Availability and pricing

Cloud	Version	Software price	Last build
Azure Marketplace VM image · plan payg-gen2 · Gen2	4.7.0	$0.028/vCPU/hr Recommended VM: Standard_D4s_v3	2026-06-27	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	WSO2 LLC
Machine-readable	product.json · catalog.json

What is WSO2 API Manager

WSO2 API Manager is an open-source platform for the full API lifecycle. It combines a Publisher (design, version and document REST, SOAP, GraphQL, WebSocket and streaming APIs), a Developer Portal (discover, subscribe, get keys and try APIs), an API Gateway (a high-performance proxy that enforces security, rate limiting and mediation), and a built-in Key Manager that issues and validates OAuth2 access tokens, API keys and JWTs. It supports OpenID Connect, OAuth 2.0 scopes, mutual TLS, subscription-tier throttling, API monetization, and pluggable external key managers (Keycloak, Okta, Auth0). Applications and clients use standard endpoints, so no vendor SDK is required. WSO2 API Manager needs a production relational database; this image bundles and rotates a local PostgreSQL. Apache-2.0 license - the community binary is the production binary, with no open-core feature gating.

What the Lynxroute image adds

Security hardening:

Production datastore on a bundled local PostgreSQL (shared_db + apim_db) - not the embedded H2 dev database
The shipped wso2carbon.jks ships a publicly known private key; this image regenerates the keystore with a fresh self-signed certificate at first boot
Random super-admin password generated at first boot, written to /root/wso2am-credentials.txt (root-only); the default admin/admin is never shipped live
PostgreSQL (5432) bound to 127.0.0.1 only; the AI/telemetry features are disabled (no phone-home on boot)
JVM heap auto-sized to the instance at first boot
UFW firewall pre-configured (22 plus the WSO2 ports 9443, 9763, 8243, 8280)
fail2ban, auditd, AppArmor pre-configured
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Note on updates: security patches follow the upstream WSO2 community release cadence plus our OS/CIS layer; this image does not use the WSO2 subscriber (WUM/U2) update channel.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/wso2am-credentials.txt.

Azure CLI

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer wso2am --plan payg-gen2
az vm create -g my-rg -n wso2am --size Standard_D4s_v3 \
  --image lynxroute:wso2am:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

WSO2 API Manager 4.7.0 - Initial release (June 2026)

Azure · 2026-06-27

WSO2 API Manager 4.7.0 (all-in-one profile) on Ubuntu 24.04 LTS, Eclipse Temurin 21
CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
CVE-scanned before every release
Production datastore on a bundled local PostgreSQL (shared_db + apim_db); embedded H2 dev DB not used
Keystore regenerated at first boot (replaces the publicly known default wso2carbon.jks); random super-admin password at first boot
PostgreSQL bound to localhost; AI/analytics phone-home disabled
UFW firewall pre-configured (22, 9443, 9763, 8243, 8280)
fail2ban, auditd, AppArmor pre-configured
SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
IMDSv2 enforced