Skip to content
Z Zendikt
France edition · 10 products ranked · Verified 2026-05-19

Top 10 API Management Software in France for 2026

Independent France ranking of API management software, EUR pricing, RGPD/CNIL fit, PSD2/DSP2 Open Banking APIs, and French-origin Axway and Gravitee context.

France verdict (TL;DR)

Verified 2026-05-19

France has two credible local API management champions that global rankings undercount: Axway (Phoenix-Paris, French-origin, Euronext-listed, ~$300M+ revenue) and Gravitee (Lille, French-founded open-source API management, ~$30M+ funded). Kong, Apigee, and Azure API Management lead at CAC 40 enterprise. Postman dominates French developer adoption. PSD2/DSP2 Open Banking API requirements drive BFSI API management maturity at BNP Paribas, Credit Agricole, and Societe Generale. RGPD (GDPR) enforced by CNIL and ANSSI cybersecurity guidance are the two compliance anchors. French data sovereignty (cloud souverain / SecNumCloud) increasingly affects public-sector and sensitive-sector API management choices.

Picks for France

  • French developer teams and product companies (API design, testing, governance): postman Dominant API lifecycle platform across French SaaS exporters (Aircall, Spendesk, Doctolib, Contentsquare). French developer community strong on Postman. EUR billing available. Free tier for individuals.
  • French enterprise and CAC 40 teams wanting open-source gateway control: kong Kong Gateway + Konnect. Leading open-source gateway at French telcos and large enterprises. EUR billing via French resellers. AWS EU (Paris) hosting available for French data residency.
  • French GCP-anchored enterprises and DSP2 Open Banking API publishers: apigee Apigee X on GCP EU (Paris region). Used by French banks (BNP Paribas, Credit Agricole tier) for DSP2/PSD2 TPP APIs. Strongest API analytics for CNIL audit trails. GCP Paris data residency.
  • French Azure-first enterprises and Microsoft-anchored CAC 40 groups: azure-api-management Default for large French Microsoft EA customers. Azure France Central (Paris) and France South (Marseille) data residency. Strong hybrid gateway for on-prem SAP + Azure API patterns common in French manufacturing.
  • French enterprises wanting Salesforce-anchored integration and API management: mulesoft MuleSoft Anypoint. Used by French BFSI and retail groups running Salesforce CRM. EUR billing via Salesforce France entity. Strong Paris-based MuleSoft professional services ecosystem.
  • French teams wanting open-source API management with local vendor support: gravitee Lille-founded, French-origin open-source API management platform. ~$30M+ funded. Gravitee APIM competes with Kong on price and developer experience. Best for French teams wanting a local-origin OSS gateway with EUR-denominated SaaS options.
Market context

How the api management software market looks in France

France's API management market is distinguished by two factors that set it apart from UK or Germany: the presence of genuinely competitive local vendors (Axway and Gravitee) and the advanced maturity of DSP2/PSD2 Open Banking API implementation at French retail banks. France was among the most proactive EU implementers of PSD2 (transposed as DSP2), and French banks (BNP Paribas, Credit Agricole, Societe Generale, La Banque Postale, BPCE) have operated Open Banking APIs since 2019, creating an API management maturity level at large French financial institutions that exceeds many peer EU markets.

Axway deserves particular emphasis. Axway (AXWAY SA, Euronext Paris: AXW) is a French-origin API management and integration platform company with ~$300M+ revenue, headquartered jointly in Phoenix, AZ and Paris. Its Amplify API Management Platform is a genuine enterprise competitor to MuleSoft and Apigee at large French and EU enterprises, with strong BFSI and healthcare vertical depth. French procurement teams at CAC 40 groups often have incumbent Axway relationships from the pre-REST era (Axway was a leading EDI/MFT vendor). For French public tenders, Axway's French legal entity (Axway Software SA) simplifies procurement.

Gravitee is the French open-source champion to watch. Founded in Lille in 2015, Gravitee has built an API management platform (APIM, Access Management, Alert Engine) that competes directly with Kong on open-source credentials and WSO2 on breadth. Gravitee.io's commercial SaaS (Cockpit, Cloud) is EUR-priced. French cloud sovereignty considerations (SecNumCloud qualification from ANSSI) are increasingly relevant: Axway and Gravitee are better positioned for future SecNumCloud-compliant deployments than US-headquartered vendors.

Compliance & local rules

RGPD (GDPR transposed): API management platforms routing personal data of French/EU residents must hold DPA (accord de traitement des donnees) with EUR-denominated SLAs; Azure France Central, GCP EU Paris, and AWS EU Paris satisfy French data residency requirements. CNIL guidance on API security recommends audit logging, rate limiting, and access token expiry controls; Kong, Apigee, and Gravitee configurations are aligned. PSD2/DSP2 TPP API requirements: AISP and PISP operators must implement mTLS with eIDAS QWAC certificates, FAPI security profiles, and SCA (Strong Customer Authentication) flows; Axway Open Banking, WSO2 Open Banking, and Apigee have published DSP2 conformance configurations. ANSSI (Agence nationale de la securite des systemes d'information) cybersecurity recommendations (PGSSI, RGS) apply to public-sector API gateways; SecNumCloud qualification is the gold standard for French public-sector cloud services. NIS2 Directive (transposed into French law 2024-2025): essential and important entities must implement API security controls as part of network and information systems security requirements.

