Apache APISIX vs Apiman

Apache APISIX is a free, Apache 2.0-licensed, self-hosted gateway for routing, securing and managing API, microservice and LLM traffic. It runs on bare metal or Kubernetes and supports HTTP, HTTPS, TCP, UDP, WebSocket, gRPC, MQTT, HTTP/3 and Dubbo, with HTTP-to-gRPC transcoding. More than 100 open-source plugins cover traffic management, security, observability and protocol handling. The project provides authentication options including API keys, JWT, Basic Authentication, OAuth 2.0/OpenID Connect, HMAC, LDAP, CAS, Keycloak, Casdoor, forward authentication and multi-auth, along with rate limiting and request transformation. Its NGINX-and-etcd architecture uses hot-reloadable plugins and distributes cluster configuration without restarts. AI gateway functions include multi-provider proxying, load balancing, retries, fallback, token limits, prompt security and transformation. Listed integrations include Prometheus, Grafana, Datadog, OpenTelemetry, Kubernetes, Redis, OpenAI, Anthropic and AWS Bedrock. Official source releases include detached signatures and SHA-512 checksums.

Apiman is open-source API management software for securing API access and handling discovery and governance across the API lifecycle. Its policy-based runtime governance supports multiple plans with different service levels for the same API. The management layer includes a REST API, Manager UI, and standalone Developer Portal, along with multi-tenancy, events, notifications, permissions, and approvals. Teams can create custom policies and components with Java plugins, which can be loaded at runtime without restarting. Gateways scale independently from the Manager and can keep running if the Manager goes down. Supported gateway platforms are Vert.x, WildFly, and Tomcat. Standard policies cover authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT through the Keycloak plugin, and HTTP security headers. Apiman is licensed under Apache License 2.0, with no features behind paywalls. It is primarily an HTTP gateway: WebSockets lack explicit testing or support, while raw TCP, raw UDP, and messaging protocols are unsupported. Version 3.x is community-supported; versions 2.x and 1.x are unsupported. Commercial support packages are also described as including 24/7 support and CVE patching and alerts.