Amazon API Gateway
Amazon API Gateway is a fully managed service that makes it easy to create, publish, maintain, monitor, and secure APIs at any scale. It acts as the front door for applications to access backend services, supporting REST APIs, HTTP APIs, and WebSocket APIs with built-in traffic management, authorization, monitoring, and API version management. API Gateway integrates natively with AWS Lambda, CloudWatch, CloudFront, IAM, and Cognito, and (as of December 2025) can expose REST APIs as MCP-compatible tools for Amazon Bedrock AgentCore Gateway for agent-driven API consumption.
Reference-quality API operations across every facet — a rich contract, published governance, transparent operations, and machine-readable commercial terms.
API Evangelist profiles Amazon API Gateway the way a machine reads it — 224 machine-readable artifacts across 13 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Amazon API Gateway scores 75.1/100 (exemplar), with a separate agent-readiness read of 54/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-07-27 · rubric v0.5
How we profile Amazon API Gateway
Each block below is one kind of artifact we hold for Amazon API Gateway. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 13
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Amazon API Gateway Portals
The API Gateway Portals control plane (introduced November 19, 2025) lets you create branded developer portals that catalog REST APIs. A portal contains PortalProducts (logical ...
Amazon API Gateway ApiKeys API
Manage API keys
Amazon API Gateway Apis API
The Apis API from Amazon API Gateway — 2 operation(s) for apis.
Amazon API Gateway Authorizers API
Manage authorizers
Amazon API Gateway Connections API
Manage and message active WebSocket connections
Amazon API Gateway Deployments API
Manage API deployments
Amazon API Gateway Integrations API
Manage backend integrations
Amazon API Gateway Methods API
Manage HTTP methods on resources
Amazon API Gateway Resources API
Manage resources within a REST API
Amazon API Gateway RestApis API
Manage REST API definitions
Amazon API Gateway Routes API
Manage routes within an API
Amazon API Gateway Stages API
Manage deployment stages
Amazon API Gateway UsagePlans API
Manage usage plans
Scroll within the panel for all 13 ·
Postman Collections 3
A runnable collection turns the contract into something a developer can execute in seconds. We profile them because the fastest way to trust an API is to make a real call against it.
Ready-to-run Postman collections for exercising this provider's APIs.
Open Collections 3
Open, tool-agnostic collections carry the same runnable value as Postman without locking you to one client — the portable, forkable form of the same exercise.
Open, tool-agnostic API collections (OpenAPI-derived and Bruno).
Amazon API Gateway Management API
OPEN COLLECTIONAmazon API Gateway V1 (REST)
OPEN COLLECTIONAmazon API Gateway V2 (HTTP and WebSocket)
OPEN COLLECTIONArazzo Workflows 12
Real integrations are rarely a single call. Arazzo describes the multi-step sequences — auth, then create, then confirm — so both a human and an agent can follow the choreography, not just the endpoints.
Multi-step API workflows described with the Arazzo specification.
AWS API Gateway Add a Method and Redeploy
Verify a REST API exists, attach a method to one of its resources, and publish a fresh deployment.
ARAZZOAWS API Gateway Audit an HTTP API Surface
Confirm an HTTP API and enumerate its routes, integrations, and stages in a single read-only pass.
ARAZZOAWS API Gateway Build an HTTP API
Create an HTTP API, attach a backend integration, wire a route to it, and publish a stage.
ARAZZOAWS API Gateway Build a WebSocket API
Create a WebSocket API, add an integration, and wire the $connect route to it.
ARAZZOAWS API Gateway Create an API Key and Usage Plan
Create an API key, create a throttled and quota-limited usage plan, and confirm the plan was registered.
ARAZZOAWS API Gateway Decommission an HTTP API
Confirm an HTTP API, check for published stages, and delete the API when it is safe to remove.
ARAZZOAWS API Gateway Deploy an HTTP API to a New Stage
Confirm an HTTP API, create a deployment, and publish it to a new stage bound to that deployment.
ARAZZOAWS API Gateway Inspect a REST API Method
Confirm a REST API, list its resources, and read the method configuration for a chosen resource and verb.
ARAZZOAWS API Gateway Provision a Metered REST API
Create a REST API with a key-protected method and branch into usage-plan setup when an API key is required.
