Enterprise Features Overview
API7 Gateway is built on Apache APISIX and runs the same proxy engine, so routes, upstreams, consumers, and plugins behave the same way. What it adds is the layer around the gateway: a control plane that governs many gateway instances at once, an identity and permission model for the people and systems that operate it, an audit trail of every configuration change, and a developer portal for publishing APIs to their consumers.
This page lists the features in that layer, then compares the two side by side so you can judge which one fits your requirements.
Gateway Groups
Gateway groups combine one or more gateway instances into a logical unit that shares configuration, so a single control plane governs many environments and regions.
Organization and RBAC
Organizations manage users, roles, and licenses, and RBAC enforces who can act on which gateway groups and resources.
Permission Policies and Boundaries
Permission policies define allowed actions and resources, while boundaries cap the permissions a user can ever hold, regardless of role.
Dashboard SSO Options
Sign in to the Dashboard through your corporate identity provider over OIDC, SAML, LDAP, or CAS, with roles mapped from the provider.
Audit Logging
Every Dashboard, Admin API, and ADC action is recorded with operator, time, resource, and source IP, and the records cannot be altered.
High Availability
Gateway instances keep serving traffic when the control plane is unreachable, and configuration can fall back to object storage.
Custom Plugins
Upload and manage your own Lua plugins from the Dashboard, then assign them to specific gateway groups and services.
Credentials
Credentials decouple authentication from consumers, so one consumer can hold several credentials and rotate them without downtime.
Anonymous Consumers
Let unauthenticated callers reach protected routes under a named consumer, typically with a lower rate limit than authenticated tiers.
Secret Providers
Reference secrets from HashiCorp Vault or AWS Secrets Manager in any plugin field, or store them encrypted inside API7 Gateway.
Alerts and Contact Points
Over 20 built-in events, such as unhealthy instances or expiring certificates, notify your team through email or webhooks.
Security Hardening
Sensitive fields are encrypted at rest with per-gateway-group keyrings, audit logs are masked, and CP to DP traffic uses mTLS.
Compliance
FIPS 140-2 Level 1 through validated OpenSSL 3.0, data masking, and WAF integration support regulatory requirements.
API Portal
Publish APIs as products and let developers register applications, subscribe, and manage their own credentials.
Apache APISIX and API7 Gateway Compared
Apache APISIX gains capabilities with every release, so check the Apache APISIX documentation for the version you run.
Traffic Handling
Both products run the same data plane engine and the same plugin set, so proxying, load balancing, authentication, transformation, and observability behave identically.
| Capability | Apache APISIX | API7 Gateway |
|---|---|---|
| Protocols | HTTP, HTTPS, gRPC, TCP/UDP | Same |
| Bundled plugins | The full plugin set, browsable in the Plugin Hub | Same |
| Custom plugin development | Lua, external plugin runners for Java, Go, and Python, and Wasm | Lua, uploaded and assigned to gateway groups from the Dashboard. Custom plugins run with full gateway runtime access and are not sandboxed |
| Traffic authentication | key-auth, jwt-auth, basic-auth, hmac-auth, ldap-auth, openid-connect, forward-auth, and more | Same |
| Credentials | credential resource, letting one consumer hold several credentials | Same, managed from the Dashboard |
| Canary releases | traffic-split plugin, weighted or condition-based | Same plugin, configured from the Dashboard |
Managing Gateways at Scale
| Capability | Apache APISIX | API7 Gateway |
|---|---|---|
| Admin API | Yes | Yes, APISIX-compatible, scoped to a gateway group |
| Web UI | Built-in Dashboard, served at :9180/ui/ and enabled by default. It authenticates with the Admin API key, so anyone who can call the Admin API can use it | Dashboard with user accounts, roles, and SSO, where every action is attributed and audited |
| Declarative CLI | ADC, an Apache-2.0 tool maintained by API7, targets Apache APISIX as a backend, and the Dashboard roadmap points to it for GitOps flows. The bundled apisix CLI controls the process rather than configuration. Standalone mode also loads declarative YAML from disk | The same ADC against an API7 Gateway backend, adding server-side validation, a diff preview before apply, and configuration export for promotion between gateway groups |
| Configuration store | etcd cluster, which you deploy and operate | PostgreSQL, MySQL, or SQL Server. The DP Manager exposes an etcd v3-compatible API through embedded kine, so there is no etcd cluster to operate |
| Deployment roles | traditional, decoupled control plane and data plane, or standalone without etcd | Decoupled control plane and data plane, with Helm charts, OpenShift, Docker on AMD64 and ARM64, and air-gapped installation |
| Multiple clusters and environments | Designed for a single cluster. The Dashboard roadmap states there are no plans to manage multiple gateway environments | Gateway groups, where one control plane manages many groups and each instance belongs to exactly one group |
Governing Who Changes What
This is where the two differ most. Apache APISIX secures the traffic it proxies; it does not model the operators who configure it. The Apache APISIX Dashboard roadmap states there are no plans to add Dashboard login, user management, or per-user permissions.