At a glance

Quick comparison, ranked for France

Product Best for Starts at 10-emp/mo* Pricing G2 Geo
1 Postman
Engineering teams 10-5,000 developers
$0 + $0/emp $0 4.6 Global; strongest in US, India, EU
2 Kong
Engineering-led mid-market and enterprise
$0 + $0/emp $0 4.5 Global; strongest in US, EU, APAC
4 Apigee
Enterprise; GCP-anchored
$500 $500 4.4 Global; strongest in US, EU, APAC
5 Microsoft Azure API Management
Any Azure-anchored organization
$0 + $0/emp $0 4.3 Global; strongest in US, EU, AU; worldwide
3 MuleSoft Anypoint
Enterprise; Salesforce-anchored
Quote - 4.5 Global; strongest in US, EU, APAC
10 Gravitee
Event-driven engineering teams
$0 + $0/emp $0 4.4 Global; strongest in EU, France
6 AWS API Gateway
Any AWS-anchored organization
$0 + $0/emp $0 4.4 Global; available in all AWS regions
7 Tyk
Cost-conscious engineering teams
$0 + $0/emp $0 4.5 Global; strongest in UK, EU, Middle East
9 WSO2
Regulated and on-prem-heavy enterprises
$0 + $0/emp $0 4.3 Global; strongest in APAC, Middle East, EU
8 Stoplight
API platform and design teams
$0 + $0/emp $0 4.4 Global; strongest in US, EU

*10-employee monthly cost = base fee + (per-employee × 10) using the lowest published tier. For opaque-pricing vendors, no value is shown.

Verified local pricing

What buyers in France actually pay

Median annual deal size by employee band, in EUR. Crowdsourced from anonymized buyer disclosures.

Product Employee band Median annual (EUR) Sample Notes
Kong Konnect Plus, up to 10M calls/month €11,000 24 EUR-billed via French reseller
Apigee Intermediate tier, 50M calls/month €55,000 12 Apigee X; GCP EU Paris; EUR billing
Microsoft Azure API Management Standard tier, 500M calls/month €9,500 47 Azure APIM Standard; France Central; EUR
MuleSoft Anypoint Gold tier, mid-market €140,000 11 Anypoint Gold; EUR via Salesforce France
Gravitee Cockpit Enterprise, up to 10M calls/month €18,000 19 Gravitee Cockpit Enterprise; EUR-priced
Local challengers

France-built or France-strong vendors worth knowing

Not yet ranked in our global top 10, but credible options for France buyers and worth a shortlist.

Axway Amplify

Visit ↗

French-origin (Paris/Phoenix), Euronext-listed (AXW). ~$300M+ revenue. The leading French-origin enterprise API management platform. Strong BFSI and healthcare vertical depth. French legal entity simplifies public-sector procurement. Competes with MuleSoft and Apigee at large enterprise.

Gravitee

Visit ↗

Lille-founded French open-source API management. ~$30M+ funded. APIM + Access Management + Alert Engine. EUR-priced SaaS (Cockpit, Cloud). Direct Kong alternative for French teams wanting local-origin OSS. Growing DSP2 Open Banking adoption.

The France ranking

All 10, ranked for France

Same intelligence as the global ranking, vendor trust, review patterns, verified pricing, compliance, reordered for the France market.

#1

Postman

The developer-anchored API workspace. Design, mock, test, document.

Founded 2014 · San Francisco, CA · private · Any (developer count is the lever) employees
G2 4.6 (1,480)
Capterra 4.6
From $0 + $0 /mo + /employee
● Transparent pricing
Visit Postman

Postman is the developer-anchored leader in API management, roughly 30M registered users and a $5.6B valuation from its 2021 Series D led by Insight Partners. The product started as a Chrome extension for hand-testing REST endpoints in 2012 and has grown into a full API workspace covering design, mocking, testing, documentation, and a public API network. Best fit when the engineering team owns the API contract and wants one tool for the entire pre-production lifecycle. Trade-offs: runtime gateway story is thin (Postman is not a Kong replacement), enterprise governance lagged behind enterprise needs until 2023, and pricing has stepped up meaningfully at the Enterprise tier.

Best for

Engineering teams (10-5,000 developers) that own the API contract end-to-end and want a single workspace for design, mocking, testing, and documentation. Default choice for greenfield API programs.

Worst for

Pure runtime gateway needs (Kong/Apigee/cloud gateways are the right answer), highly regulated air-gapped environments (WSO2 or self-hosted Tyk fit better), or teams that need built-in monetization and partner billing (Apigee or MuleSoft).

Strengths

  • Largest developer base in the category (~30M registered users)
  • Best-in-class collection and test scripting
  • Generous free tier (3 users, unlimited collections)
  • Strong mock servers and contract testing
  • Public API Network for discoverability
  • AI features (Postbot) genuinely useful for test generation

Weaknesses

  • Not a runtime gateway, pair with Kong, Apigee, or cloud gateway
  • Enterprise governance maturity behind MuleSoft / Apigee
  • Pricing escalates at Enterprise tier
  • Cloud-only by default, on-prem requires Enterprise tier
  • Rate-limit changes on free tier in 2023 frustrated power users

Pricing tiers

public
  • Free
    Up to 3 users; unlimited collections; limited mock and monitor calls
    $0+$0 /mo +/emp
  • Basic
    Per user; team collaboration
    $14 /mo
  • Professional
    Per user; SSO, advanced governance
    $29 /mo
  • Enterprise
    Per user; SCIM, audit logs, custom domains
    $49 /mo
  • Enterprise Ultimate
    Custom; on-prem, advanced security
    Quote
Watch for
  • · Mock and monitor call overages
  • · AI Postbot credits separate at Enterprise
  • · On-prem deployment requires Ultimate tier

Key features

  • +API design (OpenAPI 3.x native)
  • +Collection runner and test scripting
  • +Mock servers
  • +Contract testing
  • +API documentation auto-generation
  • +Public API Network
  • +Postbot AI assistant
  • +Workspace-level RBAC
250+ integrations
GitHubGitLabBitbucketJenkinsDatadogNew RelicSlackJira
Geography
Global; strongest in US, India, EU
#2

Kong

Open-source gateway with the most credible commercial control plane.