ARAZZOAWS API Gateway Provision and Deploy a REST API
Create a REST API, configure a method on its root resource, deploy it, and confirm the stage.
ARAZZOAWS API Gateway Redeploy a REST API Stage
Confirm a REST API, review its existing deployments, and publish a fresh deployment to a stage.
ARAZZOAWS API Gateway Secure an HTTP API with an Authorizer
Create an HTTP API, attach an authorizer, and add a route that uses it.
ARAZZOScroll within the panel for all 12 ·
GraphQL 1
Where a provider ships GraphQL, the schema is the contract. We profile it alongside the REST surface so the whole interface is legible in one place.
GraphQL schemas published by this provider.
Pricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the six things the Kin Score reads for commercial clarity.
Published pricing tiers and plan structures.
Rate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Aws Api Gateway Rate Limits
RATE LIMITSFinOps 1
Cost, billing, and metering signals let a buyer model the financial operations of an API before it's live. We profile them for the same reason we profile pricing: the money is part of the contract.
Cost, billing, and metering signals for API financial operations.
Aws Api Gateway Finops
FINOPSFeatures 19
The notable capabilities this provider advertises, captured as structured features so they can be searched and compared instead of read one landing page at a time.
Notable capabilities this provider offers.
REST API Management
Create, deploy, and manage REST APIs with full lifecycle control including stages, deployments, and versioning.
HTTP API Support
Build lightweight HTTP APIs optimized for serverless workloads at up to 71% lower cost than REST APIs.
WebSocket APIs
Enable real-time bidirectional communication for chat platforms, streaming dashboards, and live applications.
Traffic Management
Handle hundreds of thousands of concurrent API calls with built-in throttling and request validation.
Authorization and Security
Supports IAM policies, Lambda authorizers, Amazon Cognito user pools, and OAuth2/OIDC for API access control.
Monitoring and Logging
Integration with CloudWatch metrics, access logging, and CloudTrail for full API observability.
Custom Domain Names
Map APIs to branded custom domains with TLS certificates managed through AWS Certificate Manager.
Canary Releases
Safely roll out API changes using canary deployment stages with configurable traffic splitting.
AWS WAF Integration
Protect APIs against common web exploits and DDoS attacks using AWS Web Application Firewall.
SDK Generation
Automatically generate client SDKs for deployed APIs in multiple programming languages.
API Caching
Reduce backend load and improve response times with configurable response caching at the stage level.
CloudFront Edge Distribution
Leverage Amazon CloudFront edge locations for global low-latency API distribution.
Bedrock AgentCore Gateway MCP Target
Expose REST API stages as Model Context Protocol (MCP) tools for AI agents via Bedrock AgentCore Gateway. AgentCore translates incoming MCP requests into HTTP requests, supports...
Developer Portals
Native API Gateway Portals (launched November 19, 2025) let you publish PortalProducts containing REST APIs and per-endpoint documentation. Portals can be shared across AWS acco...
REST API Response Streaming
REST APIs can progressively stream response payloads to clients as they become available (launched November 19, 2025), enabling long-running and incremental response patterns.
Private Integration with Application Load Balancer
REST APIs support private integrations with Application Load Balancers (launched November 21, 2025), expanding private integration options beyond NLB and AWS Cloud Map.
SIGv4a Authentication for REST APIs
REST APIs now support AWS Signature Version 4a (launched August 19, 2025), enabling multi-Region signing for cross-Region API invocations.
Enhanced TLS Security Policies
Configurable TLS security policies for REST APIs and custom domain names (launched November 19, 2025) allow tighter control over accepted protocols and ciphers.
Dual-Stack IPv4/IPv6 Endpoints
REST, HTTP, and WebSocket APIs and custom domain names support dual-stack endpoints (launched March 28, 2025).
Scroll within the panel for all 19 ·
Event Specifications 1
Not every API is request/response. AsyncAPI describes the event-driven and streaming side — the webhooks and channels — so the asynchronous half of the interface is documented the same way the synchronous half is.
AsyncAPI definitions for this provider's event-driven and streaming APIs.
