Apache APISIX vs Gravitee: which to choose

Apache APISIX vs Gravitee: when a gateway-first project fits and when a full API management platform does

Choose Apache APISIX when your platform team needs a self-hosted gateway that handles routing, authentication and traffic policy, and you are willing to build the publisher portal, approval workflow and lifecycle tooling around it. APISIX is Apache-2.0 licensed, runs on NGINX and etcd, and offers more than 100 built-in plugins. Choose Gravitee APIM when you want the gateway, a Console UI for administrators and a Portal UI for API consumers to ship as one product. Gravitee's core is also Apache-2.0, so the difference is not the gateway code. It is what sits around the gateway and which features sit behind the Enterprise Edition license.

The decision turns on three questions. First, do you need a publisher-facing portal and lifecycle console on day one, or can your own developer portal and API catalog come later? Second, which event and protocol endpoints must you expose: Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ, JMS, Server-Sent Events or webhooks? Gravitee lists several of these as Enterprise Edition features, while APISIX's repository lists HTTP/3, gRPC, WebSocket, MQTT and TCP/UDP proxying. Confirm each endpoint against both products in a test environment before you commit.

Third, decide whether Enterprise-only features are in scope. Gravitee's documentation says the APIM Enterprise Edition requires a license and lists data masking, GeoIP filtering, Dynamic Client Registration, the Alert Engine, Redis caching and audit trails of API consumption among its paid features. Ask Gravitee for the current license terms and which of these your controls depend on, and budget for the license as a recurring cost. For APISIX, check your OpenID Connect and identity provider requirements against the openid-connect plugin documentation, since your answer determines how much custom work your team carries.

Which platform fits which API program

This table sets out the API programs most likely to shortlist Apache APISIX or Gravitee APIM and names the better fit for each. Read each row as a condition: the recommendation holds only when the stated requirement is真 the deciding factor for your team.

Program need	Better fit	Condition under which it holds
Kubernetes platform team needing an ingress and gateway with plugin extensibility	Apache APISIX	The team wants to write custom plugins in Lua or through external plugin runners in Java, Go or Python, and is comfortable running the separate APISIX Ingress Controller alongside the gateway.
API program needing a developer portal and subscription workflows	Gravitee APIM	The program needs a catalog of APIs with documentation for consumers, and the Portal UI and Console UI are central to how it operates. Confirm the portal features each edition includes before deciding.
Teams needing Kafka, MQTT or JMS endpoints through the gateway	Gravitee APIM	Kafka publish and subscribe over HTTP and WebSocket, MQTT5, JMS and Solace endpoints are listed as Enterprise Edition features, so the team must accept a Gravitee license for them. APISIX lists MQTT proxying in its repository, so confirm the exact Kafka and JMS behavior needed before choosing it.
Teams with an existing Keycloak or Entra ID estate	Apache APISIX	The team wants OpenID Connect with Keycloak or Microsoft Entra ID through the openid-connect plugin under Apache-2.0, with authorization code, client credentials, introspection and PKCE flows. Confirm that the Gravitee flows you need are available in your edition.
Teams that need data masking, GeoIP filtering or Redis caching in the gateway	Gravitee APIM	These controls are documented as Enterprise Edition features, so the decision depends on whether the team will license Gravitee Enterprise. Without that license, check APISIX's built-in plugin catalog against the same controls.
Teams that need audit trails of API consumption and activity	Gravitee APIM	Audit trails are listed as an Enterprise Edition feature. If the team needs them from a gateway with no paid tier, confirm the logging and observability options available in open-source APISIX for the same evidence.
Teams that want a gateway with no enterprise license decision at all	Apache APISIX	All APISIX plugins are covered by Apache-2.0 and the project lists more than 100 built-in plugins. The team should still confirm which features it depends on are in the open-source build and which need a third-party product.
Teams that want a managed SaaS option alongside self-hosting	Gravitee APIM	Gravitee documents SaaS, hybrid and fully self-hosted deployment for Enterprise customers. APISIX's documented modes are self-hosted, so this matters only if the team wants a vendor-run control plane.

