When open-source APISIX is enough and when API7 Enterprise earns its place
Open-source Apache APISIX is enough when your platform engineers already run the gateway well and the API catalog has no non-engineering audience. Choose API7 Enterprise when you need a portal, lifecycle tooling or a vendor you can hold to a support contract. API7 Enterprise is built on APISIX, so routing, plugins, hot-loading and the core request path behave the same in both. You are paying for the layers around the gateway, not for a different data plane.
The free gateway fits a team that manages configuration in Git or through the Admin API, runs traditional, decoupled or standalone mode with an agreed owner for etcd, and has no requirement to publish APIs to consumers through a web portal. Your in-house staff then carry upgrades, certificate rotation, incident response and plugin development. Confirm that you can staff those tasks for the life of the platform, and check the APISIX downloads page for the current release and support status before you commit.
A commercial edition earns its place when API publishing is a business process rather than an engineering task. Typical signals are product or partner teams that need a self-service developer portal, governance workflows for API design and approval, and a support obligation that your own on-call team cannot meet alone. Ask API7 which portal, lifecycle and protocol transcoding features are in the Enterprise package, how they are licensed, and what support and availability terms apply to self-hosted deployments. Their published cloud figures cover API7 Cloud only, so request a written quote for your own topology.
Which edition fits which team situation
A platform team that already runs etcd, NGINX-based infrastructure and its own CI/CD can run Apache APISIX under Apache-2.0 with no license fee for the gateway itself. APISIX offers traditional, decoupled and standalone deployment modes, more than 100 built-in plugins, and a file-driven standalone option that hot-reloads conf/apisix.yaml without a restart. API7 Enterprise is described as a full lifecycle product built on APISIX that adds API design integrations, protocol transcoding plugins and an API portal. The paid option matters when the team wants those lifecycle features packaged and supported rather than assembled in-house.
- Open-source coverage: the gateway, plugins, all three deployment modes and the Admin API are available under Apache-2.0.
- What API7 adds: API design integrations, protocol transcoding plugins and an API portal, per API7's enterprise description.
- Effort you keep: your team operates etcd, upgrades, backups and monitoring whichever edition you choose.
- Where the paid option matters: when you would otherwise build the design, transcoding or portal tooling yourself.
- Cost driver: staff time to build and maintain those missing pieces, which recurs over the life of the platform.
Confirm with API7 exactly which components ship in the enterprise package, which upgrade paths apply to an existing APISIX deployment, and whether the operations runbooks they provide cover your etcd topology.
An API product team that needs a published catalog, documentation and self-service access for external or partner developers will find that open-source APISIX does not, by itself, provide a developer portal in the supplied facts. API7 Enterprise lists an API portal among its additions, so this is the situation where the commercial edition is most directly relevant. Teams that already publish docs through their own static site or an internal developer portal may not need it, and can keep APISIX as the gateway layer only.
- Open-source coverage: routing, authentication through plugins such as openid-connect, and traffic control at the gateway.
- What API7 adds: an API portal and API design integrations, as stated on API7's enterprise page.
- Portal alternatives: an existing documentation site or a separate developer portal can serve the same audience without the enterprise license.
- Where the paid option matters: when the portal must be the product your consumers sign up through, with the API lifecycle tied to it.
- Cost driver: the number of API products, consumers and environments you need to publish.
Ask API7 how the portal handles consumer onboarding, access approval, versioned documentation and branding, and whether it runs inside your own network or only in API7 Cloud.
A regulated buyer often needs a named vendor to answer to, a written support policy and a defined escalation route before approving a production gateway. The open-source APISIX project is Apache-2.0 licensed and the downloads page does not mark any release as long-term support, so a community project does not provide a contractual support tier on its own. API7 Enterprise is the commercial product built on APISIX, and API7's pricing page references a Technical Support Policy. The paid option matters when your risk process requires contractual support, not just access to the code.
- Open-source coverage: the full gateway under Apache-2.0, with community documentation and release notes.
- What API7 adds: a commercial product with a Technical Support Policy referenced on its pricing page.
