{
 "slug": "apisix",
 "name": "Apache APISIX",
 "tagline": "Cloud-native API gateway with dashboard, plugins and embedded etcd",
 "category": "api-app-server",
 "use_cases": [
  "api-gateway",
  "rate-limiting",
  "traffic-routing"
 ],
 "aliases": [
  "apache apisix"
 ],
 "status": "live",
 "upstream": {
  "vendor": "The Apache Software Foundation",
  "url": "https://apisix.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/apache/apisix/blob/master/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443,
   9080,
   9443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "3.19.0",
   "last_build": "2026-10-02",
   "entity_id": "prod-2ztdsggqnkozg",
   "ami_alias": "/aws/service/marketplace/prod-2ztdsggqnkozg/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-4vkwcvhnp3buo",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "3.19.0",
   "last_build": "2026-10-02",
   "offer_id": "apisix",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:apisix:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.apisix?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/apisix/",
  "json": "https://lynxroute.com/products/apisix/product.json"
 },
 "release_notes": [
  {
   "version": "3.19.0",
   "title": "Apache APISIX 3.19.0",
   "notes": "* Apache APISIX upgraded to 3.19.0 (from 3.18.0) - Apache-2.0 unchanged\n* Backward-incompatible: upstream.tls.verify is now honoured for https and grpcs upstreams, so an upstream already set to verify: true rejects a certificate it cannot validate; tls.ca_certs selects the trusted CAs per upstream\n* Backward-incompatible: basic-auth rejects an empty consumer password, openid-connect validates the introspection issuer when valid_issuers is set, and batch-requests caps aggregated responses at 1 MiB per item and 10 MiB in total\n* Backward-incompatible: successful WebSocket upgrades are labelled request_type=websocket in Prometheus metrics, and the control API reports empty healthcheck node lists as a JSON array\n* New: TLS passthrough and multi-SNI matching on the stream proxy, a ws/wss upstream scheme, slow start for new upstream nodes and an openapi-to-mcp plugin\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "3.18.0",
   "title": "Apache APISIX v3.18.0",
   "notes": "* Apache APISIX upgraded to 3.18.0 (from 3.17.0) - Apache-2.0 unchanged\n* Backward-incompatible: request and response body buffering is now bounded in about 19 plugins by max_req_body_size / max_resp_body_size (default 64 MiB); larger bodies are rejected or truncated instead of buffered without limit\n* Backward-incompatible: every batch-processor logger defaults max_pending_entries to 8192 and discards entries above it\n* Backward-incompatible: openid-connect enforces audience, issuer and required scopes, and bearer introspection fails closed when the discovery document is unavailable\n* Backward-incompatible: sls-logger verifies the log server TLS certificate by default (ssl_verify), and ldap-auth tls_verify: true now performs real certificate verification\n* Backward-incompatible: post_arg.* body reads are bounded by max_post_args_readable_size (64 MiB default), and the Apisix-Plugins debug header carries name#phase entries in execution order\n* Security: control characters in $upstream_uri are encoded to prevent CRLF injection, and the X-Forwarded-* headers are sanitised in the NGINX configuration\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23",
    "azure": "2026-09-06"
   }
  },
  {
   "version": "3.17.0",
   "title": "Apache APISIX v3.17.0",
   "notes": "* Apache APISIX upgraded to 3.17.0 (from 3.16.0) - upstream security and bugfix release\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-23",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "3.16.0",
   "title": "Apache APISIX 3.16.0 - Initial release (June 2026)",
   "notes": "* Apache APISIX 3.16.0 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Single-node etcd datastore bundled and bound to 127.0.0.1 only\n* Admin API and embedded Dashboard bound to 127.0.0.1; remote management via an Nginx TLS perimeter on port 443\n* Historical default Admin API key rotated to a unique per-instance key at first boot\n* Data plane on ports 9080 (HTTP) and 9443 (HTTPS)\n* No anonymous telemetry; bundled OpenResty links OpenSSL 3.x\n* UFW firewall pre-configured (ports 22, 443, 9080, 9443)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-06-29"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.19.0",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "3.18.0",
   "aws": "2026-08-23",
   "azure": "2026-09-06"
  },
  {
   "version": "3.17.0",
   "aws": "2026-07-23",
   "azure": "2026-07-27"
  },
  {
   "version": "3.16.0",
   "aws": "2026-07-01",
   "azure": "2026-06-29"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-2ztdsggqnkozg/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer apisix --plan payg-gen2\naz vm create -g my-rg -n apisix --size Standard_D2s_v3 \\\n  --image lynxroute:apisix:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache APISIX is a cloud-native, high-performance API gateway built on OpenResty (NGINX + LuaJIT). It routes, secures, and observes API traffic through a large catalogue of plugins: key-auth, JWT, basic-auth, OpenID Connect, rate limiting, IP restriction, CORS, request and response transformation, Prometheus metrics, and OpenTelemetry. Routes, upstreams, consumers, and plugins are configured dynamically through the Admin API or the embedded web Dashboard, with no restart required. APISIX stores its configuration in etcd; this image bundles a single-node etcd locally, so there is no external etcd cluster to deploy, secure, or operate. Apache-2.0 license, no per-API fees, no vendor lock-in. The separate API7 Enterprise product is not part of this build - this is the full open-source gateway.",
  "image_adds": "Security hardening:\n* Single-node etcd datastore bundled and bound to 127.0.0.1 only - no external etcd cluster to deploy or expose\n* Admin API and embedded Dashboard bound to 127.0.0.1 only; remote management via an Nginx TLS perimeter on port 443\n* The historical default Admin API key is rotated to a unique per-instance key at first boot, saved to /root/apisix-credentials.txt\n* Data plane on ports 9080 (HTTP) and 9443 (HTTPS)\n* No anonymous telemetry; bundled OpenResty links OpenSSL 3.x\n* UFW firewall - ports 22, 443, 9080, 9443\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}