Founded 2009 · San Francisco, CA · private · 50–100,000+ employees
G2 4.5 (720)
Capterra 4.6
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit Kong

Kong is the open-source-anchored leader in runtime API management, founded in 2009 as Mashape and rebranded to Kong in 2017. The OSS Kong Gateway is the most-deployed open-source API gateway by a wide margin, and the commercial Konnect SaaS control plane has become the most credible enterprise replacement for Apigee and MuleSoft for engineering-led organizations. Best fit when the platform team is engineering-led and wants plugin extensibility without vendor lock-in. Trade-offs: developer portal and monetization remain weaker than Apigee, deployment topology (control plane vs data plane) has a learning curve, and Konnect pricing at scale is no longer cheap.

Best for

Engineering-led platform teams (typically 100-10,000 developers) running Kubernetes-heavy or multi-cloud architectures who want plugin extensibility, low-latency runtime, and a credible alternative to Apigee/MuleSoft.

Worst for

Business-led API programs that lean on partner monetization (Apigee fits better), simple serverless APIs on a single cloud (cloud-native gateways are cheaper), or teams without platform engineering capacity (Postman + cloud gateway is simpler).

Strengths

  • Most-deployed open-source API gateway in the category
  • Plugin-extensible architecture (Lua + Go + JavaScript plugins)
  • Konnect SaaS control plane decouples ops from policy
  • Service mesh story (Kong Mesh / Kuma) genuinely integrated
  • Best for Kubernetes-native deployments
  • Engineering-led buyer base, credible enterprise references

Weaknesses

  • Developer portal weaker than Apigee
  • Monetization/billing features minimal
  • Konnect pricing escalates at high traffic volumes
  • Multi-cluster Konnect topology has a learning curve
  • OSS-to-Enterprise upgrade path not always frictionless

Pricing tiers

partial
  • Kong Gateway OSS
    Open-source; self-hosted; no commercial features
    $0+$0 /mo +/emp
  • Konnect Plus
    SaaS control plane; small traffic tier
    $250 /mo
  • Konnect Enterprise
    Per-service-pricing; SLA, advanced security
    Quote
  • Kong Gateway Enterprise (self-hosted)
    On-prem with commercial plugins
    Quote
  • Kong Mesh
    Service mesh add-on
    Quote
Watch for
  • · Per-service or per-traffic overages on Konnect Enterprise
  • · Mesh and Insomnia bundles separate
  • · Professional services for migration

Key features

  • +High-performance Lua/Nginx-based gateway
  • +Plugin SDK (Lua, Go, JavaScript, Python)
  • +Konnect SaaS control plane
  • +Service Mesh (Kuma/Kong Mesh)
  • +Insomnia design tool (acquired 2019)
  • +OAuth 2.0, JWT, OIDC plugins
  • +Kubernetes Ingress Controller
  • +Dev Portal
200+ integrations
KubernetesDatadogPrometheusSplunkOktaAuth0AWS LambdaAzure Functions
Geography
Global; strongest in US, EU, APAC
#4

Apigee

Mature enterprise gateway and analytics, now inside Google Cloud.

Founded 2004 · Mountain View, CA · public · 500–500,000+ employees
G2 4.4 (480)
Capterra 4.3
From $500 /mo
◐ Partial disclosure
Visit Apigee

Apigee is the long-standing enterprise API platform that Google acquired for $625M in November 2016. Architecturally still strong, analytics depth, monetization, partner-API programs, and policy depth remain among the best in the category. Best fit for organizations already on Google Cloud with complex partner-API programs, monetization needs, or telco/financial-services regulatory contexts. Trade-offs: post-Google velocity has been slow and largely tied to GCP roadmap rather than category innovation, the legacy Apigee Edge to Apigee X migration has been painful for long-tenured customers, and pricing is opaque and high outside Google-led deal cycles.

Best for

Enterprises (1,000+ employees) on Google Cloud with complex partner-API programs, monetization workflows, or regulated telco/financial-services contexts where policy depth and analytics matter more than developer ergonomics.

Worst for

AWS or Azure-anchored shops (cloud-native gateways are simpler), engineering-led platform teams (Kong fits better), or greenfield API programs without monetization needs (Postman + cloud gateway is faster to deploy).

