Apiman
Apiman is open-source API management software for managing API access, discovery, and governance across the API lifecycle.
What Apiman is
Apiman is open-source API management software for managing API access, discovery, and governance across the API lifecycle. It uses policies to govern APIs at runtime and can offer different service levels for the same API. Its management layer includes a REST API, Manager UI, and standalone Developer Portal, alongside multi-tenancy, permissions, events, notifications, and approvals. Teams can build custom policies and components with Java plugins, which can load at runtime without a restart. Gateways scale independently of the Manager and can keep operating if the Manager goes down. Supported gateway platforms are Vert.x, WildFly, and Tomcat. Standard policies include authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT authentication through the Keycloak plugin, and HTTP security headers. The software is licensed under Apache License 2.0, with no features hidden behind paywalls. Apiman is primarily an HTTP gateway; WebSockets lack explicit testing or support, and raw TCP, raw UDP, and messaging protocols are unsupported. Version 3.x is community-supported; versions 2.x and 1.x are unsupported.
Good
- Apache License 2.0 software has no paywalled features.
- Gateways can run if the Manager goes down.
- Custom Java plugins can load without a restart.
- Includes a standalone Developer Portal.
Watch out
- Primarily an HTTP API gateway.
- Raw TCP, raw UDP, and messaging protocols are unsupported.
- Versions 2.x and 1.x are unsupported.
Who it suits
Apiman suits teams seeking self-hosted, open-source API management with policy-based governance and extensible Java plugins. Its protocol limits matter for teams needing raw TCP, UDP, or messaging support.
Verdict
Apiman provides a broad API management layer and independently operating gateways under an open-source license. Check its protocol limits and supported-version status against your needs.
Plans and prices
From Apiman's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Apiman Community Edition | Free | Apache-2.0 licensed · no features hidden behind paywalls · self-hosted |
| Advanced | Priced on request | 32 cores · 24/7 support · 10 days professional services · 41 days feature development · unlimited CVE patching and alerts |
| Essentials | Priced on request | 4 cores · 24/7 support · 1 day professional services · 5 days feature development · unlimited CVE patching and alerts |
| Standard | Priced on request | 16 cores · 24/7 support · 5 days professional services · 20 days feature development · unlimited CVE patching and alerts |
The facts
Each one read from Apiman's own pages, with the date it was checked.
What it does
- API governance
- Apiman supports policy-based runtime governance and multiple plans that can offer different service levels for the same API.checked 9 Oct 2026
- Extensibility
- Developers can create custom policies and components with Java plugins, and plugins can be loaded dynamically at runtime without restarting.checked 9 Oct 2026
- Gateway deployment
- The gateways scale independently of the Manager and can continue running if the Manager goes down.checked 9 Oct 2026
- Integrations
- The feature page names Keycloak for identity management and Elasticsearch, Prometheus, InfluxDB, and JDBC as gateway metrics emitters.checked 9 Oct 2026
- License
- The project says Apiman is licensed under Apache License 2.0, with no features hidden behind paywalls.checked 9 Oct 2026
- Management
- The management layer includes a REST API, Manager UI, and standalone Developer Portal, as well as multi-tenancy, events, notifications, permissions, and approvals.checked 9 Oct 2026
- Monetization limit
- Apiman supports post-hoc billing or monetization through metrics but does not currently provide explicit up-front billing or payment capture.checked 9 Oct 2026
- Protocol limits
- Apiman is primarily an HTTP API gateway; the feature page says WebSockets lack explicit testing or support and raw TCP, raw UDP, and messaging protocols are unsupported.checked 9 Oct 2026
- Purpose
- Apiman is open-source API management software covering the API management lifecycle, including secure API access and API discovery and governance.checked 9 Oct 2026
- Security policies
- Standard policies include authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT authentication via the Keycloak plugin, and HTTP security headers.checked 9 Oct 2026
- Security support
- The project security policy lists version 3.x as community-supported and versions 2.x and 1.x as unsupported.checked 9 Oct 2026
- Support
- Black Parrot Labs offers commercial Apiman support, development, and expertise, with support packages described as including 24/7 support and CVE patching and alerts.checked 9 Oct 2026
Where it runs
- Supported gateway platforms
- The site lists Vert.x, WildFly, and Tomcat as supported gateway platforms and says Vert.x provides the best performance.checked 9 Oct 2026
Alternatives to Apiman
- 1
Amazon API Gateway
Free planAndroidiOSWebAPI8.2From $1 a month - 2
Boomi
WebAPILinuxSelf-hosted7.6$99 usage-based - 3
Zuplo
Free planWebAPILinuxSelf-hosted7.6From $25 a month - 4
APIMatic
Free planWebAPIExtensionLinux7.4From $99 a month - 5
DigitalAPI
WebAPISelf-hosted7.1From $2,500 a month - 6
SnapLogic
WebAPILinuxmacOS7.1