Skip to content
SPECIFICTION
Get listed

Apiman

apiman.io

Free plan WebLinuxAPISelf-hosted
Visit apiman.io
Spec score 8.1 #7 of 28 in Rest Apis

What it is

Apiman is open-source API management software for securing API access and handling discovery and governance across the API lifecycle. Its policy-based runtime governance supports multiple plans with different service levels for the same API. The management layer includes a REST API, Manager UI, and standalone Developer Portal, along with multi-tenancy, events, notifications, permissions, and approvals. Teams can create custom policies and components with Java plugins, which can be loaded at runtime without restarting. Gateways scale independently from the Manager and can keep running if the Manager goes down. Supported gateway platforms are Vert.x, WildFly, and Tomcat. Standard policies cover authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT through the Keycloak plugin, and HTTP security headers. Apiman is licensed under Apache License 2.0, with no features behind paywalls. It is primarily an HTTP gateway: WebSockets lack explicit testing or support, while raw TCP, raw UDP, and messaging protocols are unsupported. Version 3.x is community-supported; versions 2.x and 1.x are unsupported. Commercial support packages are also described as including 24/7 support and CVE patching and alerts.

Spec sheet

Purpose
Apiman is open-source API management software covering the API management lifecycle, including secure API access and API discovery and governance.Read 9 Oct 2026 · apiman.io
Integrations
The feature page names Keycloak for identity management and Elasticsearch, Prometheus, InfluxDB, and JDBC as gateway metrics emitters.Read 9 Oct 2026 · apiman.io
Support
Black Parrot Labs offers commercial Apiman support, development, and expertise, with support packages described as including 24/7 support and CVE patching and alerts.Read 9 Oct 2026 · blackparrotlabs.io
License
The project says Apiman is licensed under Apache License 2.0, with no features hidden behind paywalls.Read 9 Oct 2026 · apiman.io
API governance
Apiman supports policy-based runtime governance and multiple plans that can offer different service levels for the same API.Read 9 Oct 2026 · apiman.io
Extensibility
Developers can create custom policies and components with Java plugins, and plugins can be loaded dynamically at runtime without restarting.Read 9 Oct 2026 · apiman.io
Gateway deployment
The gateways scale independently of the Manager and can continue running if the Manager goes down.Read 9 Oct 2026 · apiman.io
Management
The management layer includes a REST API, Manager UI, and standalone Developer Portal, as well as multi-tenancy, events, notifications, permissions, and approvals.Read 9 Oct 2026 · apiman.io
Monetization limit
Apiman supports post-hoc billing or monetization through metrics but does not currently provide explicit up-front billing or payment capture.Read 9 Oct 2026 · apiman.io
Protocol limits
Apiman is primarily an HTTP API gateway; the feature page says WebSockets lack explicit testing or support and raw TCP, raw UDP, and messaging protocols are unsupported.Read 9 Oct 2026 · apiman.io
Security policies
Standard policies include authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT authentication via the Keycloak plugin, and HTTP security headers.Read 9 Oct 2026 · apiman.io
Security support
The project security policy lists version 3.x as community-supported and versions 2.x and 1.x as unsupported.Read 9 Oct 2026 · github.com
Supported gateway platforms
The site lists Vert.x, WildFly, and Tomcat as supported gateway platforms and says Vert.x provides the best performance.Read 9 Oct 2026 · apiman.io

Plans and prices

Apiman Community Edition Free Apache-2.0 licensed · no features hidden behind paywalls · self-hosted Read 9 Oct 2026 · apiman.io
Advanced Priced on request 32 cores · 24/7 support · 10 days professional services · 41 days feature development · unlimited CVE patching and alerts Read 9 Oct 2026 · blackparrotlabs.io
Essentials Priced on request 4 cores · 24/7 support · 1 day professional services · 5 days feature development · unlimited CVE patching and alerts Read 9 Oct 2026 · blackparrotlabs.io
Standard Priced on request 16 cores · 24/7 support · 5 days professional services · 20 days feature development · unlimited CVE patching and alerts Read 9 Oct 2026 · blackparrotlabs.io

Every Apiman plan and price →

Strong points and limits

Strong points

  • Apache License 2.0 software with no paywalled features.
  • Gateways can continue running if the Manager goes down.
  • Custom Java plugins can load without a restart.
  • Includes a standalone Developer Portal.

Limits

  • Raw TCP, raw UDP, and messaging protocols are unsupported.
  • WebSockets lack explicit testing or support.
  • Only version 3.x is community-supported.
  • Up-front billing and payment capture are not provided.

Who it suits

Apiman suits teams that want self-hosted, open-source API management with policy-based governance, a developer portal, and extensible Java plugins. It is a better fit for HTTP APIs than systems that depend on raw TCP, raw UDP, or messaging protocols.

Verdict

Apiman offers a broad API management lifecycle for teams comfortable operating gateway and manager components themselves. Its protocol scope and version support status should be checked before adoption.

Where Specifiction places it

Alternatives to ApimanAll alternatives →