Strengths

  • Strongest analytics and monetization in the category
  • Mature policy framework (KVMs, JS callouts, traffic management)
  • Works for partner API programs and telco/banking
  • Apigee X is GCP-native with autoscaling
  • Deep developer portal capabilities
  • Public cloud financial backing (Alphabet)

Weaknesses

  • Post-Google velocity slower than category leaders
  • Apigee Edge to Apigee X migration painful
  • Pricing opaque and high outside GCP-led deals
  • Strongly tied to Google Cloud, multi-cloud feels second-class
  • Developer experience dated vs Postman + Kong combo
  • Smaller community than Kong or Postman

Pricing tiers

partial
  • Apigee Standard
    ~$500/env/mo entry; limited calls
    $500 /mo
  • Apigee Enterprise
    $25K-$100K+/yr typical
    Quote
  • Apigee Enterprise Plus
    Enterprise; advanced monetization, SLA
    Quote
  • Apigee Hybrid
    Hybrid runtime; on-prem control planes
    Quote
Watch for
  • · Per-call overage charges
  • · Hybrid deployment infrastructure costs
  • · Implementation via Google or partners
  • · Apigee Edge to X migration services

Key features

  • +API design and policy framework
  • +Apigee Edge / Apigee X runtime
  • +Developer portal with monetization
  • +Advanced analytics dashboards
  • +Threat protection policies
  • +Hybrid runtime (Apigee Hybrid)
  • +OAuth 2.0 / OIDC enforcement
  • +Traffic management and quotas
150+ integrations
Google CloudBigQuerySalesforceSAPStackdriver / Cloud OperationsKubernetesAnthos
Geography
Global; strongest in US, EU, APAC
#5

Microsoft Azure API Management

The default API gateway for Azure-anchored organizations.

Founded 2014 · Redmond, WA · public · 50–500,000+ employees
G2 4.3 (580)
Capterra 4.4
From $0 + $0 /mo + /employee
● Transparent pricing
Visit Microsoft Azure API Management

Azure API Management (APIM) is the default API platform for any organization anchored to Microsoft Azure, launched in 2014 after Microsoft acquired Apiphany in 2013. Best fit when the runtime stack is Azure-heavy, App Service, Functions, Logic Apps, and identity is Microsoft Entra ID. The Consumption tier removed the historical minimum-spend barrier and made APIM viable for serverless-only workloads. Trade-offs: developer experience outside the Azure portal is dated, the policy expression language (XML-based) is unique to APIM and adds a learning curve, and capabilities outside the Azure ecosystem (multi-cloud, on-prem) feel second-class.

Best for

Azure-anchored organizations of any size, particularly those running App Service, Functions, Logic Apps, and using Microsoft Entra ID for OAuth/OIDC. Default choice for Microsoft-aligned shops.

Worst for

AWS or GCP-anchored shops (cloud-native gateways are simpler), engineering-led platform teams that want a plugin ecosystem (Kong is the answer), or teams that want a polished developer-experience-first design tool (pair with Postman or Stoplight).

Strengths

  • Native integration with Entra ID, Logic Apps, Functions, App Service
  • Consumption tier with no minimum spend
  • Self-hosted gateway for on-prem and multi-cloud
  • Strong policy library (rate limiting, caching, validation, JWT)
  • Developer portal included at no extra cost
  • Microsoft enterprise support backbone

Weaknesses

  • Developer experience outside Azure portal dated
  • XML policy language unique and harder to learn
  • Multi-cloud and on-prem feel second-class
  • Pricing tiers (Developer, Basic, Standard, Premium) hard to size
  • Cold-start latency on Consumption tier can hit lower-percentile traffic
  • Smaller plugin ecosystem than Kong

Pricing tiers

public
  • Consumption
    Pay-per-call; ~$3.50 per million calls
    $0+$0 /mo +/emp
  • Developer
    Non-prod; single unit
    $50 /mo
  • Basic
    Production entry; 1-2 units
    $150 /mo
  • Standard
    Production; 1-4 units; VNet not supported
    $700 /mo
  • Premium
    VNet, multi-region, 99.95% SLA
    $2800 /mo
  • Standard v2
    Newer SKU; faster scaling
    Quote
Watch for
  • · Capacity unit overages on Standard/Premium
  • · VNet integration drives Premium tier
  • · Multi-region deployment is per-region billing
  • · Self-hosted gateway separate licensing

Key features

  • +Policy expression language (XML)
  • +Developer portal included
  • +OAuth 2.0 and Entra ID native
  • +Self-hosted gateway (on-prem/multi-cloud)
  • +API versioning and revisioning
  • +Caching and rate limiting policies
  • +Mock responses
  • +Native Application Insights telemetry
200+ integrations
Azure App ServiceAzure FunctionsLogic AppsMicrosoft Entra IDApplication InsightsEvent GridService BusGitHub Actions
Geography
Global; strongest in US, EU, AU; worldwide
#3

MuleSoft Anypoint

Enterprise iPaaS + API platform inside the Salesforce stack.

Founded 2006 · San Francisco, CA · public · 500–500,000+ employees
G2 4.5 (680)
Capterra 4.4
Custom quote
○ Sales call required
Visit MuleSoft Anypoint

MuleSoft Anypoint is the integration-anchored enterprise API platform, combining iPaaS, API design, runtime, and a developer portal into a single suite. Salesforce acquired MuleSoft in March 2018 for $6.5B, making it one of the largest software acquisitions in the category. Anypoint is best fit when API management is downstream of large-scale system integration (ESB-replacement workloads, Salesforce-anchored enterprises, banking and insurance modernization). Trade-offs: pricing is among the highest in the category, post-Salesforce mid-market reach has visibly eroded as the sales motion shifted upmarket, runtime engine (Mule) is heavier than Kong or cloud-native gateways, and roadmap velocity has slowed compared to the standalone era.

Best for

Large enterprises (1,000-100,000+ employees), particularly Salesforce-anchored, with ESB-replacement workloads or complex multi-system integration where API management is one piece of a broader platform investment.

Worst for

Mid-market with simple REST-only needs (Kong, Tyk, or cloud gateways are cheaper), engineering-led platform teams (Kong fits the operating model better), or any organization not already anchored to Salesforce.

