Which API management platform fits your team's situation
Choose Tyk if your team already runs or plans to run a Go-based gateway on Redis and wants the open-source gateway in production first, accepting that the Dashboard and Developer Portal need a commercial license. Choose Gravitee if you want an Apache-2.0 management platform with a console and portal in the open-source distribution, and you expect to buy the Enterprise Edition later for event protocols, data masking or AI proxies. Choose WSO2 API Manager if you want the full platform under Apache-2.0 and plan to buy commercial support subscriptions rather than a feature license. The decision turns on which management components you must have on day one and whether you can accept a licensed layer in production.
For Tyk, the gateway itself is licensed under MPL-2.0 and ships with JWT, rate limiting, versioning and plugins in Python, JavaScript, Go or any gRPC-capable language. The Dashboard, Developer Portal and Operator are not part of the open-source path, so a team that needs a portal for consumers must budget for the Self-Managed license from day one. For Gravitee, the Community Edition is self-hosted and includes the gateway, Console and Portal UI, which suits teams that want a catalog without a license. Event entrypoints such as Kafka over WebSocket, MQTT5 and webhooks sit in the Enterprise Edition, so confirm early which of those protocols your integrations require. For WSO2, the Publisher and Developer Portal are part of the Apache-2.0 platform, and the commercial subscription adds expert support, product updates and vulnerability monitoring. Ask WSO2 whether that subscription is required for your production use.
Which platform to shortlist for each scenario
This table maps common team situations to the platform most likely to fit, with the condition under which another option would be the better choice. Read each row against your own licensing budget, event protocols and deployment model before shortlisting.
| Scenario | Best fit and why | When another option is the better choice |
|---|---|---|
| Open-source gateway, and you will pay for the management layer | Tyk. The Tyk Gateway is MPL-2.0 and ships with no feature lockout in the gateway itself, so you can start with the open gateway on Redis and license the Dashboard and Developer Portal only when you need a console and portal. | Gravitee if you want a Community Edition console and portal for self-hosting from the start, since its Community Edition is self-hosted and Apache-2.0. Confirm which management features each edition includes before you commit. |
| Kafka or MQTT event APIs in production | Gravitee. Its Enterprise Edition lists Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ and Server-Sent Events entrypoints, which the facts supplied for this page do not show in Tyk or WSO2 API Manager. | Confirm event API support in Tyk and WSO2 API Manager directly with each vendor if they are your only candidates. Gravitee event features require the Enterprise license, so budget for it as a production requirement. |
| Standardizing on Kubernetes with a declarative operator | Tyk, if you want a Kubernetes-native operator. The Tyk Operator for declarative API management requires a license, and the open gateway ships a tyk-oss Helm chart for installation. | WSO2 API Manager if you want Kubernetes through the separate WSO2 API Platform for Kubernetes. Gravitee if a Helm chart covering AKS, GKE, EKS and OpenShift matches your target clusters. Confirm operator features and licensing for each. |
| Apache-2.0 full platform, with support bought separately | WSO2 API Manager. Its repository lists Apache-2.0 licensing for the platform, Developer Portal and Publisher web interfaces, and commercial subscriptions cover expert support, updates and vulnerability monitoring. | Gravitee if the Community Edition covers your console and portal needs, or Tyk if an open gateway with a licensed management layer fits your budget better. Ask WSO2 which parts of the distribution need a subscription for commercial use. |
| Air-gapped or on-premises estate | Tyk or WSO2 API Manager, both of which support self-hosting. Tyk's open gateway runs with Redis and installs from packages or source, and WSO2 supports on-premises installation from extracted packages. | Gravitee if you use Docker Compose with MongoDB or the Helm chart in a private cluster. Confirm with each vendor which components need outbound connectivity for licensing, updates or vulnerability feeds in your network. |
| Managed hosting with a contractual uptime target | Tyk Cloud or WSO2 API Manager SaaS, if a hosted option fits your data residency rules. WSO2 documents a fully managed SaaS deployment with a 99.95% SLA, and Tyk Cloud is available with a free trial. | Self-hosted options if data must stay inside your own infrastructure. Ask each vendor for the SLA terms in writing, since the supplied facts only cover WSO2's stated figure. |
What is open source in Tyk, Gravitee and WSO2 API Manager
Tyk's gateway is open source, but the management layer is not. The Tyk Gateway code is licensed under the Mozilla Public License 2.0, with the exception of the ee folder, which falls under a separate commercial Enterprise Edition license. The gateway itself ships without feature lockout and runs on Redis, so a team can self-host it without a Tyk contract. The Dashboard, the Developer Portal and the Tyk Operator for Kubernetes are not part of that free path: the full Self-Managed platform, which includes Dashboard, Developer Portal, Tyk Pump, Redis and PostgreSQL, needs a license. Before you scope a build, confirm with Tyk exactly which files and features fall under the ee folder, and ask whether your portal and console requirements depend on licensed components.