How APISIX and Gravitee are built and deployed

APISIX and Gravitee take different routes to the same goal: a gateway that enforces access to APIs. APISIX is a gateway you assemble from configuration and plugins, while Gravitee ships a gateway alongside a management backend, administrator console and developer portal. The cards below cover what each component does and what each deployment choice means for upgrades and day-to-day operations.

APISIX on NGINX and etcd

APISIX runs on NGINX and ngx_lua with LuaJIT, and in traditional and decoupled modes it keeps configuration in etcd. Your platform team must run and back up an etcd cluster, and must understand how it behaves during a network partition between data and control planes. Check who owns that etcd cluster, how its backups are tested, and whether your Kubernetes or GitOps tooling expects to write to the Admin API or to files. Those answers shape your upgrade path more than the gateway itself.

Traditional and decoupled topologies

In traditional mode, data plane and control plane run together on each node, with client traffic on port 9080 and the Admin API on port 9180. Decoupled mode separates the two planes into their own instances while they share one etcd cluster. Traditional mode is simpler to start with, but Admin API exposure and scaling happen on the same nodes that serve traffic. Decoupled mode lets you lock the Admin API into a management network, which is a question to settle before you expose the gateway.

Standalone file and API configuration

Standalone mode removes etcd entirely and reads routes from conf/apisix.yaml or conf/apisix.json, or accepts configuration through an API. In file-driven mode APISIX checks those files for changes every second and reloads without a restart. This suits GitOps workflows where routes live in version control, but it changes how you audit changes and roll back. Confirm which mode your review process can verify and how a bad file is caught before it reaches production traffic.

Gravitee gateway and management API

Gravitee separates the runtime gateway from the management API backend, which holds API definitions, plans, subscriptions and analytics. Operators work through two UIs: the Console for administrators and the Portal, which is the catalog of APIs with documentation for consumers. Upgrades must keep the gateway and management backend on compatible versions, and you should test that pairing before each change. Ask Gravitee which versions of each component are supported together for the release you intend to run.

Gravitee Docker Compose and Helm options

Gravitee supports Docker Compose with MongoDB for smaller or evaluation installs, and a Helm chart for Kubernetes that covers AKS, GKE, EKS and OpenShift. Compose is quick to stand up but puts MongoDB availability, backup and upgrade work on your team. The Helm chart moves that work into Kubernetes operations, with its own storage and secret handling. Decide early which path matches your cluster standards, because switching later means migrating definitions and analytics data.

SaaS, hybrid and self-hosted for Enterprise

Gravitee documents SaaS, hybrid and fully self-hosted deployment for Enterprise customers, while its Community Edition is self-hosted. For a regulated team, the choice decides where gateway traffic, logs and analytics live and who patches the management plane. Hybrid splits control from runtime, so confirm where the management backend runs and what traffic leaves your network. Ask Gravitee to confirm the deployment options included in your specific license before you design around them.

Where APISIX plugins and Gravitee policies differ in practice

Choose APISIX when the gateway's behavior is the main asset and your engineers want to shape it directly. The APISIX documentation describes more than 100 built-in plugins covering authentication, security, traffic control, observability and AI gateway functions, so many common needs require no custom code. When a gap remains, Lua plugins run inside the NGINX worker processes, and plugin runners extend the gateway in Java, Go and Python. Each runner is a separate process that you must deploy, monitor and upgrade alongside the gateway, which adds operating effort that a built-in plugin does not. WebAssembly plugin support is listed as experimental in the APISIX architecture documentation, so test it before it carries production traffic.