- Support scope: ask what severity levels, response targets and hours the policy covers, since the supplied facts do not state them.
- Where the paid option matters: when audit, procurement or contract rules require a named support obligation.
- Cost driver: the support tier chosen, which is a recurring subscription in addition to any implementation work.
Request the Technical Support Policy in writing, check how it applies to the self-hosted edition as well as API7 Cloud, and confirm how DeployOpen would work alongside that policy during implementation and upgrades.
A team that does not want to run the APISIX control plane can consider API7 Cloud, which API7's pricing page offers as an alternative to self-hosted API7 Enterprise. The pricing page lists usage charges of 2 US dollars per million API calls, 250 US dollars per gateway group per month and 10 US dollars per service per month, and states a 99.95% monthly availability target for the API7-operated Cloud control plane under its Technical Support Policy. This option moves control plane operations to API7, but it also moves control plane location and cost to a metered model. Teams with data residency or air-gap requirements should weigh that before choosing it.
- Open-source alternative: APISIX self-hosted in traditional or decoupled mode, where your team runs etcd and the control plane.
- What API7 Cloud changes: API7 operates the control plane, with the availability target stated on the pricing page.
- Published cost components: 2 US dollars per million API calls, 250 US dollars per gateway group per month and 10 US dollars per service per month.
- Where the paid option matters: when running etcd and control plane upkeep costs more staff time than the metered fees.
- Where it does not fit: environments that must keep configuration inside your own network.
Model your expected call volume, gateway groups and service count against those published rates, and confirm with API7 where the control plane runs, how it is backed up and what the availability target does and does not cover.
What APISIX provides and what API7 Enterprise adds
This table sets the open-source APISIX gateway beside API7 Enterprise, the commercial lifecycle product built on it, row by row. Read the APISIX column as what the Apache project documents, and the API7 column as what API7 describes publicly, with items marked for confirmation needing a direct answer from API7 before you decide.
| Capability | Apache APISIX (open source) | API7 Enterprise |
|---|---|---|
| Gateway core and license | Apache-2.0 licensed, built on NGINX and ngx_lua with LuaJIT, configuration stored in etcd in traditional and decoupled modes | Described by API7 as a full lifecycle solution based on Apache APISIX, so the gateway core is APISIX; confirm licensing terms of the commercial build |
| Built-in plugins | More than 100 built-in plugins covering authentication, security, traffic control, observability and AI gateway functions | Inherits the APISIX plugin set; confirm which plugins are included or extended in the enterprise build |
| Deployment modes | Traditional, decoupled and standalone, the last using a YAML or JSON file or an API with no etcd | Self-hosted API7 Enterprise or API7 Cloud; confirm which of the three APISIX modes each option supports |
| Protocol support | HTTP and HTTPS, HTTP/3 with QUIC, gRPC, WebSocket, MQTT, Dubbo and TCP/UDP proxying | Protocol transcoding plugins are offered; confirm the full protocol list in the enterprise edition |
| Plugin extension languages | Lua inside worker processes; Java, Go and Python through plugin runners; WebAssembly support is experimental | Confirm whether enterprise plugin development follows the same languages and runner model |
| OpenID Connect with identity providers | openid-connect plugin works with Keycloak, Auth0, Microsoft Entra ID, Google and Okta, supporting authorization code, client credentials, introspection and PKCE | Confirm whether the enterprise build adds any identity provider integrations or support commitments beyond the open-source plugin |
| API design integrations and portal | Not part of the open-source project; teams assemble design tooling and a developer portal themselves | Adds API design integrations and an API portal as part of the lifecycle product; confirm supported design tools and portal features |
| Support and cloud operation | Community project under the Apache Software Foundation; support depends on your own staff or a third party | Offers API7 Cloud with a 99.95% monthly availability target for the control plane under API7's Technical Support Policy; confirm the terms that apply to your contract |
How licensing, support and updates differ between the two
APISIX is free under Apache-2.0 and its support comes from the community and whoever you hire. API7 Enterprise is a commercial product built on APISIX, so its support, availability and upgrade terms come from a contract. The cards below cover what to verify on each side before you compare costs.