Gravitee splits its open-source and paid scope by edition, not by repository. The Gravitee API Management repository is Apache-2.0 and includes the gateway, the management API, the Console UI for administrators and the Portal UI for consumers. You can self-host the Community Edition, but the documentation states that the Enterprise Edition requires a license. Several capabilities a team may assume are part of the core, including Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ, Server-Sent Events, webhook entrypoints, audit trails, data masking, GeoIP filtering and Redis caching, appear on the Enterprise list. Map each requirement against the edition table in the Gravitee Enterprise Edition documentation before you assume a feature is free.
WSO2 API Manager is Apache-2.0, but the commercial model is support and distribution. The API Manager repository is licensed under Apache-2.0, and WSO2 sells commercial subscriptions that bring expert support, continuous product updates, vulnerability monitoring and access to the licensed distribution for commercial use. The API Platform components are also Apache-2.0, with one exception: the Monetization module is not open source under that license, so any monetization requirement needs its own licensing review. Confirm with WSO2 whether your production deployment needs a subscription for the distribution you intend to run, and what support and patch commitments the subscription covers in writing.
How the three platforms compare on architecture, datastores and protocols
This table sets the three platforms side by side on license boundaries, datastores, Kubernetes paths, protocols, event APIs, plugin languages and deployment models. Read each row against the scope you need to run in production, because the open-source boundary differs for each product.
| Capability | Tyk | Gravitee APIM | WSO2 API Manager |
|---|---|---|---|
| License of the core | Gateway under MPL-2.0; the ee folder and the Dashboard, Developer Portal and Operator need a commercial license | Apache-2.0 for the Community Edition; Enterprise Edition requires a license | Apache-2.0 platform; commercial subscriptions add support, updates and licensed distribution for commercial use |
| Management console and portal | Dashboard and Developer Portal are part of the licensed Self-Managed stack | Console UI for administrators and Portal UI for consumers are part of the open-source repository | Publisher and Developer Portal web interfaces ship in the open-source repository |
| Datastores | Redis for the open-source gateway; PostgreSQL and Redis in the full Self-Managed stack with Pump | MongoDB in the Docker Compose path; confirm the datastore for your chosen Helm or Enterprise layout | Confirm the database requirements for your release and deployment pattern in the product documentation |
| Kubernetes options | tyk-oss Helm chart for the open-source gateway; Tyk Operator for declarative management requires a license | Helm chart covering AKS, GKE, EKS and OpenShift | WSO2 API Platform for Kubernetes, a separate offering from the on-premises package |
| Protocols | REST with OpenAPI, SOAP, GraphQL, gRPC, TCP and MCP | Gateway protocols per its documentation; confirm the exact set in your edition | REST, GraphQL and AsyncAPI APIs; confirm SOAP and gRPC support before you rely on them |
| Event API support | Confirm event and streaming endpoint support against your requirements in Tyk's documentation | Enterprise Edition adds Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ, Solace, JMS and Azure Service Bus | AsyncAPI support is documented; confirm broker-level event connectors with WSO2 |
| Plugin and extension languages | Python, JavaScript, Go or any language supporting gRPC | Confirm the supported policy and extension model for your edition | Custom authenticators, policies and workflows; confirm the implementation language for each |
| Deployment models | Self-hosted from Docker, packages, Ansible, source or Helm; Tyk Cloud as the hosted option | Gravitee Cloud SaaS, Helm, Docker Compose; Enterprise adds SaaS, hybrid and fully self-hosted | On premises from extracted packages, managed cloud, hybrid with on-premises gateways, and Kubernetes |
What each platform needs a license for in production
Tyk Gateway code is licensed under the Mozilla Public License 2.0, with the exception of the ee folder, which sits under a separate commercial Enterprise Edition license. The open-source gateway runs with Redis and covers JWT, bearer tokens, Basic Auth, client certificates, rate limiting, quotas, versioning and IP allowlisting. The management layer is different. The full Tyk Self-Managed platform, which adds the Dashboard, Developer Portal, Tyk Pump, Redis and PostgreSQL, needs a license, and so does the Tyk Operator for Kubernetes-native declarative management. Tyk Cloud is the hosted alternative that manages the full stack.