Gravitee extends its gateway through a policy model, and its documentation ties the stronger controls to the Enterprise Edition. That edition adds an enterprise policy pack, data masking, GeoIP filtering, Dynamic Client Registration and the Alert Engine, which are the controls a security review often asks about. Compare each one against the license before you treat it as equivalent to an APISIX plugin with a similar name. The sources for this comparison do not settle which custom policy languages Gravitee supports in each edition, so ask Gravitee in writing whether custom policies are written in Java or another language, how they are packaged and deployed, and whether Community Edition users can build their own. Also ask whether policy changes can be made through the API or only through the Console UI, as that decides how well they fit a GitOps workflow. Confirm the Enterprise Edition scope against the version you plan to run.

Plugin breadth matters more than a console when your platform team manages the gateway as code. If you configure routes and plugins through the Admin API, or through a file in standalone mode, and you need custom authentication flows, header rewriting or checks that no standard control covers, the plugin catalog and its extension path will decide your workload. A console matters more when API product owners publish, subscribe to and audit APIs without filing tickets with engineers. As an illustrative check, list the controls your security review requires, label each one as a built-in APISIX plugin, a plugin runner, or a Gravitee policy in the edition you would buy, then prototype the two least common ones in a lab before scoring either platform.

Capability comparison: gateway, portal, protocols and identity

This table sets Apache APISIX against Gravitee APIM on license, protocol coverage, plugin and policy breadth, and identity integration. Read the Gravitee column as conditional: several event, security and AI features sit behind its Enterprise license, so confirm each one against the edition you would buy.

Capability	Apache APISIX	Gravitee APIM
License	Apache-2.0, a top-level Apache Software Foundation project with no separate enterprise tier for the gateway core	Apache-2.0 for the open-source repository, with an Enterprise Edition that requires a license for the features listed below
Core gateway	Built on NGINX and ngx_lua with etcd for configuration in traditional and decoupled modes, or a YAML or JSON file in standalone mode	Gateway, management API backend, Console UI for administrators and Portal UI for consumers, deployable as SaaS, hybrid or self-hosted for Enterprise customers
Built-in plugin breadth	More than 100 built-in plugins covering authentication, security, traffic control, observability and AI gateway functions	Policy set in the open-source edition; the enterprise policy pack, data masking, GeoIP filtering and Redis caching are Enterprise Edition features, so confirm the exact policies you need
HTTP, HTTPS and HTTP/3	HTTP, HTTPS and HTTP/3 with QUIC are listed in the APISIX repository	Confirm HTTP/3 support for your Gravitee version and edition before relying on it
gRPC and WebSocket	gRPC and WebSocket proxying are listed in the APISIX repository	WebSocket is an Enterprise Edition entrypoint for Kafka publish and subscribe; confirm gRPC support in your edition
MQTT and TCP/UDP	MQTT and TCP/UDP proxying are listed in the APISIX repository	MQTT5 is an Enterprise Edition endpoint; confirm TCP/UDP and MQTT 3.x handling with Gravitee before scoping
Event and messaging endpoints	Not listed as built-in endpoint types in the supplied APISIX facts; confirm any Kafka or broker proxying with your architects	Enterprise Edition lists Kafka, Azure Service Bus, MQTT5, RabbitMQ, Solace and JMS endpoints, plus Server-Sent Events and Webhook entrypoints
Identity (OIDC)	The openid-connect plugin works with Keycloak, Auth0, Microsoft Entra ID, Google and Okta and supports authorization code, client credentials, token introspection and PKCE flows	Confirm OIDC provider coverage, Dynamic Client Registration and flow support in your Gravitee edition, since DCR is an Enterprise feature
AI and audit features	AI gateway functions are part of the plugin catalog; confirm the specific plugins you need	Enterprise Edition adds audit trails of API consumption and activity, Agent-to-Agent, LLM and MCP proxies and the Alert Engine

What is free and what needs a Gravitee Enterprise license

Apache APISIX is a top-level Apache Software Foundation project released under the Apache License 2.0. The license lets you use the gateway and its built-in plugins without a license fee to the project. The project documents more than 100 built-in plugins covering authentication, security, traffic control, observability and AI gateway functions. Commercial products built on APISIX, such as API7 Enterprise, are separate purchases with their own terms.