Strengths

  • Strongest iPaaS + API combination in the category
  • Salesforce-native integration unmatched for SF-anchored enterprises
  • Anypoint Studio mature for complex transformations
  • Runtime supports both REST and SOAP cleanly
  • API governance via Anypoint Exchange
  • Fits ESB modernization projects

Weaknesses

  • Among the most expensive options in the category
  • Mid-market reach eroded post-Salesforce acquisition
  • Mule runtime heavier than Kong or cloud-native gateways
  • Roadmap velocity slower since 2018 acquisition
  • Steep learning curve for non-Mule developers
  • Per-vCore pricing creates surprise costs

Pricing tiers

opaque
  • Anypoint Platform Starter
    Entry tier; typically starts ~$80K/yr
    Quote
  • Anypoint Platform Gold
    Mid-tier; ~$200K-$500K/yr typical
    Quote
  • Anypoint Platform Platinum
    Enterprise; $500K-$5M/yr typical
    Quote
  • Anypoint Flex Gateway
    Lightweight gateway; per-instance
    Quote
Watch for
  • · vCore overage charges
  • · Implementation services ($100K-$5M typical)
  • · Per-API governance modules
  • · Annual price increases of 8-15%

Key features

  • +API design (Anypoint Design Center)
  • +Mule runtime engine
  • +Anypoint Exchange (developer portal)
  • +iPaaS connectors (300+)
  • +Anypoint Flex Gateway (lightweight runtime)
  • +API security policies
  • +Mule MQ messaging
  • +Salesforce-native connectors
300+ integrations
SalesforceSAPWorkday HCMOracleNetSuiteServiceNowAWSAzure
Geography
Global; strongest in US, EU, APAC
#10

Gravitee

French open-core platform with first-class async API support.

Founded 2015 · Lille, France · private · 50–10,000 employees
G2 4.4 (180)
Capterra 4.5
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit Gravitee

Gravitee is the French open-core API platform with a distinctive bet, first-class support for asynchronous APIs (Kafka, MQTT, WebSocket, SSE) alongside traditional REST and GraphQL. Founded 2015 in Lille, Gravitee has carved out a niche in event-driven architectures where Kong and traditional gateways feel synchronous-only. Best fit for engineering teams running event-streaming architectures who need API governance over Kafka topics and WebSocket endpoints, not just REST. Trade-offs: smaller community and ecosystem than Kong or Tyk, brand awareness lower in North America, and the async-first positioning narrows the ideal customer profile.

Best for

Engineering teams (50-2,000 developers) running event-streaming architectures (Kafka, MQTT, WebSocket) who need API governance over async endpoints, particularly EU-based teams with GDPR data-residency requirements.

Worst for

Pure REST API needs (Kong, Tyk, cloud gateways are simpler), monetization-heavy partner programs (Apigee, MuleSoft), or US-only deployments where vendor proximity matters.

Strengths

  • First-class async API support (Kafka, MQTT, WebSocket, SSE)
  • Open-core with credible commercial tier
  • OAuth, OIDC, mTLS native
  • GraphQL and REST native
  • Right call for event-driven architectures
  • EU-hosted SaaS option for GDPR-sensitive workloads

Weaknesses

  • Smaller community than Kong or Tyk
  • Brand awareness low in North America
  • Plugin ecosystem narrower
  • Documentation uneven outside core flows
  • Support inconsistency reported by region
  • Ideal customer profile narrow

Pricing tiers

partial
  • Gravitee OSS
    Open-source self-hosted; no commercial features
    $0+$0 /mo +/emp
  • Gravitee Cloud
    Entry SaaS tier
    $250 /mo
  • Gravitee Cloud Enterprise
    Per-call tiers; SLA, advanced security
    Quote
  • Gravitee Self-Managed Enterprise
    On-prem; per-instance
    Quote
Watch for
  • · Per-call overages on Cloud Enterprise
  • · Async-specific add-ons
  • · Professional services for migration

Key features

  • +Async API gateway (Kafka, MQTT, WebSocket, SSE)
  • +REST, GraphQL gateway
  • +Access Management (OIDC IdP)
  • +Policy designer
  • +Developer portal
  • +Cockpit multi-environment management
  • +OAuth 2.0, JWT, mTLS
  • +Self-managed and SaaS
70+ integrations
KafkaMQTT brokersKubernetesKeycloakDatadogPrometheusOpenTelemetry
Geography
Global; strongest in EU, France
#6

AWS API Gateway

The default front door for AWS Lambda and serverless APIs.

Founded 2015 · Seattle, WA · public · 1–500,000+ employees
G2 4.4 (720)
Capterra 4.5
From $0 + $0 /mo + /employee
● Transparent pricing
Visit AWS API Gateway

AWS API Gateway has been the default API front door on AWS since its 2015 launch, particularly for Lambda-backed serverless architectures. Two flavors matter, REST APIs (full feature set, higher cost) and HTTP APIs (subset of features, ~70% cheaper). Best fit when the runtime is AWS-heavy and identity is Cognito or AWS IAM. Trade-offs: it is a runtime gateway only, no design tool, no developer portal, no monetization, so most AWS shops pair it with Postman for design and a separate dev portal solution. Usage-based pricing scales linearly with traffic, which is fine until it is not.

Best for

AWS-anchored organizations running Lambda-based serverless architectures, particularly mid-market and startups that want pay-per-request pricing and tight integration with AWS IAM/Cognito.

Worst for

Multi-cloud strategies (cloud-neutral gateways like Kong fit better), partner-API monetization (Apigee or MuleSoft), or any team that wants design + portal + runtime in one product (Postman + Kong or Apigee).