- Gateway: MPL-2.0 for the core code, so the runtime you test can be self-hosted without a license.
- Dashboard and Developer Portal: part of the licensed Self-Managed platform, not the open-source gateway.
- Tyk Pump: listed with the Self-Managed components that need a license.
- Tyk Operator: requires a license, which matters if your Kubernetes workflow depends on declarative management.
- Tyk Cloud: hosted and managed, with a free trial, so it changes who operates the stack rather than the license of the software.
Confirm with Tyk which Self-Managed components your production architecture requires, and whether any Dashboard-dependent workflow must be replaced before you rely on the open-source gateway alone.
Gravitee API Management is licensed under Apache-2.0, and its repository describes the gateway, management API, Console UI and Portal UI as the core components. The Community Edition is self-hosted. Gravitee's documentation states that the APIM Enterprise Edition requires a license, and it lists a set of features that sit only in that edition. Teams whose requirements fall into those features need to plan for a commercial agreement before production, not after.
- Event endpoints: Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ, Solace, JMS, Azure Service Bus, Server-Sent Events and Webhook entrypoints are Enterprise Edition features.
- Security and compliance: data masking, GeoIP filtering and audit trails of API consumption and activity are Enterprise Edition features.
- Operations: the Alert Engine, Redis caching and Cloud Reporter are listed as Enterprise Edition features.
- AI and agent proxies: Agent-to-Agent, LLM and MCP proxies are listed as Enterprise Edition features.
- Deployment modes: SaaS, hybrid and fully self-hosted deployment are documented for Enterprise customers, while the Community Edition is self-hosted.
Before you build on Gravitee, map each requirement against the Community Edition list and the Enterprise Edition list, and ask Gravitee to confirm in writing which features your chosen deployment mode includes.
WSO2 API Manager is licensed under Apache-2.0, so the platform source and the on-premises packages can be used without a license fee. What you pay for is support and assurance. WSO2 sells commercial subscriptions that provide expert support, continuous product updates, vulnerability monitoring and access to the licensed distribution for commercial use. Those subscriptions are the part to scope against your change control and vulnerability management obligations, since the open-source build does not come with them.
- Expert support: provided through the commercial subscription, not the Apache-2.0 code.
- Continuous product updates: delivered through the subscription, which affects how you plan patch cycles.
- Vulnerability monitoring: included in the subscription, which matters if your policy requires a named source of security advisories.
- Licensed distribution for commercial use: the subscription grants access to the distribution you use in production.
- Managed and hybrid options: WSO2 also describes a managed SaaS deployment with a 99.95% SLA and a hybrid model with a SaaS control plane, both of which are contractual terms to read directly.
Ask WSO2 for the exact subscription tier, what it covers for your deployment model, and whether the licensed distribution terms match your intended commercial use.
Across the three platforms, the recurring cost sits in different places. For Tyk, it is the license for the management layer and any Operator use. For Gravitee, it is the Enterprise Edition license tied to the event, security and AI features you need. For WSO2, it is a commercial subscription that buys support, updates and vulnerability monitoring around an Apache-2.0 product. None of the vendors' license prices are supplied here, so the figures must come from each vendor's quote.
- Who is paid: Tyk and Gravitee are paid for licensed components, while WSO2 is paid for support and assurance.
- Recurring versus one-time: subscriptions and licenses are typically recurring, so model them as annual running costs.
- Cost drivers: the number of components you license, the deployment mode and the support level change the price.
- Quote scope: ask for a line-item quote listing each component, feature, deployment mode and support term.
- Exit cost: check how each license ends and what you keep, since features locked to a commercial edition can force a re-platform.
Before you compare totals, confirm each license term and quote with the vendor, not from this page.