Release line: APISIX 3.19.0 was released on September 28, 2026. The downloads page does not mark any release as long-term support, so set your own upgrade cadence and test window.
Ingress controller: APISIX Ingress Controller 2.2.0 was released on August 18, 2026, and the same page does not mark it as long-term support.
Plugin scope: Authentication, security, traffic control, observability and AI gateway plugins are all in the open-source distribution.
Support: The project provides documentation and community channels. Paid support from third parties must be contracted and priced separately.

Check the APISIX downloads page for current release status before you pin a version in your change process.

Event and protocol support: what each platform proxies

Proxying a protocol at the gateway and publishing or subscribing to a broker are different jobs. A gateway such as Apache APISIX forwards client requests over a protocol it understands, so it can sit in front of an MQTT, gRPC or WebSocket service and apply routing, authentication and rate limits to that traffic. Publishing to or consuming from a broker such as Kafka or RabbitMQ is a separate capability: the gateway has to speak the broker's client protocol and manage the message flow, which is a different job from forwarding a request. Before comparing the two platforms, separate these two needs in your own design.

APISIX's repository lists HTTP and HTTPS, HTTP/3 with QUIC, gRPC, WebSocket, MQTT, Dubbo and TCP/UDP proxying, so a team with MQTT or raw TCP services can keep those flows behind the same gateway. Gravitee's Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ, Solace, JMS and Azure Service Bus endpoints, along with Server-Sent Events and Webhook entrypoints, are listed as Enterprise Edition features in its documentation. Confirm with Gravitee exactly which of these you would need, and whether each is included in the license you would buy, because the Community Edition does not carry them.

Build a table of every protocol and broker your APIs and integrations touch, including internal service-to-service traffic and partner feeds. For each entry, record whether the platform supports it natively, through a plugin or policy you would need to build or maintain, or only in the Enterprise Edition. Ask the vendor to show the feature working against your broker version in a test environment, and check whether the Enterprise feature count changes your licensing and support scope before you choose.

What drives the running cost of each platform

Running costs for APISIX and Gravitee come from different places: APISIX leans on etcd, the Admin API and in-house Lua or NGINX skills, while Gravitee leans on MongoDB, gateway nodes and an Enterprise license for many features. Read each card against your own architecture and ask vendors and integrators for line items, not totals.

Configuration store and control plane hosting

In traditional and decoupled APISIX topologies, etcd holds the configuration and must run as a cluster you back up, monitor and patch. Decoupled mode shares one etcd cluster across data planes, so its size and availability become a shared dependency. Standalone mode removes etcd but moves change control to YAML or JSON files and the Admin API. For Gravitee, the equivalent recurring cost is MongoDB for the management backend. Ask each side what it runs, who patches it and what the backup and restore procedure costs in staff time.

Gateway node sizing and count

Each APISIX data plane and each Gravitee gateway node consumes compute that scales with traffic, TLS termination, plugin chains and logging. Gravitee's Docker Compose path pairs the gateway with MongoDB, while its Helm chart targets Kubernetes distributions including AKS, GKE, EKS and OpenShift. Ask both sides for a sizing basis (requests per second, payload size, policy count) and for the number of nodes they expect in production, development, and disaster recovery environments. Do not accept a sizing figure that lacks a traffic profile.

Staff skills for Lua and NGINX

APISIX runs Lua plugins inside worker processes on NGINX and ngx_lua, and custom logic in other languages goes through external plugin runners. Teams that extend APISIX deeply need engineers comfortable with Lua, NGINX tuning and LuaJIT behavior, or they pay an integrator to maintain that code. Gravitee's extension model, and its Java-based platform, draw on a different skill pool. Estimate the headcount for each stack, count who will be on call for gateway incidents, and ask whether custom plugins will be supported by the vendor or only by your team.

