Azure API Management self-hosted gateway vs fully self-hosted API management

No, not as a fully disconnected gateway. The self-hosted gateway runs in your network and keeps client traffic local, but it still needs outbound connectivity to Azure at a regular interval, which Microsoft's documentation describes as every minute. A deployment with no path to Azure is therefore a different architecture, and you would need to run the gateway, control plane and developer portal yourself. Confirm the current connectivity requirements, the tiers that include the self-hosted gateway and the behavior when the link drops with Microsoft's documentation and a test in your own environment. If your rules forbid any outbound path, plan for fully self-hosted management, and ask any implementation partner to show the egress rules they will configure and the logs that prove no unexpected destinations are reached.

The cost has four parts: people, infrastructure, licenses or support, and migration work. The base gateways, such as Apache APISIX (Apache-2.0) and Kong Gateway OSS (Apache-2.0), carry no license fee, but you still pay for the engineers who design, build and operate the stack. One-time work includes architecture, offline packaging of images and packages, identity integration, policy migration, hardening, documentation and cutover. Recurring work includes compute and storage for the gateway, the configuration store, the portal and monitoring, plus patching, upgrades, backups, certificate rotation, security testing and on-call time. Licensing becomes recurring when you need enterprise features or vendor support. Ask for a quote that splits one-time and recurring costs, names each deliverable, lists assumptions such as the number of APIs and environments, and states what is excluded.

The duration depends on scope more than on the gateway product. The main drivers are the number of APIs and policies to re-create, how many identity providers and backends must be connected, whether you need multi-region or high availability, and how many environments and network zones are involved. Air-gapped delivery adds work because every container image, package and vulnerability data source must be mirrored and verified before it crosses the boundary. Approval cycles for firewall changes, certificates and security review often take longer than the technical build. No general duration is supplied for this migration, so ask the partner for a timeline tied to a written scope, with milestones for design, build, pilot, cutover and handover, and ask which of those dependencies sit with your teams.

Your team needs skills in four areas. Platform operators need experience with the container or Kubernetes runtime and the configuration store the gateway uses, such as etcd for APISIX in traditional or decoupled mode. Network and security staff own egress rules, certificates, DNS, load balancing and logging. Identity engineers connect the gateway to your identity provider and set token validation. API owners decide policies, rate limits, versioning and who may subscribe. Someone must also own the upgrade calendar, vulnerability intake and backup restore tests after go-live. Ask the partner to name which roles they expect you to fill, how many people that means in practice, and what knowledge transfer or runbook handover is included in the written scope.

Yes, many teams do, provided they have the skills listed above and time to build them. Open-source gateways such as Apache APISIX and Kong Gateway OSS can run in standalone, containerized or Kubernetes setups, and their documentation covers each mode. Offline work is the harder part: a Kubernetes cluster built without internet access needs control plane images pulled in advance and pointed at a private registry, as described in the kubeadm documentation, and the same logic applies to gateway images, portal assets and plugins. Outside help is most useful for the one-off design, offline packaging, hardening and cutover, and for retainers that cover upgrades and testing. Decide early which parts your team owns, and treat that split as an explicit line in the written scope.

Licensing differs by product, so check each feature against its license. Apache APISIX is Apache-2.0 licensed and ships more than 100 built-in plugins under that license. Gravitee API Management is Apache-2.0 licensed, but its documentation states that the Enterprise Edition requires a license, and some features, including several advanced protocol and audit capabilities, sit in that edition. WSO2 API Manager is Apache-2.0 licensed, while WSO2 sells on-prem subscriptions with support, updates and a licensed distribution for commercial use. Across the wider market, air-gapped deployment is often limited to paid editions. Ask each vendor in writing which features you need are included in the free edition, whether offline updates and images are covered, and what happens to support if you run the product disconnected.

NERC CIP-005-7 requires that interactive remote access to high and medium impact BES Cyber Systems pass through an Intermediate System with encryption and multi-factor authentication, and that you can detect and disable active vendor remote access sessions. NERC CIP-013-2 requires procurement processes that address verification of software integrity and authenticity for vendor software and patches, which is the control behind checking every package carried across an isolated boundary. For an API gateway, that means documenting how gateway and portal artifacts are sourced, hashed, scanned and transferred, and how changes reach the isolated zone. DeployOpen prepares systems, controls and evidence for compliance assessments, but auditors and certification bodies issue the assessment results. Ask your compliance lead to confirm which requirements apply to your asset classification before scoping the work.

A useful quote lists the scope before the price. It should name the gateways, control plane and portal components in scope, the number of APIs, policies, consumers and environments, and the identity and backend integrations. It should state the deliverables for design, offline packaging, migration, hardening, documentation, testing and handover, plus the acceptance criteria for each. Assumptions matter as much as the figures: your network zones, approval steps, hardware and existing monitoring. Exclusions should be explicit, such as third-party license fees, hardware purchases and developer portal content authoring. Separate one-time work from optional retainers for upgrades, support and continuous security testing. DeployOpen does not publish a price list, and a quote follows from the written scope, so use this list to compare proposals on like terms.