Amazon API Gateway vs Apiman

Amazon API Gateway is a cloud service for creating, publishing, maintaining, monitoring, and securing APIs that connect applications to backend services. It supports REST, HTTP, and WebSocket APIs, including real-time two-way communication. Integrations include AWS Lambda, Step Functions, Elastic Beanstalk, EC2, and public HTTP endpoints; HTTP APIs can also route requests to certain private services. API Gateway Portals provide managed spaces to discover, document, and govern REST APIs. Traffic controls include request throttling and configurable caching for REST APIs. The console integrates with Amazon CloudWatch for call, latency, and error metrics, alarms, and execution logs. Authorization options include IAM, Lambda authorizers, OIDC, OAuth 2.0, and other listed methods; REST API keys are optional. A free tier is available to new AWS customers for up to 12 months within monthly allowances, with excess usage charged at standard rates. Pay-as-you-go has no minimum fees or upfront commitments; the listed pricing note is From $1. WebSocket messages can be up to 128 KB and are metered in 32 KB increments.

Apiman is open-source API management software for securing API access and handling discovery and governance across the API lifecycle. Its policy-based runtime governance supports multiple plans with different service levels for the same API. The management layer includes a REST API, Manager UI, and standalone Developer Portal, along with multi-tenancy, events, notifications, permissions, and approvals. Teams can create custom policies and components with Java plugins, which can be loaded at runtime without restarting. Gateways scale independently from the Manager and can keep running if the Manager goes down. Supported gateway platforms are Vert.x, WildFly, and Tomcat. Standard policies cover authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT through the Keycloak plugin, and HTTP security headers. Apiman is licensed under Apache License 2.0, with no features behind paywalls. It is primarily an HTTP gateway: WebSockets lack explicit testing or support, while raw TCP, raw UDP, and messaging protocols are unsupported. Version 3.x is community-supported; versions 2.x and 1.x are unsupported. Commercial support packages are also described as including 24/7 support and CVE patching and alerts.