Enterprise license and support fees

Gravitee's documentation states that the APIM Enterprise Edition requires a license, and it lists the event protocols, data masking, GeoIP filtering, the Alert Engine, Redis caching and MCP and LLM proxies as Enterprise features. APISIX is Apache-2.0 licensed, so its gateway and plugins carry no license fee, but commercial support comes from a separate contract. This is a recurring cost on the Gravitee side and an optional cost on the APISIX side. Request the license scope, the term, the number of gateways or environments it covers, and the support tier in writing.

Upgrade and release tracking effort

APISIX 3.19.0 was released on September 28, 2026, and the downloads page does not mark any release as long-term support, so your team sets its own upgrade cadence and test cycle. Gravitee's repository was tagged core_4.13.1 on October 15, 2026, and its documentation covers API Management 4.12. Each upgrade on either side needs a staging run of your routes, plugins and policies, plus a rollback plan for the data store. Ask each vendor for its supported upgrade paths and the hours your integrator will bill per minor release.

Developer portal hosting and content

Gravitee's Portal UI is a catalog of APIs with documentation, so it adds a web tier to host, secure and keep in sync with the management API. Hosting it inside your network means the same platform and security review as the gateway. If you use Gravitee Cloud SaaS instead, the recurring cost moves to a subscription, and you must confirm where data resides. APISIX has no bundled portal in the open-source gateway, so a portal is a separate build or purchase decision. Ask which portal you need, who writes its content and who reviews the documentation for each release.

Moving an API estate from one gateway to the other

This sequence moves routes, identity and consumers from Gravitee to APISIX (or back) in controlled stages, so each API is verified on the new gateway before traffic leaves the old one. The output is a documented inventory, a policy-to-plugin map, and a per-API cutover record that both teams can audit.

Inventory APIs, policies and subscriptions
Export the full list of Gravitee APIs, their plans, policies, entrypoints and endpoints, and record which consumer applications hold subscriptions to each. On the APISIX side, list the routes, upstreams, plugins and consumers you intend to keep, and note any Gravitee Enterprise-only features in use, such as Kafka or MQTT endpoints, data masking or audit trails, since these need a documented alternative or a decision to drop them. The step is done when every API has one row covering its traffic, auth method, policies and subscribers. Owner: the API platform team with API product owners.
Map each Gravitee policy to an APISIX plugin
For every policy in the inventory, find the matching APISIX plugin from its built-in set, or record that no built-in equivalent exists and the behavior must be written as a custom plugin in Lua or through an external plugin runner. Confirm each mapping against the current plugin documentation rather than assuming parity, paying particular attention to rate limiting, transformations, and authentication flows. The output is a signed-off mapping table where every row is marked as direct, approximate or custom, with the security reviewer's initials on any approximate row.
Rebuild identity configuration and consumer access
Identify the identity provider clients that Gravitee currently calls and confirm whether they can be reused by APISIX. The openid-connect plugin supports authorization code, client credentials, token introspection and PKCE flows, so client registrations can usually transfer while redirect URIs, allowed scopes and token audiences are updated for the new gateway hostnames. Recreate consumer credentials and subscription keys on the APISIX side, and issue a migration notice to each consumer team. The step is complete when a test token issued by the provider is accepted on a staging route and rejected when its scope is removed.
Rebuild the developer portal and documentation
Gravitee's Portal UI hosts the API catalog and its documentation, and APISIX does not ship an equivalent portal in its open-source distribution, so this content must be rebuilt in whatever portal or documentation site you choose. Export the OpenAPI specifications from Gravitee, validate them, and publish them to the new catalog with onboarding guides, changelogs and sample requests. Confirm with the commercial vendor or your own team which portal option fits your governance needs before starting. Done when each published API has a working sample call against the staging gateway and an owner listed in the catalog.
Rebuild dashboards, alerts and audit logging
Analytics dashboards and alert rules built on Gravitee's console or Alert Engine do not move automatically. Recreate the required metrics, error budgets and alerts in your observability stack, reading APISIX's metrics and logs as the source, and recreate any audit trail obligations your compliance team relies on, since Gravitee lists audit trails of API consumption and activity as an Enterprise feature. The step is done when a test request produces the same log fields and alert firing that the auditors and on-call engineers expect, verified in a staging run.
Run both gateways in parallel on staging and production
Deploy the APISIX configuration beside the Gravitee gateway, using a shared upstream and a traffic split or DNS weight that you can change per API. Replay representative production traffic against APISIX in a non-production environment, compare response codes, latency and policy outcomes against Gravitee, and investigate every difference before proceeding. Keep the Gravitee gateway serving live traffic until each API has passed its comparison. The output is a parallel-run report per API that records any deviation and its resolution.
Cut over and retire Gravitee API by API
Move production traffic one API at a time, starting with the lowest-risk APIs and leaving high-value or event-driven APIs for last. For each API, shift traffic to APISIX, monitor errors and consumer tickets through a defined observation window, and keep a tested rollback path to Gravitee until the window closes. Record the cutover date, the owner who approved it and the rollback test result in a per-API record. Gravitee stays in place for APIs not yet migrated, and it is decommissioned only after the final record is signed off.

