Open Source Licenses
API7 Gateway's commitment to open-source software and license compliance. Review the major open-source components used and their respective licenses.
API7 Gateway is built on the foundation of the Apache APISIX open-source project and incorporates various other open-source components. API7.ai is committed to license compliance and transparency, and the record below states which software the product is built from and under which licenses.
Key open source components
API7 Gateway uses several major open-source projects, each governed by its own license.
| Component | License | Purpose |
|---|---|---|
| Apache APISIX | Apache 2.0 | Core data plane engine and plugin system. |
| OpenResty / Nginx | BSD | High-performance HTTP and reverse proxy server embedded in the data plane. |
| LuaJIT | MIT | Just-in-time compiler for the Lua language used in plugins. |
| PostgreSQL | PostgreSQL License | Primary storage backend for the control plane. |
| kine | Apache 2.0 | etcd-compatible shim that translates the etcd v3 API to PostgreSQL for the DP Manager. |
| Ladon | Apache 2.0 | Policy engine used to evaluate permission policies. |
License compliance
API7.ai ensures that all open-source components used within its enterprise products are used in accordance with their respective licenses. This includes:
- Attribution: Providing credit to the original authors where required.
- Redistribution: Adhering to the terms for redistributing original or modified source code.
- Patent Retention: Respecting patent clauses included in modern licenses like Apache 2.0.
SBOM (Software Bill of Materials)
For enterprise customers with rigorous compliance requirements, API7.ai can provide a Software Bill of Materials (SBOM) for each release. An SBOM is a formal, machine-readable record of all components, versions, and licenses contained within the API7 container images. To request an SBOM for a specific API7 Enterprise release, contact your API7 account manager or sales@api7.ai.
Next steps
- Review the Trust Center for additional compliance information.
- Review Vulnerability Scanning practices for these components.