Apiman
What it is
Apiman is open-source software for managing APIs, including access security, discovery, and governance across the API lifecycle. Its policy system governs APIs at runtime and can provide different service levels for the same API. The management layer combines a REST API, Manager UI, and standalone Developer Portal with multi-tenancy, events, notifications, permissions, and approvals. Teams can build custom policies and components using Java plugins, which can be loaded while the system is running without a restart. Gateways scale independently from the Manager and can continue operating if the Manager becomes unavailable. Supported gateway platforms include Vert.x, WildFly, and Tomcat. Standard policies cover authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT authentication through the Keycloak plugin, and HTTP security headers. Apiman is licensed under Apache License 2.0, with no features hidden behind paywalls. Its primary focus is HTTP APIs; WebSockets lack explicit testing or support, while raw TCP, raw UDP, and messaging protocols are unsupported. Version 3.x is community-supported; versions 2.x and 1.x are unsupported.
For and against
For
- Apache License 2.0 with no paywalled features.
- Includes a REST API, management UI, and developer portal.
- Custom Java plugins can load at runtime without a restart.
- Gateways can continue running if the Manager goes down.
- Supports Vert.x, WildFly, and Tomcat gateways.
Against
- Raw TCP, raw UDP, and messaging protocols are unsupported.
- WebSockets lack explicit testing or support.
- Versions 2.x and 1.x are unsupported.
- Up-front billing and payment capture are not provided.
The verdict
Apiman brings API access controls, governance, and management tools into an open-source, self-hosted package. Check protocol needs and version support before choosing it.
Who it suits
Apiman suits teams that want self-hosted, open-source API management with runtime policies and a developer portal. It is a better fit for HTTP API use cases than for teams relying on raw network or messaging protocols.
Plans and prices
Apiman Community Edition
Apache-2.0 licensed · no features hidden behind paywalls · self-hosted
Read 9 Oct 2026 · apiman.io
Advanced
32 cores · 24/7 support · 10 days professional services · 41 days feature development
Read 9 Oct 2026 · blackparrotlabs.io
Essentials
4 cores · 24/7 support · 1 day professional services · 5 days feature development
Read 9 Oct 2026 · blackparrotlabs.io
Standard
16 cores · 24/7 support · 5 days professional services · 20 days feature development
Read 9 Oct 2026 · blackparrotlabs.io
On the record
- API governance
- Apiman supports policy-based runtime governance and multiple plans that can offer different service levels for the same API.apiman.io · read 9 Oct 2026
- Extensibility
- Developers can create custom policies and components with Java plugins, and plugins can be loaded dynamically at runtime without restarting.apiman.io · read 9 Oct 2026
- Gateway deployment
- The gateways scale independently of the Manager and can continue running if the Manager goes down.apiman.io · read 9 Oct 2026
- Integrations
- The feature page names Keycloak for identity management and Elasticsearch, Prometheus, InfluxDB, and JDBC as gateway metrics emitters.apiman.io · read 9 Oct 2026
- License
- The project says Apiman is licensed under Apache License 2.0, with no features hidden behind paywalls.apiman.io · read 9 Oct 2026
- Management
- The management layer includes a REST API, Manager UI, and standalone Developer Portal, as well as multi-tenancy, events, notifications, permissions, and approvals.apiman.io · read 9 Oct 2026
- Monetization limit
- Apiman supports post-hoc billing or monetization through metrics but does not currently provide explicit up-front billing or payment capture.apiman.io · read 9 Oct 2026
- Protocol limits
- Apiman is primarily an HTTP API gateway; the feature page says WebSockets lack explicit testing or support and raw TCP, raw UDP, and messaging protocols are unsupported.apiman.io · read 9 Oct 2026
- Purpose
- Apiman is open-source API management software covering the API management lifecycle, including secure API access and API discovery and governance.apiman.io · read 9 Oct 2026
- Security policies
- Standard policies include authorization, BASIC authentication, IP allowlisting and blocklisting, OAuth2/JWT authentication via the Keycloak plugin, and HTTP security headers.apiman.io · read 9 Oct 2026
- Security support
- The project security policy lists version 3.x as community-supported and versions 2.x and 1.x as unsupported.github.com · read 9 Oct 2026
- Support
- Black Parrot Labs offers commercial Apiman support, development, and expertise, with support packages described as including 24/7 support and CVE patching and alerts.blackparrotlabs.io · read 9 Oct 2026
- Supported gateway platforms
- The site lists Vert.x, WildFly, and Tomcat as supported gateway platforms and says Vert.x provides the best performance.apiman.io · read 9 Oct 2026
