{
 "slug": "wso2am",
 "name": "WSO2 API Manager",
 "tagline": "Full-lifecycle API management with publisher, developer portal and gateway",
 "category": "api-app-server",
 "use_cases": [
  "api-management",
  "developer-portal",
  "api-gateway"
 ],
 "aliases": [
  "wso2 api manager"
 ],
 "status": "live",
 "upstream": {
  "vendor": "WSO2 LLC",
  "url": "https://wso2.com/api-manager/",
  "license": "Apache-2.0",
  "license_url": "https://github.com/wso2/product-apim/blob/master/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   9443,
   9763,
   8243,
   8280
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "4.7.0",
   "last_build": "2026-06-27",
   "offer_id": "wso2am",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:wso2am:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.wso2am?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/wso2am/",
  "json": "https://lynxroute.com/products/wso2am/product.json"
 },
 "release_notes": [
  {
   "version": "4.7.0",
   "title": "WSO2 API Manager 4.7.0 - Initial release (June 2026)",
   "notes": "* WSO2 API Manager 4.7.0 (all-in-one profile) on Ubuntu 24.04 LTS, Eclipse Temurin 21\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Production datastore on a bundled local PostgreSQL (shared_db + apim_db); embedded H2 dev DB not used\n* Keystore regenerated at first boot (replaces the publicly known default wso2carbon.jks); random super-admin password at first boot\n* PostgreSQL bound to localhost; AI/analytics phone-home disabled\n* UFW firewall pre-configured (22, 9443, 9763, 8243, 8280)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-06-27"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.7.0",
   "azure": "2026-06-27"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer wso2am --plan payg-gen2\naz vm create -g my-rg -n wso2am --size Standard_D4s_v3 \\\n  --image lynxroute:wso2am:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "WSO2 API Manager is an open-source platform for the full API lifecycle. It combines a Publisher (design, version and document REST, SOAP, GraphQL, WebSocket and streaming APIs), a Developer Portal (discover, subscribe, get keys and try APIs), an API Gateway (a high-performance proxy that enforces security, rate limiting and mediation), and a built-in Key Manager that issues and validates OAuth2 access tokens, API keys and JWTs. It supports OpenID Connect, OAuth 2.0 scopes, mutual TLS, subscription-tier throttling, API monetization, and pluggable external key managers (Keycloak, Okta, Auth0). Applications and clients use standard endpoints, so no vendor SDK is required. WSO2 API Manager needs a production relational database; this image bundles and rotates a local PostgreSQL. Apache-2.0 license - the community binary is the production binary, with no open-core feature gating.",
  "image_adds": "Security hardening:\n* Production datastore on a bundled local PostgreSQL (shared_db + apim_db) - not the embedded H2 dev database\n* The shipped wso2carbon.jks ships a publicly known private key; this image regenerates the keystore with a fresh self-signed certificate at first boot\n* Random super-admin password generated at first boot, written to /root/wso2am-credentials.txt (root-only); the default admin/admin is never shipped live\n* PostgreSQL (5432) bound to 127.0.0.1 only; the AI/telemetry features are disabled (no phone-home on boot)\n* JVM heap auto-sized to the instance at first boot\n* UFW firewall pre-configured (22 plus the WSO2 ports 9443, 9763, 8243, 8280)\n* fail2ban, auditd, AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nNote on updates: security patches follow the upstream WSO2 community release cadence plus our OS/CIS layer; this image does not use the WSO2 subscriber (WUM/U2) update channel."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}