Procurement and security teams should test each commercial boundary against the requirements written in their own architecture and policy documents, not against a summary. The aim is to find any gap between what the open-source build gives you and what your audit, identity, logging and event-handling needs will require, before a contract is signed. This check is also where you record who owns the licensed components after go-live.
- Feature inventory: list every API, event, security and portal requirement and mark which edition covers it.
- Deployment mode: confirm the license that applies to self-hosted, hybrid and managed options.
- Support boundary: write down who responds to vulnerabilities and what the subscription commits to.
- Written terms: ask for the license file or agreement text that governs each component you plan to run.
- Renewal and exit: confirm renewal terms and what happens to production features if the subscription lapses.
Confirm license terms and quotes with Tyk, Gravitee and WSO2 directly before you rely on any boundary described here.
What drives the running cost of each platform
Open-source status does not settle running cost for any of the three platforms. The cost sits in which components need a commercial agreement, which datastores your team operates, and how much upgrade and patch work lands on your own staff. Read each card as a question to put to the vendor before you sign.
Licence scope for the management layer
Tyk Gateway is MPL-2.0, but the Dashboard, Developer Portal and Operator require a commercial licence in the Self-Managed platform. Gravitee's Enterprise Edition requires a licence for the features your team needs, while the Community Edition is self-hosted. WSO2 sells commercial subscriptions for API Manager that cover support, updates and vulnerability monitoring. Ask each vendor which components the quote covers, whether fees are per node, per API or per user, and whether the licence renews annually.
WSO2 subscription scope
WSO2's Apache-2.0 platform can be run without a subscription, but a commercial subscription adds expert support, continuous product updates, vulnerability monitoring and rights to the licensed distribution for commercial use. Those four items are separate costs to weigh. Ask whether the subscription covers the gateway, the traffic manager and the Developer Portal in one agreement, and which WSO2 components sit outside it.
Datastore operation
Each platform brings its own stateful services. Tyk's open-source gateway runs on Redis, the full Self-Managed stack adds PostgreSQL and Pump, Gravitee uses MongoDB in its Docker Compose setup, and WSO2 relies on its own database layer. Every datastore needs backups, patching, failover testing and capacity planning, and that work recurs for the life of the platform. Ask who supports each datastore under the quote and whether the vendor's support covers the database versions you run.
Kubernetes and VM footprint
Gravitee publishes a Helm chart for AKS, GKE, EKS and OpenShift, Tyk ships the tyk-oss Helm chart, and WSO2 offers Kubernetes through a separate API Platform. Hybrid deployments add gateways in each network zone, and each gateway adds compute, certificates and monitoring. Estimate the node count for your traffic and each control-plane component, then compare that against the vendor's supported platforms. Ask for the reference architecture the quote assumes.
Upgrade and patch effort
Upgrades are the recurring labour most teams underestimate. Each platform ships on its own release cadence, and each upgrade touches the gateway, the management layer, the datastores and any custom plugins. Tyk Gateway is currently on the v5.15.1 line, WSO2 API Manager 4.7.0 requires JDK 21, and Gravitee documents API Management 4.12. Ask who runs upgrades, how long the vendor keeps prior versions supported, and whether the quote includes staging validation.
Cost of switching later
Switching costs rise with custom plugins, policies and portal content built on one platform. Tyk plugins can be written in Python, JavaScript, Go or any gRPC language, WSO2 supports custom authenticators and workflows, and Gravitee policies and API definitions are specific to its gateway. Migrating API definitions, subscriptions, developer accounts and analytics history is a one-time project. Keep plugin logic in portable code where you can, and ask each vendor for its export and migration options before you commit.
How implementing each platform typically proceeds
The sequence below moves from license and feature checks to a tested, hardened gateway and portal in your own infrastructure. Each step names where Tyk, Gravitee and WSO2 API Manager diverge, so the plan reflects the platform you choose rather than a generic rollout.
Confirm required features against license tiers
Start by listing the capabilities your APIs need: developer portal, management console, event entrypoints, data masking, audit trails and any AI or MCP proxying. Then map each item to the edition that provides it. Tyk's gateway is MPL-2.0 with no feature lockout, but the Dashboard, Developer Portal and Operator require a commercial license. Gravitee's Community Edition is Apache-2.0, while Kafka, MQTT, RabbitMQ, audit trails and the Alert Engine sit in the Enterprise Edition. WSO2 API Manager is Apache-2.0, and its commercial subscriptions add support, updates and vulnerability monitoring. Done means a written feature-to-license matrix that your procurement and security teams have reviewed.