Strengths

  • Default gateway for AWS-anchored serverless
  • HTTP APIs ~70% cheaper than REST APIs
  • Native Lambda integration
  • AWS IAM and Cognito enforcement built-in
  • Pay-per-request, no minimum spend
  • Multi-region deployment via Route 53

Weaknesses

  • No design tool, pair with Postman or Stoplight
  • No developer portal, must build or buy separately
  • No monetization or partner billing
  • REST APIs pricing escalates at high volume
  • Custom authorizer cold starts add latency
  • WebSocket APIs feel like an afterthought

Pricing tiers

public
  • HTTP APIs
    $1.00 per million requests (first 300M)
    $0+$0 /mo +/emp
  • REST APIs
    $3.50 per million requests (first 333M)
    $0+$0 /mo +/emp
  • WebSocket APIs
    $1.00 per million messages
    $0+$0 /mo +/emp
  • Private APIs
    Same as REST/HTTP; VPC endpoint costs extra
    $0+$0 /mo +/emp
Watch for
  • · Data transfer out (CloudFront or direct)
  • · Caching costs ($0.02-$3.80/hr per cache size)
  • · CloudWatch Logs ingestion
  • · WAF if attached

Key features

  • +REST and HTTP API types
  • +WebSocket APIs
  • +Native Lambda integration
  • +AWS IAM and Cognito authorizers
  • +Custom Lambda authorizers
  • +Caching layer
  • +Throttling and quotas
  • +Stage-based deployments
100+ integrations
AWS LambdaAWS IAMAmazon CognitoCloudWatchAWS WAFRoute 53CloudFrontX-Ray
Geography
Global; available in all AWS regions
#7

Tyk

Lightweight, open-source-friendly Go-based gateway built in the UK.

Founded 2014 · London, UK · private · 50–10,000 employees
G2 4.5 (280)
Capterra 4.6
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit Tyk

Tyk is the UK-built open-source-friendly API platform, Go-based, lightweight, and explicitly multi-cloud / air-gappable from the start. Founded 2014 in London, Tyk has carved out a credible niche as the cost-conscious alternative to Kong with strong support for self-hosted, on-prem, and air-gapped deployments. Best fit for cost-conscious engineering teams that want Kong-class capability without Konnect-tier pricing, particularly in regulated or sovereign-cloud contexts. Trade-offs: smaller community and ecosystem than Kong, plugin model (gRPC, JS, Python) less mature, and documentation depth is uneven.

Best for

Cost-conscious engineering teams (50-2,000 developers) needing Kong-class runtime capability with strong on-prem, air-gapped, or sovereign-cloud requirements, particularly UK, EU, and Middle East public sector and financial services.

Worst for

Teams that need a polished managed SaaS with plugin marketplace (Kong Konnect fits better), monetization-heavy partner programs (Apigee), or shops wanting US-anchored vendor with deep North American partner network.

Strengths

  • Go-based runtime, light footprint
  • OSS-first with credible commercial tier
  • Strong multi-cloud and air-gapped story
  • Self-managed and SaaS deployment options
  • OAuth, JWT, OIDC out of the box
  • Pricing significantly below Kong Konnect at scale

Weaknesses

  • Smaller community than Kong
  • Plugin ecosystem less mature
  • Documentation depth uneven
  • Developer portal weaker than Apigee or MuleSoft
  • Brand awareness lower in North America
  • Support quality variable by region

Pricing tiers

partial
  • Tyk OSS
    Open-source; self-hosted; no commercial features
    $0+$0 /mo +/emp
  • Tyk Cloud Launchpad
    Entry SaaS tier
    $600 /mo
  • Tyk Cloud
    Production SaaS; per-call tiers
    Quote
  • Tyk Self-Managed
    On-prem; per-instance licensing
    Quote
  • Tyk MDCB (Multi Data Centre)
    Distributed control plane
    Quote
Watch for
  • · Per-call overages on Cloud
  • · MDCB add-on for distributed deployments
  • · Professional services for migration

Key features

  • +Go-based gateway
  • +OSS Tyk Gateway + Tyk Pump
  • +Tyk Cloud SaaS
  • +Self-hosted with MDCB
  • +OAuth 2.0, JWT, OIDC, mTLS
  • +GraphQL federation
  • +Plugin SDKs (gRPC, JS, Python)
  • +Developer portal
80+ integrations
KubernetesPrometheusDatadogSplunkOktaKeycloakAuth0
Geography
Global; strongest in UK, EU, Middle East
#9

WSO2

Open-source full-stack: gateway, IAM, and integration in one suite.

Founded 2005 · Mountain View, CA / Colombo, Sri Lanka · private · 500–500,000+ employees
G2 4.3 (380)
Capterra 4.4
From $0 + $0 /mo + /employee
○ Sales call required
Visit WSO2

WSO2 is the Sri Lanka-built open-source full-stack platform that bundles API management (API Manager), identity (Identity Server / Asgardeo), and integration (Micro Integrator) into a single coherent suite. Founded 2005 with deep ESB heritage, WSO2 has carved out a strong position with telcos, banks, and government agencies that need on-prem, sovereign-cloud, or air-gapped deployments. Best fit for regulated enterprises wanting an OSS-licensed alternative to MuleSoft with a single-vendor IAM + API + integration stack. Trade-offs: developer experience dated compared to Postman or Stoplight, deployment complexity higher than SaaS-first options, and brand awareness in North America is well below the Big Three.