APISIX license terms
Apache APISIX is licensed under Apache-2.0 and is a top-level Apache Software Foundation project, so you can run, modify and redistribute it without a license fee for the gateway itself. The project's downloads page does not mark any release as long-term support. That means a fixed support window is not promised by the project, and the upgrade planning falls to your team or to the service provider you hire. Confirm which APISIX release line your own patch and upgrade process will track.
API7 Enterprise as a commercial layer
API7 Enterprise is described by API7.ai as a full API lifecycle management product based on Apache APISIX, adding API design integrations, protocol transcoding plugins and an API portal. Those additions are the reason to pay, not the gateway core. Ask API7 which of these components are licensed, which are included in self-hosted deployments, and whether the gateway version you receive tracks the upstream APISIX release line.
Cloud control plane availability target
API7's pricing page states a 99.95% monthly availability target for the API7-operated Cloud control plane under its Technical Support Policy. This is a target, not a credit-backed guarantee unless the policy says so. Read the policy text for how availability is measured, what counts as downtime, and what remedy applies. Note that the target covers the control plane, so confirm separately how gateway traffic continues to flow if the control plane is unavailable.
Self-hosted responsibility split
With self-hosted APISIX, your team or DeployOpen owns patching, certificate rotation, etcd backups and version moves. With self-hosted API7 Enterprise, the commercial contract should define which of those tasks API7 performs or supports. Ask for a written responsibility matrix that lists each upgrade, security fix and incident task, the party responsible, and the response expectation for each. Without that matrix, you cannot compare the two options on operating effort.
Support windows and upgrade cadence
Before you sign anything, ask API7 for the support window of each major release, the frequency of minor and patch releases, and how long an older line receives security fixes. Ask whether upgrades are included in the subscription, how much notice you receive, and whether you can run a mixed version fleet during a rolling upgrade. Compare these answers against the upstream APISIX release dates on the GitHub releases page, since the project does not mark a long-term support line.
Self-hosted API7 Enterprise or API7 Cloud: what changes for operations
The first operational decision with API7 is where the control plane runs. API7 offers self-hosted API7 Enterprise or API7 Cloud, and the pricing page describes the Cloud control plane as operated by API7 with a 99.95% monthly availability target under its Technical Support Policy. With self-hosted Enterprise, your team installs, patches, backs up and upgrades the control plane and its data stores inside your own infrastructure. With Cloud, API7 operates the control plane, but your data plane gateways still run in your environment and still need your own monitoring, certificate handling and rollout process. Confirm in writing which components sit in API7's scope under the Technical Support Policy, which upgrade windows apply, and what happens to gateway traffic if the Cloud control plane is unreachable.
Map this choice onto APISIX's documented modes. In traditional mode, the control plane and data plane run together on each node and etcd is the configuration center, so self-hosting means you run etcd, the Admin API on port 9180 and the client listener on port 9080 on every node you deploy. Decoupled mode separates the data plane from the control plane, but both still share one etcd cluster, so you still operate that etcd cluster, its backups and its quorum. Standalone mode removes etcd and loads configuration from conf/apisix.yaml or conf/apisix.json, which the gateway checks every second. In standalone mode your team owns the file distribution and change pipeline, and no control plane is needed at all. Ask API7 which of these layers it would run for you under each deployment option.
Before you choose, run a short ownership exercise. List every component in your target topology, then mark who patches it, who restores it after a failure, who answers the on-call page and who signs off on upgrades. Keep the list concrete: etcd or a file pipeline, Admin API exposure, the Enterprise portal, certificate rotation and gateway node images. If the list shows that your team would still operate most of the stack under API7 Cloud, the Cloud option saves less effort than its price suggests. If your environment cannot send control plane traffic outside its network, self-hosted Enterprise or a standalone design is the path to test, and API7 should confirm which of its features run without a Cloud connection.