Choose the deployment model
Decide between fully self-hosted, hybrid and managed options, and whether Kubernetes is the target. Tyk offers a tyk-oss Helm chart for the open source gateway and a licensed Self-Managed stack. Gravitee offers a Helm chart covering AKS, GKE, EKS and OpenShift, Docker Compose with MongoDB, and, for Enterprise customers, SaaS, hybrid and fully self-hosted modes. WSO2 supports on-premises extracted packages, a managed cloud service, and Kubernetes through a separate WSO2 API Platform for Kubernetes. Confirm whether your control plane must stay inside your network, since that often decides which model is viable. Done means a documented topology diagram signed off by your architecture review.
Stand up datastores and the gateway
Provision the stateful components before the gateway starts. Tyk's full Self-Managed platform uses Redis and PostgreSQL alongside Tyk Pump, while the open source gateway runs with Redis. Gravitee's documented Docker Compose path uses MongoDB, so your database team needs MongoDB operational support in addition to the gateway. WSO2 API Manager is distributed as Java packages and requires JDK 21 to build from source, so confirm the JDK standard in your environment. In all three cases, your platform team owns backups, high availability and patching for these stores. Done means the gateway passes a health check and routes a test API from a clean install.
Configure the developer portal and management console
Set up the publisher or admin console and the developer portal that consumers will use. In Tyk, this means licensed Dashboard and Developer Portal components. In Gravitee, it means the Console UI for administrators and the Portal UI, which is where the API catalog and documentation live. In WSO2, the Publisher and Developer Portal are the equivalent web interfaces, and the lifecycle workflows can be extended with custom workflows. Define who publishes, who approves, and how API documentation is versioned before anyone imports APIs. Done means a sample API moves from draft to published with documentation visible to a test consumer.
Integrate identity and event sources
Connect the gateway to your identity provider and to any event systems in scope. All three support JWT and bearer token validation, and Tyk also covers Basic Auth and client certificates. For event APIs, Gravitee's Kafka, MQTT, RabbitMQ and webhook entrypoints are Enterprise Edition features, so confirm them before design. WSO2 supports AsyncAPI definitions and custom authenticators, which can cover identity patterns the defaults do not. Tyk plugins can be written in Python, JavaScript, Go or any language that supports gRPC. Ask each vendor to confirm the exact identity and broker versions they certify against. Done means a token issued by your identity provider authorizes a request through the gateway and an event flow completes end to end.
Test, harden and document the deployment
Test authentication, rate limits, quotas, access control per version and operation, IP allowlisting and failover before go-live. Tyk documents hitless configuration reloads, which should be verified under load. Run hardening against your own baseline, covering admin interface exposure, secrets handling, TLS and log retention. Keep the upgrade path in mind: Tyk, Gravitee and WSO2 publish separate release tracks, so record which versions you run and how you will apply vendor updates. Where you need evidence for an assessment, capture configuration, access logs and change records as you go. DeployOpen can plan, implement and test this work under a written scope, while independent auditors issue any assessment outcome. Done means a signed test report, a runbook and a tested rollback.
Where implementation effort differs between the three
The effort gap between these three platforms comes from what each one needs before the first API is published. Tyk's open-source Gateway runs with Redis, and the Gateway alone can be installed with Docker, the tyk-oss Helm chart, Ansible or system packages. The full Self-Managed stack adds the Dashboard, Developer Portal, Tyk Pump and PostgreSQL, and the Dashboard, portal and Tyk Operator all require a license. Before you scope the work, confirm which of those components your management console and portal requirements depend on, and get the license terms for each in writing so the Redis and PostgreSQL operations work is not sized against a gateway-only deployment.
Gravitee's Community Edition is self-hosted on Docker Compose with MongoDB, and its Helm chart covers AKS, GKE, EKS and OpenShift. The effort risk is in the features. Kafka publish and subscribe, MQTT5, RabbitMQ, Solace, JMS, data masking, Redis caching and the Alert Engine are Enterprise Edition features, so a team that builds its event or security design on the Community Edition may need to re-plan once the license is in place. WSO2 API Manager 4.7.0 requires JDK 21 to build from source, and its Kubernetes deployment comes through a separate WSO2 API Platform for Kubernetes, which adds a second product to install, patch and operate.
