2.0 community edition or need its broader listed platform range, including Windows; its Community Edition has no numerical limits published here. For a managed search-oriented use case rather than API governance, Algolia offers a free tier with 10K search requests per month, 50K records, 5K recommendation requests per month, and 5K crawls per month.

Amazon API Gateway is another API gateway option. Google Cloud Endpoints has a free usage tier covering 1,999,999 API calls, while its Standard usage tier is priced at $3 a month. Hasura offers a free plan with up to 3M API requests per month and two databases per project. Kong Gateway offers a 30-day free trial with no Gateway limits and 30 days of analytics retention. Apigee API hub is available at no additional cost to eligible Apigee organizations in supported regions. DreamFactory offers an open-source plan with a PostgreSQL connector.

Browse more options in API Management Software or API Developer Portal Software.

Verdict

Apiman is a strong choice for teams that want open-source, self-hosted API management with flexible governance and gateways that can run independently of the Manager. Its main reasons to look elsewhere are equally concrete: limited protocol coverage, no built-in up-front billing, and community support restricted to version 3.x.