What each edition costs and who gets paid
This table sets out who is paid for each cost of running APISIX yourself versus buying API7 Enterprise, and which costs recur. Read the self-hosted and cloud rows separately, because API7 Cloud pricing is published while self-hosted Enterprise pricing is not.
| Cost component | Who is paid | One-time or recurring, and what drives it |
|---|---|---|
| Apache APISIX license | No license fee under Apache-2.0 | None. The Apache License 2.0 carries no per-node or per-call charge, so the software line is zero for open-source APISIX. |
| Infrastructure and etcd | Your cloud or data center provider, or your hardware team | Recurring. Gateway nodes plus a sized etcd cluster for traditional or decoupled mode. Standalone mode removes etcd but moves configuration into files or the Admin API. |
| Staff time for operation and upgrades | Your platform, SRE or security engineers (internal), or a services firm you hire | Recurring. Covers patching, the APISIX release cadence (3.19.0 was released September 28, 2026), plugin maintenance and on-call. Drivers include the number of clusters and custom Lua or plugin runner code. |
| API7 Enterprise subscription (self-hosted) | API7.ai, under a commercial agreement | Recurring. API7's pricing page offers self-hosted Enterprise but does not publish its price. Request a written quote covering term, support tier, node count and included portal and lifecycle features. |
| API7 Cloud usage pricing | API7.ai, billed on usage | Recurring. Per API7's pricing page: 2 US dollars per million API calls, 250 US dollars per gateway group per month and 10 US dollars per service per month. Call volume, gateway groups and service count drive the total. |
| Support and availability terms | API7.ai under its Technical Support Policy | Recurring with the subscription. API7's pricing page cites a 99.95% monthly availability target for the API7-operated Cloud control plane. Confirm whether the target applies to self-hosted deployments. |
| Migration and switching later | Your team, plus API7 or a partner if engaged | One-time. Moving between self-hosted APISIX and API7 Enterprise depends on how much configuration, portal content and custom plugins are tied to the commercial product. Ask API7 for its export and migration path before signing. |
Moving from open-source APISIX to API7 Enterprise, and back
This illustrative sequence shows how a team would inventory its existing APISIX estate, test API7 Enterprise against it, move configuration across and keep a tested path back to plain APISIX. Because API7 Enterprise is built on APISIX, the checks are narrower than a cross-vendor migration, but they are not skipped.
Inventory routes, plugins and configuration storage
The platform or gateway team lists every route, upstream, consumer, plugin and custom plugin in use, and records how configuration is stored: traditional mode with etcd as the configuration center, decoupled mode with a shared etcd cluster, or standalone mode with conf/apisix.yaml or conf/apisix.json. Each plugin is tagged as built-in or custom, with the runtime it depends on (Lua, an external plugin runner in Java, Go or Python, or WebAssembly). The step is done when the team has a complete inventory signed off by the owners of each API, and a list of anything that would need a second look.
Confirm compatibility of assets with API7 Enterprise
The architecture team checks each inventoried item against API7's documentation and against a non-production API7 Enterprise deployment, since the product is described as based on Apache APISIX but is a separate commercial distribution. Custom plugins, plugin runner versions, openid-connect settings and any reliance on the Admin API port 9180 are tested individually. The output is a compatibility matrix that marks each item as works as-is, needs change or needs vendor confirmation. Ask API7 in writing which APISIX features and versions the enterprise build tracks, and whether any plugin behavior differs.
Pilot the portal and control plane on non-production traffic
The team deploys API7 Enterprise in its own environment, or evaluates API7 Cloud under the vendor's terms, and runs a limited set of non-sensitive routes through it while the existing APISIX estate keeps serving production. The pilot exercises the API portal, management features, authentication flows and logging or observability integration that the team relies on. Confirm where the control plane runs, which data leaves your network in the Cloud option, and what the API7 Technical Support Policy covers. The step closes with a pilot report listing defects, gaps and operational differences.
Export and migrate configuration in controlled waves
The team exports configuration from the existing APISIX deployment, converts it where API7 tooling requires, and imports it wave by wave, starting with low-risk APIs. Each wave runs in parallel with the current gateway, with traffic shifted through DNS, load balancer or ingress weighting that the team controls. Secrets and certificates are moved through the team's secrets process, not copied into configuration files. The wave is done when error rates, latency and authentication outcomes match the baseline recorded in the inventory.