Where API gateway projects usually run long

The schedule risk in an API gateway project is rarely the gateway itself. It sits in the work around it, and the most common delay is identity integration. Whether the team connects to Keycloak, Microsoft Entra ID or Okta, someone must register clients, agree on redirect URIs, map roles and claims to routes, and test the authorization code, client credentials and token introspection flows against real tenants. APISIX's openid-connect plugin supports these flows, but the identity provider's configuration, token lifetimes and group mappings are usually owned by a different team, so the work waits on that team's change process. Confirm early who owns each identity provider and how long their change requests take.

The second group of delays comes from platform wiring. In APISIX's traditional mode the Admin API listens on port 9180 and client traffic on port 9080, and the team must decide how those ports sit behind load balancers, network policies and TLS termination in its own environment. If the deployment is decoupled, the etcd cluster shared by the data and control planes becomes an operational dependency with its own backup, upgrade and certificate rotation tasks. Gravitee's Helm chart and Docker Compose options cover different footprints, so the team should confirm which one matches its Kubernetes distribution and which components its security team must review. Portal content migration and procurement of Gravitee's Enterprise license also add weeks that technical plans often omit. Ask for a written inventory of APIs, owners and documentation before the license conversation starts.

DeployOpen plans and implements this work as fixed-scope engagements, with scope, deliverables and timelines agreed in writing before any work begins. The duration of an integration project therefore depends on that written scope: the number of identity providers, the number of APIs and portal pages to migrate, the topology chosen and the approvals each step needs. This page does not give a figure for any of these, and a quote should be requested against a defined scope rather than estimated from general experience. Teams that want a useful quote should bring their identity provider inventory, target deployment model, list of protocols such as Kafka, MQTT or gRPC, and the owners who must sign off.

Questions buyers ask before choosing an API gateway

Is Apache APISIX free to run in production?

Yes, the APISIX gateway is licensed under the Apache License 2.0, so the software itself carries no license fee to run in production. The costs that remain are infrastructure, the etcd cluster in traditional and decoupled modes, the people who operate and upgrade the gateway, and any support contract you choose to buy from a vendor or partner. Confirm with your own legal team that the Apache-2.0 terms cover how you plan to distribute or embed any custom plugins. Ask a quote to separate the one-time build work from the recurring operating work so you can compare it fairly with a licensed product.

What does Gravitee Enterprise add, and how is it licensed?