Best for

Regulated enterprises (1,000-100,000+ employees), telcos, banks, government, that need OSS-licensed full-stack API + IAM + integration with on-prem or sovereign-cloud requirements and willingness to invest in deployment expertise.

Worst for

SaaS-first organizations (Kong Konnect or Apigee X are simpler), engineering teams that prioritize polished developer experience (Postman + Kong), or US-anchored shops with no sovereign-cloud requirements.

Strengths

  • Genuine open-source with permissive Apache 2.0 license
  • Single-vendor IAM + API + integration stack
  • Made for telcos, banks, government
  • On-prem, sovereign-cloud, air-gapped deployment
  • Asgardeo cloud IAM is credible CIAM
  • Choreo cloud-native developer platform

Weaknesses

  • Developer experience dated
  • Deployment complexity higher than SaaS
  • Brand awareness low in North America
  • Documentation depth uneven across modules
  • Support depends on tier
  • UI feels older than Kong/Apigee/Postman

Pricing tiers

opaque
  • WSO2 API Manager OSS
    Open-source Apache 2.0; self-hosted
    $0+$0 /mo +/emp
  • WSO2 Subscription
    Commercial subscription; support, updates, SLA
    Quote
  • Choreo (cloud)
    SaaS dev platform; per-developer + per-call
    Quote
  • Asgardeo (cloud IAM)
    Free up to 5K MAU; tiered after
    $0+$0 /mo +/emp
Watch for
  • · Per-CPU subscription pricing on-prem
  • · Implementation services typically required
  • · Training certifications recommended

Key features

  • +WSO2 API Manager (gateway + portal)
  • +Identity Server / Asgardeo (CIAM)
  • +Micro Integrator (ESB heritage)
  • +Choreo cloud-native platform
  • +GraphQL and async API support
  • +OAuth 2.0, OIDC, SAML, mTLS
  • +Multi-tenancy
  • +SOAP and REST
200+ integrations
KubernetesSalesforceSAPOracleKeycloakDatadogPrometheus
Geography
Global; strongest in APAC, Middle East, EU
#8

Stoplight

API design and OpenAPI governance, now part of SmartBear.

Founded 2014 · Austin, TX · pe backed · 50–10,000 employees
G2 4.4 (240)
Capterra 4.5
From $0 + $0 /mo + /employee
◐ Partial disclosure
Visit Stoplight

Stoplight is the API design and governance specialist, best-in-class visual OpenAPI editor, style guides, and design-first workflows. SmartBear (PE-owned by Vista Equity Partners) acquired Stoplight in 2024, bringing it into the broader API tooling portfolio alongside ReadyAPI, SwaggerHub, and Pact. Best fit for teams that want design-first API governance and OpenAPI linting at scale, typically before they hand the contract to a runtime gateway. Trade-offs: not a runtime gateway, post-acquisition roadmap uncertainty as SmartBear consolidates with SwaggerHub, and pricing model has been in transition since the acquisition.

Best for

API platform teams (50-5,000 developers) implementing design-first workflows, OpenAPI style guides, and contract governance at scale, typically before runtime gateway selection.

Worst for

Pure runtime gateway needs (Kong, Apigee, cloud gateways), teams already standardized on Postman for design (overlap), or organizations sensitive to PE-backed roadmap uncertainty.

Strengths

  • Best-in-class visual OpenAPI design studio
  • Style guides and Spectral linter (open-source)
  • Strong design-first governance for API platforms
  • Mock servers and prototyping
  • Git-native workflow
  • Spectral now de facto standard for OpenAPI linting

Weaknesses

  • Not a runtime gateway
  • SmartBear acquisition created roadmap uncertainty
  • Overlap with SmartBear SwaggerHub causing brand confusion
  • Pricing model in transition
  • Free tier reduced post-acquisition
  • Smaller community than Postman

Pricing tiers

partial
  • Free
    Reduced post-acquisition; limited collaborators
    $0+$0 /mo +/emp
  • Starter
    Per user; small teams
    $39 /mo
  • Professional
    Per user; SSO, governance
    $99 /mo
  • Enterprise
    Custom; on-prem, advanced security
    Quote
Watch for
  • · Style guide enforcement at higher tier
  • · On-prem requires Enterprise
  • · Annual price changes since acquisition

Key features

  • +Visual OpenAPI design studio
  • +Spectral linter and style guides
  • +Mock servers
  • +Documentation publishing
  • +Git-native workflow
  • +Design library reuse
  • +Project-level governance
  • +OpenAPI 3.x and AsyncAPI
60+ integrations
GitHubGitLabBitbucketAzure DevOpsJenkinsPostmanSlack
Geography
Global; strongest in US, EU

Frequently asked questions

The questions buyers actually ask before they sign.