Verify security controls and audit evidence
Security engineers repeat the authentication, authorization and rate-limit tests on the migrated routes and confirm that logs reach the same SIEM or log platform as before. Where compliance evidence depends on gateway configuration, they capture the configuration state and access records for both platforms so that an assessor can see continuity. The step is done when each security control has a test result tied to the migrated route, and the evidence location is documented. DeployOpen can prepare these controls and evidence for an assessment, but independent auditors issue any opinion.
Define and test the rollback path to plain APISIX
Before production cutover, the team writes a rollback procedure that returns traffic to the existing APISIX deployment, including the configuration snapshot taken before migration, DNS or load balancer steps, and who approves the switch. The rollback is rehearsed in a non-production environment to confirm that the stored configuration still loads in the original APISIX mode. Confirm with API7 whether any enterprise-only plugin, portal setting or data format would block this path, and whether a configuration export from API7 Enterprise can be read by open-source APISIX. The step is done when a rehearsal is recorded and the rollback owner has signed off.
Retire or hold the old estate deliberately
After the migrated routes have run stably through an agreed observation period set by the owners, the team decides whether to keep the open-source APISIX deployment as a warm standby, retire it, or keep it for specific workloads. Keeping it preserves the rollback path, but it recurs as infrastructure and operations cost. The decision, the retention period and the owner are written into the change record. The step closes when the inventory is updated to show the final state of every route, plugin and configuration store.
Questions buyers ask before choosing an APISIX edition
What does API7 Enterprise cost to run compared with APISIX alone?
APISIX itself is Apache-2.0 licensed, so the software carries no license fee. API7 Enterprise adds a commercial subscription on top of the same gateway core, and its cost depends on the deployment choice. For a self-hosted install, you pay API7 for the license and support, and you still run the infrastructure, etcd, upgrades and on-call yourself. For API7 Cloud, API7's pricing page lists usage charges of 2 US dollars per million API calls, 250 US dollars per gateway group per month and 10 US dollars per service per month. Your bill scales with call volume, the number of gateway groups and the number of services, so model those three counts against your estate. Ask API7 for a written quote that separates the subscription from any professional services.
How long does a move from open-source APISIX to API7 Enterprise take?
The timeline depends on scope: how many gateways, routes, plugins and custom Lua or plugin-runner code you have, which deployment mode you run, and whether you move to self-hosted or API7 Cloud. Because APISIX is the base of API7 Enterprise, the gateway configuration itself is usually the smaller part of the work. The larger items are the portal, the management workflows, identity integration and the cutover plan for live traffic. No duration is published in the sources for this comparison, so ask API7 for a timeline tied to a written plan with named milestones, a rollback path and the teams who must sign off at each stage.
Can a platform team run APISIX without a commercial edition?
Yes. The open-source APISIX core is Apache-2.0 licensed and includes more than 100 built-in plugins, the three documented deployment modes and the openid-connect plugin. A team that runs it without a commercial edition pays no license fee, and its main cost is staff time. That time covers upgrades, etcd operations in traditional and decoupled modes, certificate handling, monitoring, the Admin API and on-call for the data plane. It also covers building anything the commercial product would otherwise supply, such as a developer portal or management UI. Decide whether your team has that capacity before you compare the subscription against it.
What does the work need from our team?
Plan for skills in Linux, NGINX-based gateway operations, etcd or standalone configuration, TLS and identity protocols such as OAuth 2.0 and OpenID Connect. If you use the Admin API or file-driven standalone mode, staff also need configuration-as-code discipline, since APISIX reads conf/apisix.yaml or conf/apisix.json and hot-reloads changes every second. Engineers who write custom plugins need Lua, or a supported plugin runner language, and a test pipeline for them. Name an owner for upgrades, for security patches and for the portal if you adopt one. Confirm with API7 which of these tasks it performs under a subscription and which stay with your team.