Gravitee Enterprise Edition requires a license, and its documentation lists features that the Community Edition does not include. These include Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ, Solace and JMS endpoints, Server-Sent Events and webhook entrypoints, audit trails of API consumption, data masking, GeoIP filtering, Dynamic Client Registration, the Alert Engine, Redis caching, and Agent-to-Agent, LLM and MCP proxies. Before you shortlist Gravitee, list which of these your workloads need and confirm the current license terms and deployment options (SaaS, hybrid or fully self-hosted) directly with Gravitee.

Do we need a developer portal, and does APISIX provide one?

You need a developer portal if external partners or internal teams must discover, subscribe to and test APIs without filing tickets. Gravitee bundles a Portal UI with its catalog of APIs and documentation, while APISIX is a gateway-first project and does not present the same bundled portal in the sources reviewed here. If a portal is a requirement, confirm with APISIX's maintainers and the wider ecosystem which portal or catalog tool fits, and budget for its integration and hosting as a separate component. If your consumers are mainly internal engineers, a catalog tool and documentation pipeline may be enough.

How long does a migration take, and what drives it?

Migration time depends on the number of routes and plugins in use, how much custom logic must be rewritten, the authentication model, and how many consumers must cut over without downtime. Teams usually run both gateways in parallel and move traffic in stages, so the timeline is set by the inventory and testing work rather than the gateway software alone. APISIX's file-driven standalone mode and its Admin API give different configuration paths, which affects how much of your existing setup can be scripted. Ask for a written scope that lists the inventory, the mapping of each policy, the test plan and the cutover steps before agreeing to any timeline.

What skills does the team need to run APISIX or Gravitee?

Running APISIX well requires operators who understand NGINX, the APISIX configuration model and etcd if you choose traditional or decoupled mode. Writing custom Lua plugins needs Lua skills, while external plugin runners let teams work in Java, Go or Python. Gravitee requires administrators comfortable with its management API, the Console UI and the database and Kubernetes stack chosen for the deployment, such as its Helm chart or Docker Compose with MongoDB. Identify which of these skills already exist in your platform team and which need training or outside help before you commit to a design.

Can DeployOpen implement this with our team, or do the work for us?

DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. Most engagements are fixed-scope with scope, deliverables and timelines agreed in writing before work starts, and that model suits both a team-led build with DeployOpen support and a delivery where DeployOpen carries most of the implementation. Ongoing support, upgrades and continuous testing are available as retainers. Ask us to map which parts your team keeps and which parts we deliver so ownership is clear from the start.

What does a quote depend on?

A quote follows from the written scope, so it depends on the number of APIs and routes, the plugins and authentication flows you need, the event and protocol endpoints in scope, the deployment target and the migration path from any existing gateway. It also depends on the security testing, documentation and handover you require and on any retainer for upgrades. DeployOpen does not publish a price list. Provide your inventory, target environment and compliance expectations so the quote reflects your actual conditions.

How DeployOpen helps choose and implement an API gateway

DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For an APISIX or Gravitee decision, we start by writing down which gateway features, event protocols and Enterprise Edition capabilities your APIs actually need, then build against that scope.

How we scope

We agree scope, deliverables and timelines in writing before any work starts.
Scope lists the APIs, protocols, identity provider and deployment mode your team needs.
We confirm which Gravitee Enterprise Edition features your use case requires, and which licensing terms apply.

How we build

We install and configure the chosen gateway in your environment, in the deployment mode you select.
We wire up authentication, such as OpenID Connect with your identity provider, and rate limiting policies.
We test routing, authentication and protocol behavior against the requirements written in the scope.

How we hand over

We document configuration, runbooks, backup and upgrade steps so your team can operate the gateway.
We prepare the evidence and control descriptions your compliance assessors may request, without issuing any certification.
We walk your engineers through the deployment and transfer ownership of the configuration repository.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover.
Retainers cover version upgrades, which we plan against the release and support dates your vendor publishes.
Security testing of the deployed APIs and gateway can be added to the retainer scope.

Apache APISIX vs Gravitee