Amazon API Gateway WebSocket API Protocol
AsyncAPI description of the *platform protocol* exposed by Amazon API Gateway WebSocket APIs. Customer-deployed WebSocket APIs are message-routed based on a route selection expr...
ASYNCAPISemantic Vocabularies 30
JSON-LD contexts give the data shared meaning across APIs. We profile them because semantics are what let a machine reconcile 'customer' here with 'customer' somewhere else.
JSON-LD contexts and semantic vocabularies used across these APIs.
Scroll within the panel for all 30 ·
Spectral Rules 3
Governance rulesets we run against this provider's specs — the automated checks behind parts of the score. Profiling them makes the quality bar explicit and re-runnable, not a matter of opinion.
Amazon API Gateway API Rules
SPECTRALAmazon API Gateway API Rules
SPECTRALAmazon API Gateway API Rules
SPECTRALJSON Schema 41
Standalone JSON Schema definitions describe the data models behind the API. We profile them so the shapes are validatable on their own — useful long after a single request is forgotten.
Standalone JSON Schema definitions for this provider's data models.
Connection
JSON SCHEMAIdentity
JSON SCHEMAApiKey
JSON SCHEMAApiKeys
JSON SCHEMACreateApiKeyRequest
JSON SCHEMACreateDeploymentRequest
JSON SCHEMACreateRestApiRequest
JSON SCHEMACreateUsagePlanRequest
JSON SCHEMADeployment
JSON SCHEMADeployments
JSON SCHEMAEndpointConfiguration
JSON SCHEMAMethod
JSON SCHEMAPutMethodRequest
JSON SCHEMAQuotaSettings
JSON SCHEMAResource
JSON SCHEMAResources
JSON SCHEMARestApi
JSON SCHEMARestApis
JSON SCHEMAStage
JSON SCHEMAStages
JSON SCHEMAThrottleSettings
JSON SCHEMAUsagePlan
JSON SCHEMAUsagePlans
JSON SCHEMAApi
JSON SCHEMAApis
JSON SCHEMAAuthorizer
JSON SCHEMAAuthorizers
JSON SCHEMACreateApiRequest
JSON SCHEMACreateAuthorizerRequest
JSON SCHEMACreateDeploymentRequest
JSON SCHEMACreateIntegrationRequest
JSON SCHEMACreateRouteRequest
JSON SCHEMACreateStageRequest
JSON SCHEMADeployment
JSON SCHEMADeployments
JSON SCHEMAIntegration
JSON SCHEMAIntegrations
JSON SCHEMARoute
JSON SCHEMARoutes
JSON SCHEMAStage
JSON SCHEMAStages
JSON SCHEMAScroll within the panel for all 41 ·
JSON Structure 41
JSON Structure captures the data shapes in a form built for tooling — a complement to JSON Schema that keeps the model machine-legible.
JSON Structure definitions describing this provider's data shapes.
Management Connection Structure
JSON STRUCTUREManagement Identity Structure
JSON STRUCTUREV1 Api Key Structure
JSON STRUCTUREV1 Api Keys Structure
JSON STRUCTUREV1 Create Api Key Request Structure
JSON STRUCTUREV1 Create Deployment Request Structure
JSON STRUCTUREV1 Create Rest Api Request Structure
JSON STRUCTUREV1 Create Usage Plan Request Structure
JSON STRUCTUREV1 Deployment Structure
JSON STRUCTUREV1 Deployments Structure
JSON STRUCTUREV1 Endpoint Configuration Structure
JSON STRUCTUREV1 Method Structure
JSON STRUCTUREV1 Put Method Request Structure
JSON STRUCTUREV1 Quota Settings Structure
JSON STRUCTUREV1 Resource Structure
JSON STRUCTUREV1 Resources Structure
JSON STRUCTUREV1 Rest Api Structure
JSON STRUCTUREV1 Rest Apis Structure
JSON STRUCTUREV1 Stage Structure
JSON STRUCTUREV1 Stages Structure
JSON STRUCTUREV1 Throttle Settings Structure
JSON STRUCTUREV1 Usage Plan Structure
JSON STRUCTUREV1 Usage Plans Structure
JSON STRUCTUREV2 Api Structure
JSON STRUCTUREV2 Apis Structure
JSON STRUCTUREV2 Authorizer Structure
JSON STRUCTUREV2 Authorizers Structure
JSON STRUCTUREV2 Create Api Request Structure
JSON STRUCTUREV2 Create Authorizer Request Structure
JSON STRUCTUREV2 Create Deployment Request Structure
JSON STRUCTUREV2 Create Integration Request Structure
JSON STRUCTUREV2 Create Route Request Structure
JSON STRUCTUREV2 Create Stage Request Structure
JSON STRUCTUREV2 Deployment Structure
JSON STRUCTUREV2 Deployments Structure
JSON STRUCTUREV2 Integration Structure
JSON STRUCTUREV2 Integrations Structure
JSON STRUCTUREV2 Route Structure
JSON STRUCTUREV2 Routes Structure
JSON STRUCTUREV2 Stage Structure
JSON STRUCTUREV2 Stages Structure
JSON STRUCTUREScroll within the panel for all 41 ·
Examples 41
Real request and response payloads are what turn a spec from abstract into obvious — and they're one of the twelve things an agent needs to call an API correctly on the first try.