Does API7 Cloud's 99.95% target replace our internal on-call?
No. API7's pricing page states a 99.95% monthly availability target for the API7-operated Cloud control plane under its Technical Support Policy. That target covers the control plane that API7 runs, not your application traffic, your upstream services, your DNS, your identity provider or the routes and plugins you configure. A target is also not a guarantee of any specific credit or remedy, so read the policy text for what happens when it is missed. Keep your own on-call for the parts you own, and ask API7 to explain its incident process, escalation path and response commitments in writing.
What should we ask API7 in a quote?
Ask for a quote that lists each cost line separately: subscription terms, deployment model (self-hosted or API7 Cloud), gateway groups, services, API call volume assumptions, professional services and training. Request the support tier and the Technical Support Policy in full. Ask which components are covered, including the portal and management features, and which APISIX versions you will run. Also ask about upgrade paths, the process for moving from open-source APISIX, data export if you leave, and what changes if your call volume or service count grows. Compare the answers with your own estimate of staff time for the open-source route.
A checklist to settle the edition question before a vendor call
Settle the edition question on paper before you talk to API7, because each answer below points to a specific option. Start with who will use the developer portal. The open-source APISIX project gives you the gateway, its Admin API and its plugins, but the API portal named in API7's Enterprise description is part of the commercial product. If the only consumers are your own engineers, a portal may not be needed at all. If external partners or internal consumers need self-service key issuance and documentation, the portal is a requirement and points toward API7 Enterprise. Next, list the lifecycle features you need beyond routing and policy enforcement, such as API design integrations and protocol transcoding. Those are the features API7 names as additions on top of APISIX, so an item on this list that you cannot satisfy with plugins you already run is a signal to price the commercial edition.
Then record your support obligations and hosting constraints. Ask whether you need a vendor-backed response commitment, and whether the data plane and control plane must stay inside your own network or your cloud accounts. API7 offers both self-hosted API7 Enterprise and API7 Cloud, and the API7-operated Cloud control plane carries a 99.95% monthly availability target under its Technical Support Policy. That target applies to the control plane only, so ask API7 in writing which components it covers, how the target is measured and what remedy applies. Also assess your team's operating capacity honestly: who patches etcd, the gateway nodes and the portal, and who is on call for them. Finally, estimate your monthly API call volume and the number of gateway groups and services you expect. Those inputs drive API7 Cloud usage pricing of 2 US dollars per million API calls, 250 US dollars per gateway group per month and 10 US dollars per service per month, as listed on API7's pricing page. Run that arithmetic on your own volumes before the call, and confirm with API7 whether any other charges apply.
How DeployOpen scopes and supports APISIX or API7 deployments
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For Apache APISIX vs API7 Enterprise, we start from the decision you have to make, then write down what the chosen path includes before any work begins.
How we scope
- Confirm which APISIX deployment mode fits your traffic, teams and hosting, with traditional, decoupled or standalone compared in writing.
- Record whether you need self-hosted API7 Enterprise, API7 Cloud, or open-source APISIX, and which components each option includes.
- Agree in writing on the identity provider, plugins, routes and environments in scope, so the quote follows from a defined list.
How we build
- Install and configure the gateway in your cloud accounts, data centers or air-gapped network, with the Admin API access you approve.
- Wire OpenID Connect against your identity provider, testing the flows your applications actually use before go-live.
- Test routing, rate limiting, and plugin behavior against your own traffic patterns, and record the results as part of the deliverables.
How we hand over
- Document configuration, plugin choices, deployment topology and the upgrade path, so your own team can operate the gateway.
- Deliver runbooks for backup, restore and upgrades, written for the mode and tooling you choose.
- Provide a licensing summary that lists which features are open source and which depend on an API7 subscription or other terms.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped separately from the initial fixed-scope engagement.
- Before any upgrade, we check the release notes and support windows for the APISIX or API7 version you run, and confirm them with the vendor.
- Ask any provider, including DeployOpen, to confirm which support terms apply to your chosen edition before you sign.