Switching later is the cost most often underestimated. Each platform stores APIs, policies, subscriptions and portal content in its own model, so a move between them is a re-modeling exercise unless the vendor provides a supported export. Ask Tyk, Gravitee and WSO2 in writing whether their current versions export APIs, policies, plans and developer accounts in a documented format, whether that export includes Enterprise or licensed components, and what a re-import into another product requires. Include the answers in your exit plan and in the written scope of any implementation partner engagement, because the export path decides how much of the first build you can carry forward.
Questions buyers ask before choosing an API management platform
What does a self-hosted API management platform cost to run?
Most of the cost sits in people and infrastructure, not the software license, and the license line depends on which components you need. The open-source Tyk Gateway runs with Redis, while the full Tyk Self-Managed stack with Dashboard, Developer Portal, Pump and PostgreSQL needs a license. Gravitee's Community Edition is self-hosted, but its Enterprise Edition requires a license for features such as Kafka publish and subscribe over HTTP and WebSocket. WSO2 API Manager is Apache-2.0, and its commercial subscriptions cover expert support, continuous product updates and vulnerability monitoring. Recurring costs include licenses or subscriptions, the hosting footprint for gateways and datastores, and staff time for upgrades. Ask each vendor for a written list of which components the production architecture requires, which edition each needs, and whether pricing is per gateway, per node, per API or per user.
Can our team implement an API management platform ourselves?
A team with experience running Kubernetes or Java services and a clear owner for API standards can usually handle a single-environment proof of concept without outside help. The harder part is production: identity integration, gateway clustering, datastore backup, certificate handling, and a developer portal that the business trusts. WSO2 API Manager is distributed as extracted packages and as a Kubernetes platform, and its repository notes that building it requires JDK 21, so the build and patch process needs an owner. Gravitee offers a Helm chart for Kubernetes and Docker Compose with MongoDB, which lowers the first step. Confirm with each vendor which installation path it supports for your environment and what its documentation expects your team to maintain after go-live.
How long does an API management rollout take, and what drives that?
The timeline depends mainly on the number of APIs to onboard, the number of environments, how many identity and policy requirements must be met, and how much of the developer portal is customized. Each of these multiplies the work. Teams that migrate from an existing gateway also need to plan for route translation, consumer key reissue and parallel running. Because no rollout duration is supplied for these products, ask each vendor or implementation partner for a written timeline that lists the environments, the API inventory size, the identity integration and the cutover method. A fixed-scope engagement, which DeployOpen typically uses, agrees scope, deliverables and timelines in writing before work starts, so the same inputs should appear in any proposal you compare.
What does the work need from our own staff?
Plan for three roles: a platform owner who runs the gateway and management console, an identity engineer who connects JWT, OAuth or client certificate flows to your provider, and an API owner for each product who maintains documentation and access policies. Tyk supports JWT, bearer tokens, Basic Auth and client certificates, rate limiting and quotas, and per-version and per-operation access control, so the policy design needs decisions up front. WSO2 API Manager supports REST, GraphQL and AsyncAPI definitions and custom authenticators, policies and workflows, which adds development skills to the list. Ask each vendor which skills their upgrade guide expects and how often security fixes are released for the components you run.
Does the open-source gateway cover our production needs?
It depends on which features production needs. The Tyk Gateway is open source with no feature lockout in the gateway itself, and it supports REST, SOAP, GraphQL, gRPC, TCP and MCP, but the Dashboard, Developer Portal and Operator require a commercial license. Gravitee's Community Edition covers the gateway, Console and Portal, while Enterprise features include data masking, GeoIP filtering, audit trails, the Alert Engine and event entrypoints such as MQTT5 and RabbitMQ. WSO2's platform is Apache-2.0 apart from the Monetization module, but its commercial subscriptions add support and vulnerability monitoring. List your required features, then check each one against the vendor's edition table before assuming the open-source tier is sufficient.
What security and compliance evidence will we need from the platform?