Example request and response payloads for these APIs.
Management Identity Example
EXAMPLEV1 Api Key Example
EXAMPLEV1 Api Keys Example
EXAMPLEV1 Deployment Example
EXAMPLEV1 Deployments Example
EXAMPLEV1 Method Example
EXAMPLEV1 Quota Settings Example
EXAMPLEV1 Resource Example
EXAMPLEV1 Resources Example
EXAMPLEV1 Rest Api Example
EXAMPLEV1 Rest Apis Example
EXAMPLEV1 Stage Example
EXAMPLEV1 Stages Example
EXAMPLEV1 Throttle Settings Example
EXAMPLEV1 Usage Plan Example
EXAMPLEV1 Usage Plans Example
EXAMPLEV2 Api Example
EXAMPLEV2 Apis Example
EXAMPLEV2 Authorizer Example
EXAMPLEV2 Authorizers Example
EXAMPLEV2 Deployment Example
EXAMPLEV2 Deployments Example
EXAMPLEV2 Integration Example
EXAMPLEV2 Integrations Example
EXAMPLEV2 Route Example
EXAMPLEV2 Routes Example
EXAMPLEV2 Stage Example
EXAMPLEV2 Stages Example
EXAMPLEScroll within the panel for all 41 ·
Security Posture 4
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Agentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Use Cases 8
What developers actually build with this provider — captured so the catalogue answers 'what is this for', not just 'what does this expose'.
What developers build with this provider.
Serverless API Backend
Build fully serverless APIs with API Gateway as the front door and AWS Lambda as the backend compute layer.
Microservices Gateway
Consolidate access to multiple microservices behind a single API endpoint with routing and load balancing.
Real-Time Applications
Enable chat apps, collaborative tools, and live dashboards using WebSocket APIs for persistent bidirectional connections.
Mobile and Web Application APIs
Create secure, scalable REST and HTTP APIs for mobile and web front-ends with Cognito authentication.
Legacy API Modernization
Expose existing on-premises or EC2-hosted services as modern REST APIs without rewriting backend logic.
Third-Party API Integration
Aggregate and normalize third-party APIs behind a consistent API surface with transformation and mapping.
MCP Tool Server for AI Agents
Expose REST APIs as MCP-compatible tool catalogs via Bedrock AgentCore Gateway so AI agents can list and invoke operations without bespoke client code.
Developer Portal for Partner APIs
Use native API Gateway Portals to publish partner-facing REST APIs with branded documentation, Cognito-gated access, and self-service key issuance.
Scroll within the panel for all 8 ·
Resources
Every other property we hold for Amazon API Gateway — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 2
Portal, sign-up, and the first successful call
Documentation 1
Reference material describing how the API behaves
Agent Surfaces 1
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 14
Pagination, idempotency, versioning, errors, and events
Scroll within the panel for all 14 ·
Build 5
SDKs, sample code, and the tooling you integrate with
Access & Security 4
Authentication, authorization, and security posture
Operate 6
Status, limits, changes, and where to get help
Commercial 5
Pricing, plans, and the legal terms of use
Company 2
The organization behind the API
← All providers · Data indexed from github.com/api-evangelist/aws-api-gateway · machine-readable index on apis.io