| Capability | Apache APISIX | API7 Gateway |
|---|---|---|
| Administrator identity | A static X-API-KEY, with two built-in roles: admin and viewer, where viewer is limited to read methods | User accounts, with custom roles you define |
| Single sign-on for administrators | Not provided | OIDC, SAML, LDAP, and CAS, with role mapping from the provider. Documented for Keycloak, Microsoft Entra ID, Google, and Okta |
| User provisioning | Not provided | SCIM, documented for Okta and Microsoft Entra ID |
| Fine-grained authorization | The two static roles above | Permission policies scoped to actions and resources, plus permission boundaries that cap effective permissions regardless of role. Deny overrides allow |
| Audit of configuration changes | Not provided. The bundled logger plugins record proxied requests, not Admin API calls | Every Dashboard, Admin API, and ADC action, recorded with operator, time, event type, resource, and source IP. Records are immutable and masked, kept 180 days, and exportable as JSON or CSV |
Secrets
| Capability | Apache APISIX | API7 Gateway |
|---|---|---|
| Secret backends | Environment variables, HashiCorp Vault, AWS Secrets Manager, and GCP Secret Manager | Environment variables, HashiCorp Vault, and AWS Secrets Manager. GCP Secret Manager is planned |
| Built-in secret storage | Not applicable, secrets live in the backends above | Secrets can instead be stored in API7 Gateway, encrypted to FIPS 140-2 standards |
| Operational safeguards | Not provided | The Dashboard lists where each secret provider is referenced and blocks edits or deletions that would leave dangling references. Changes to providers are audited |
Resilience and Operations
| Capability | Apache APISIX | API7 Gateway |
|---|---|---|
| High availability | Stateless gateway instances behind a load balancer, with an etcd cluster you make highly available yourself | The same stateless instances, with control plane HA through your database's replication, multiple Dashboard instances, and documented multi-AZ and multi-region deployments |
| Surviving a control plane outage | Not applicable | Instances serve from last-known configuration, and a fallback control plane can export configuration to AWS S3, S3-compatible storage, or Azure Blob Storage for instances to load |
| Alerting | Metrics via prometheus, traces via opentelemetry, and logger plugins for Kafka, Elasticsearch, Splunk, and others. Alerting rules are yours to build | The same telemetry, plus built-in events such as unhealthy instance counts, 5xx ratios, and certificates expiring within 30 days, delivered to email or webhook contact points |
Publishing APIs to Developers
| Capability | Apache APISIX | API7 Gateway |
|---|---|---|
| Developer portal | Not provided. The Dashboard roadmap states there are no plans to act as a developer portal | Provider Portal for publishing API products and reviewing subscriptions, and Developer Portal where developers register applications, subscribe, manage credentials, and try APIs. Supports SSO, SCIM, and Dynamic Client Registration, and can run as internal, partner, or public portals |
Security and Support
| Capability | Apache APISIX | API7 Gateway |
|---|---|---|
| Encryption at rest | data_encryption encrypts plugin fields marked encrypt_fields with AES, enabled by default with a built-in keyring, and applies when configuration is stored in etcd | Fields marked encrypted_fields are encrypted with AES256 and enabled by default, with keyrings per gateway group, and user credentials salted and hashed with PBKDF2 |
| FIPS | Not provided | FIPS 140-2 Level 1, through FIPS-validated OpenSSL 3.0 |
| Certifications | Not applicable to an open-source project | API7.ai holds SOC 2 Type II, ISO/IEC 27001:2022, HIPAA, and GDPR. See Compliance |
| Security response | The Apache Security Team process, with CVEs and a published threat model | The above, plus a dedicated security team and security patches backported to supported releases |
| Support | Community mailing list, Slack, and GitHub issues | Dedicated support team with defined SLAs, version upgrade assistance, and architecture review |
Choosing Between Them
Apache APISIX is sufficient when one team runs one cluster and everyone who can reach the Admin API is trusted to change any configuration.
API7 Gateway addresses what appears past that point: many teams sharing a gateway estate, separate environments that need separate permissions, auditors asking who changed a route and when, identity that lives in your corporate directory, and APIs that outside developers subscribe to. Those needs are about governance rather than proxying, which is why the two share a data plane and diverge above it.
Next Steps
- Install API7 Gateway: Get started with deploying API7 Gateway in your environment.
- Security and Compliance: Learn about authentication, authorization, and compliance features.
- Key Concepts: Understand core API7 Gateway abstractions like Services, Routes, and Plugins.