What makes Axway relevant for French buyers compared to Kong or Apigee?
Axway (Axway Software SA, Euronext Paris: AXW) is a French-registered company with a Paris corporate presence and French-speaking support and professional services teams. For large French enterprise and public-sector procurement, a French legal entity matters for contract law, data protection liability, and public tender eligibility. Axway Amplify competes directly with MuleSoft and Apigee on enterprise API lifecycle management and has stronger EDI/MFT integration for French manufacturing and logistics than either competitor. The downside is a smaller developer community and ecosystem than Kong or Apigee.
How does French cloud sovereignty (SecNumCloud/ANSSI) affect API management choices?
ANSSI's SecNumCloud qualification framework defines security requirements for French public-sector cloud services. As of mid-2026, no major US-origin API management SaaS (Kong Konnect, Apigee, Azure API Management, AWS API Gateway) holds SecNumCloud qualification; the SecNumCloud-qualified market is served by OVHcloud, Outscale (Dassault), and Thales S3NS (Thales + Google architecture). For French public-sector API management projects requiring SecNumCloud, deploying Kong or Gravitee on OVHcloud-hosted Kubernetes is the most common architecture. Axway on-premises deployments are also compliant when hosted in SecNumCloud-qualified infrastructure.
Which API management platform best covers DSP2/PSD2 Open Banking requirements?
DSP2 (French transposition of EU PSD2) requires AISP and PISP operators to expose and consume APIs with FAPI security profiles, mTLS with eIDAS QWAC certificates, SCA (RTS on SCA), and Dynamic Client Registration. Axway Open Banking has the most complete French DSP2 compliance kit with pre-built Societe Generale and BNP Paribas-tested configurations. WSO2 Open Banking has published EU-wide PSD2 compliance documentation. Apigee and Kong require more custom configuration but are used in production by French banks. The STET API specification (French interoperability standard for Open Banking APIs) is supported natively by Axway Amplify and with custom adapters in Kong and Apigee.
Postman vs Kong, which one?
Both, almost always. Postman owns the design / mock / test / document side of the API lifecycle and is the workspace your developers already know. Kong owns the runtime gateway side, policy enforcement, rate limiting, OAuth, traffic shaping. They are not competitors; they are complementary. Most engineering-led organizations land on Postman for design plus a runtime gateway (Kong if you want plugin-extensible OSS, cloud gateways if you are anchored to one cloud, Apigee or MuleSoft if you need monetization). Pick one design tool and one runtime; do not pay for two of either.
MuleSoft vs Apigee, which enterprise platform?
MuleSoft when integration is the primary need and you are Salesforce-anchored, Anypoint excels at iPaaS plus API management as a single suite. Apigee when API governance, monetization, and partner-API programs are the primary need and you are Google Cloud-anchored. Both are expensive. Both have post-acquisition velocity issues, MuleSoft under Salesforce since 2018, Apigee under Google since 2016. Honest take: if you are an engineering-led modernization, Kong Konnect is now a credible third option that beats both on developer experience.
Should I use Azure APIM or AWS API Gateway?
Use whichever cloud you are already on. The decision is platform alignment, not feature merit. Azure APIM has stronger developer portal and policy library; AWS API Gateway has cheaper pay-per-request pricing for serverless. If you are multi-cloud, neither is right, use Kong or Tyk and treat the cloud gateways as edge ingress only. For OAuth/OIDC the cloud gateways pair natively with their cloud identity service (Cognito on AWS, Entra on Azure); see our Top 10 IAM Software ranking.
How much should I budget for API management?
Startup or small dev team (1-50 developers): $0-$5K (Postman free or Basic, Kong OSS, AWS API Gateway pay-per-request). Mid-market (50-200 developers): $20K-$100K (Postman Professional, Kong Konnect Plus, Tyk Cloud, Azure APIM Standard). Enterprise (200-2,000 developers): $100K-$500K (Postman Enterprise, Kong Enterprise, Apigee Standard, Azure APIM Premium). Large enterprise (2,000+ developers): $500K-$5M+ (MuleSoft Anypoint, Apigee Enterprise Plus, Kong Konnect Enterprise, WSO2 enterprise subscription).
How long does API management implementation take?
Postman: hours to days for the workspace, weeks for governance rollout. AWS API Gateway, Azure APIM Consumption: hours to days. Kong OSS: 1-2 weeks. Kong Konnect, Tyk Cloud, Gravitee Cloud: 2-6 weeks. Apigee, Azure APIM Premium with VNet: 4-12 weeks. MuleSoft Anypoint, WSO2 on-prem: 12-32 weeks via certified partners. The runtime gateway is usually the fast part; developer-portal content and OAuth/OIDC integration with your IAM stack typically dominates the timeline.
How does API management connect to my IAM stack?
API gateways have become the OAuth 2.0 / OIDC enforcement boundary for most modern architectures. The gateway validates the JWT or introspects the access token issued by your IAM provider (Okta, Auth0, Microsoft Entra ID, Keycloak, Ping). Postman uses your IAM for collection-level access control. See our Top 10 IAM Software ranking for the identity layer. Common pairings: Microsoft Entra ID with Azure APIM, Auth0 with Kong or AWS, Okta with any gateway.
How do I monitor API performance?
Most API management platforms ship basic gateway analytics (request rate, error rate, latency percentiles), but production-grade observability lives in your APM stack, Datadog, New Relic, Dynatrace, Honeycomb. Kong, Apigee, MuleSoft, Azure APIM, and AWS API Gateway all integrate natively with the major APM vendors. See our Top 10 APM Software ranking. The pattern: API gateway provides infrastructure-level metrics; APM provides distributed tracing across services behind the gateway.
What is the role of OpenAPI in 2026?
OpenAPI 3.x is the industry-standard contract format for REST APIs and is supported by every vendor in this ranking. The 2026 shift: design-first workflows (write OpenAPI, generate code, lint with Spectral) have moved from advanced practice to default expectation, especially in regulated industries. Stoplight is the design-first specialist; Postman handles design plus the rest of the lifecycle. AsyncAPI (the async equivalent) is gaining adoption, Gravitee, WSO2, and Postman all support it. If your platform team is not enforcing OpenAPI style guides, that is a 2024 problem, not a 2026 problem.

Final word

Looking at a different market? See the global API Management Software ranking, or pick another country at the top of this page.

Last updated 2026-05-19. Local pricing reverified quarterly. Found something inaccurate? Tell us.