Start with the controls your assessment will test: access control on the management console, audit logging of administrative and API activity, secret handling for keys and certificates, and patch cadence. Gravitee lists audit trails of API consumption and activity as an Enterprise feature, so confirm whether your audit requirement depends on that edition. WSO2 states that its commercial subscriptions include vulnerability monitoring, and Tyk ships the gateway with its own release history on GitHub. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors issue any report or certification, so confirm with your assessor which evidence they will accept before the design is fixed.
When should we bring in an implementation partner?
Bring in a partner when the production design includes several environments, licensed components, identity integration and a regulated evidence requirement that your team has not delivered before. A partner is also useful when the internal team cannot staff the platform owner and identity roles for the length of the project. DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades and documents self-hosted open-source platforms inside your own infrastructure, and most engagements are fixed-scope with written deliverables. Ask any partner for a written scope that names the components, the environments, the acceptance tests and who maintains the platform after handover, and compare that scope against the vendor's own professional services offer.
How to decide between the three before you request quotes
Start by writing down the features your team must have on day one, then check which of them sit behind a license in each platform. Decide on licensed components first, not on the price of the gateway. Tyk's MPL-2.0 Gateway is free to self-host with Redis and offers REST, SOAP, GraphQL, gRPC, TCP and MCP support, but the Dashboard, Developer Portal and Operator need a commercial license. Gravitee's Community Edition is Apache-2.0, yet its Enterprise Edition license covers Kafka publish and subscribe over HTTP and WebSocket, MQTT5, RabbitMQ, Solace, JMS, Server-Sent Events, webhook entrypoints, audit trails, data masking, and the LLM and MCP proxies. WSO2 API Manager is Apache-2.0 with its Developer Portal and Publisher included, so its commercial subscription buys support, updates and vulnerability monitoring rather than unlocked components. Confirm each of these points against the current license files and vendor pricing before you rely on them.
Next, match the list to the platform whose licensed parts cover it. If you need event APIs such as Kafka or MQTT, Gravitee's Enterprise license is the main path. If your priority is a self-hosted gateway that your own engineers extend in Python, JavaScript or Go, and a portal can wait or be built on the open source side, Tyk's free gateway may cover the first phase. If you want one control plane for WSO2 gateways and third-party gateways such as Kong, Envoy or cloud gateways, and you can run a JDK 21 stack, WSO2 fits best. Ask each vendor in writing which features a Kubernetes deployment needs, since Tyk offers a licensed Operator, Gravitee documents Helm charts for AKS, GKE, EKS and OpenShift, and WSO2 uses a separate API Platform for Kubernetes.
Before requesting quotes, shortlist no more than two platforms and ask for a line-item quote covering each licensed component, support tier, number of gateways and environments, and the datastores you must run (Redis and PostgreSQL for Tyk, MongoDB for Gravitee's Compose setup, and the database WSO2 requires). Ask how upgrades and vulnerability fixes reach a self-hosted install, and which parts are one-time (installation, integration, portal design) and which recur (licenses, support, retainers). A quote built from your written scope will show which platform's licensed parts actually match your requirements.
How DeployOpen helps choose and implement an API management platform
DeployOpen plans, implements, customizes, integrates and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Tyk, Gravitee and WSO2 API Manager, we start by mapping which components your team needs in production, then set the licensing and deployment path before any build work begins.
How we scope
- We confirm which components you need: gateway only, or gateway plus management console and developer portal.
- We record the license each required component needs, such as Tyk's licensed Dashboard and portal or Gravitee's Enterprise features.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
How we build
- We deploy the chosen platform in your environment, including Docker, Helm or package-based installs where the vendor supports them.
- We configure the datastores each platform uses, such as Redis for Tyk and MongoDB for Gravitee, and test failover behavior.
- We integrate authentication, plugins and policies, then test the gateway, portal and management interfaces against your own API traffic.
How we hand over
- We document the deployed architecture, configuration, upgrade steps and the license terms that apply to each component.
- We run security testing of the APIs and management interfaces and provide the findings and remediation notes in writing.
- We prepare the controls and evidence your compliance assessors need, while independent auditors perform any formal assessment.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- We confirm vendor release lines and support windows with you before each upgrade, so your platform stays on a supported version.
- Backup, restore and upgrade procedures are documented so your own operations team can run the platform after handover.
