Learn More About API7 Products and APISIX
Understand the API7 product family, the relationship between API7 Enterprise and Apache APISIX, and how they fit into your API management strategy.
API7.ai offers a suite of API management products built on the Apache APISIX open-source project. Use this page to decide which product fits your needs.
API7 product family
| Product | Deployment | Best For |
|---|---|---|
| API7 Enterprise | Self-hosted (On-Premises) | Organizations requiring full control, data sovereignty, and enterprise features like RBAC, SSO, and audit logs. |
| Apache APISIX (Open Source) | Self-hosted | Developers and teams who need a high-performance API gateway without enterprise features. |
API7 Enterprise vs. Apache APISIX
API7 Enterprise is built on top of Apache APISIX and extends it with additional features, including the ones compared below. The data plane (gateway) in API7 Enterprise is a hardened, commercially supported version of APISIX.
| Capability | Apache APISIX | API7 Enterprise |
|---|---|---|
| High-performance proxying | ✅ | ✅ |
| Dynamic routing and load balancing | ✅ | ✅ |
| Rich plugin ecosystem | ✅ (100+ plugins) | ✅ (100+ plugins + enterprise-only plugins) |
| Dashboard UI | APISIX Dashboard (community) | API7 Dashboard (commercial) |
| RBAC and multi-tenancy | ❌ | ✅ (Roles, organizations, gateway groups) |
| Approval workflows | ❌ | ✅ |
| Audit logging | ❌ | ✅ |
| SSO | ✅ (Gateway SSO) | ✅ (Dashboard and Gateway SSO with more protocols) |
| Commercial support and SLAs | Community support | 24/7 enterprise support |
| Kubernetes ingress controller | APISIX Ingress Controller | API7 Ingress Controller |
| Administrator identity | A static X-API-KEY, with two roles: admin and viewer | Named users with roles, permission policies and boundaries |
| Custom plugin languages | Lua, plus external plugin runners for Java, Go and Python, plus Wasm | Lua only, and not sandboxed — a custom plugin runs with the gateway's privileges |
| Declarative configuration | ADC (Apache-2.0, maintained by API7.ai) | The same ADC, with server-side validation, diff preview and configuration export for environment promotion |
| Secret storage | External secret managers | External secret managers, or stored in API7 Gateway encrypted to FIPS standards |
| Certifications | — | SOC 2 Type II, ISO/IEC 27001:2022, HIPAA, GDPR |
The APISIX Dashboard is served by APISIX itself at :9180/ui/ and authenticates with the Admin API key; the API7 Dashboard is a separate control-plane component with its own user model.
Ingress Controllers
Each gateway has its own Kubernetes ingress controller, and the two are separate products built from separate repositories:
| Drives | Install it | |
|---|---|---|
| API7 Ingress Controller | API7 Gateway, through the API7 control plane | Set Up API7 Ingress Controller (opens in Ingress Controller docs) |
| APISIX Ingress Controller | Apache APISIX | Set Up APISIX Ingress Controller (opens in Ingress Controller docs) |
They ship the same custom resources and the same Gateway API version, so the resource workflows are shared; which one you install is decided by the gateway you run. See Which one am I using? (opens in Ingress Controller docs) and Compatibility (opens in Ingress Controller docs).
Key concepts
These core concepts run through the API7 Enterprise documentation:
- Service: A logical API configuration that groups routes, upstream targets, and plugins.
- Gateway group: A logical grouping of data plane instances that share the same configuration. Use gateway groups to separate environments (e.g., staging, production).
- Consumer: An API consumer identity used for authentication and authorization. Consumers can have credentials and per-consumer plugin configurations.
- Plugin: A reusable module that intercepts the request/response lifecycle to handle tasks like authentication, rate limiting, and observability.
- ADC (API Declarative CLI): A tool for managing gateway configurations through declarative YAML files, enabling GitOps workflows.
Control plane and data plane architecture
API7 Enterprise uses a decoupled architecture, so the two planes are deployed and scaled separately.
- Control plane (CP): The central management point where administrators define policies and manage configurations. It stores data in a PostgreSQL database.
- Data plane (DP): The high-performance traffic proxy that handles API requests. DP nodes are stateless and receive real-time updates from the CP over mTLS.
This design ensures that even if the control plane is temporarily unavailable, the data plane continues to operate and proxy traffic without interruption.
Related
Tasks that use this concept
- Quick Start: Deploy API7 Gateway and proxy your first request.
- Configure and Manage APIs: Explore the full range of API management capabilities.
- Tutorial: Proxying and Managing API Requests via Plugins: apply plugins to a proxied route.
Related concepts
- Security and Compliance: Learn about the security features available in API7 Enterprise.