All-in-One API Management
Full lifecycle API management in as a self-hosted, open-source server. Design, secure, publish, and monitor APIs from one place. Built for government, finance, and regulated industries that need complete control over their infrastructure.
Why it matters
Most teams cobble together separate tools for design, security, publishing, and monitoring. The result: gaps between tools, inconsistent policies, and wasted engineering time on integration plumbing. WSO2 API Manager Server ships the entire lifecycle as a single, self-hosted solution.
Choice of gateway technology
Starting with WSO2 API Manager Server 4.7, you can select the best gateway to fit your specific needs and stack. Choose either the Java-based Universal Gateway or new Go-based Platform Gateway.
Go from spec to production in minutes
Import an OpenAPI spec, attach policies, and publish to your developer portal. No handoffs between teams. No deployment scripts to maintain.
Give developers a portal they'll actually use
Interactive try-it console, auto-generated SDKs in multiple languages, and self-service key management. Developers onboard themselves instead of filing tickets.
100% open source, 100% yours
Apache 2.0 licensed. Full source code. Deploy on your own infrastructure with no per-gateway fees, no usage caps, and no vendor lock-in.
Built for regulated environments
Air-gapped deployments, on-premises Kubernetes, and disconnected networks. WSO2 API Manager Server runs where your compliance requirements demand.
WSO2 API Manager Server is trusted by enterprises across 90+ countries in government, financial services, healthcare, and beyond.
Key capabilities
Design and publish any API type
Import or build REST, GraphQL, WebSocket, and Webhook APIs. Manage versions, lifecycle states, and subscriptions from a single publisher console. AI-assisted API testing with API Chat helps teams evaluate APIs faster.
- OpenAPI spec import with built-in designer
- Lifecycle states from creation through deprecation and retirement
- Revision-based deployment with rollback support
- Multi-tenant publisher console for team-based API ownership
API governance
Define and enforce API standards across your organization from a single control point. Approval workflows control who can publish APIs and which developers get access. Audit logging captures every change so you have a clear compliance trail.
- Lifecycle approval workflows for API publishing and access
- Centralized policy enforcement across all gateways
- Audit logging for all API and policy operations
- Scope-based authorization with XACML and OPA support
Developer portal that drives adoption
A self-service marketplace where developers discover, evaluate, and subscribe to APIs without waiting for your team. White-label ready for partner and customer-facing deployments.
- Interactive try-it console for REST, GraphQL, and SOAP
- Auto-generated SDKs in multiple languages
- Self-service application registration and key management
Deploy gateways where your infrastructure lives
Run Universal, Kubernetes, Immutable, or Event gateways in any environment. Supports air-gapped networks, disconnected data centers, and on-premises Kubernetes clusters where external connectivity is restricted or prohibited.
- Multiple gateway types for different deployment needs
- Air-gapped and disconnected environment support
- Distributed rate limiting, caching, and edge deployment
- On-premises Kubernetes, Docker, and bare metal runtimes
AI gateway and MCP built in (4.6+)
Route LLM traffic across OpenAI, Anthropic, Azure OpenAI, Bedrock, Gemini, and Mistral. Apply guardrails for content safety, PII masking, and prompt filtering. Expose your APIs as MCP tools for AI agents.
- Multi-model LLM routing
- Built-in and third-party AI guardrails (AWS Bedrock Guardrail, Azure Content Safety)
- Semantic caching to reduce LLM latency and cost
- MCP Hub for governed AI agent tool discovery
API analytics powered by Moesif
Track traffic, latency, errors, and business metrics across all APIs and environments. Moesif integration provides user-centric observability so you can see how developers actually use your APIs, not just infrastructure health.
- Real-time API traffic and error monitoring
- Per-developer and per-application usage tracking
- Anomaly detection and alerting via Slack or PagerDuty
- OpenTelemetry tracing support for end-to-end visibility
Security that doesn't slow you down
Multi-layered security with flexible authentication, fine-grained authorization, and real-time threat protection. Apply policies once and enforce across every gateway type and environment.
- OAuth 2.0, API keys, mutual SSL, JWT, and basic auth
- XACML, OPA, and scope-based authorization
- Bot detection, payload validation, and injection prevention
- Distributed rate limiting and throttling
Benefits at a glance
All-in-one API management publisher, developer portal, gateway, key manager,
and analytics in a single deployment.
100% open source
Apache 2.0 licensed. Full source code. No vendor lock-in.
Built for regulated
industries
Air-gapped deployments, on-premises hosting, and full audit logging for compliance.
Self-hosted, self-controlled
Runs on your infrastructure. Your data never leaves your network.
AI-ready
LLM routing, guardrails, semantic caching, and MCP support built in.
Developer portal that drives adoption
Try-it console, SDKs, and self-service onboarding reduce time-to-first-call.
WSO2 API Manager Server is how enterprises ship, secure, and scale APIs.
One platform. Open source. AI-ready.