Cloud Parts

Amazon API Gateway

AWS’s managed API front door: REST, HTTP and WebSocket APIs that authenticate, throttle and route calls to Lambda and other backends.

What it is
API gateways
Type
Managed service on AWS
Made by
Amazon Web Services
License
Proprietary
Facts checked
5 October 2026
Website

What it is

API Gateway gives you an HTTPS endpoint, maps each route (a method plus a path, like POST /orders) to an integration, and handles auth and throttling on the way. Integrations can be a Lambda function, any HTTP URL, a private service behind a VPC link, or an AWS API called directly, such as putting a message on SQS. It comes in three products. REST APIs have the most features: API keys and usage plans, per-client throttling, request validation, caching, AWS WAF and private endpoints. HTTP APIs are leaner and cheaper ($1.00 instead of $3.50 per million requests in US East) and add built-in JWT authorisers. WebSocket APIs keep connections open for up to 2 hours and route each message by a field in its body.

Every request is metered against an account-wide throttle, 10,000 requests per second by default in most regions, using a token bucket with a burst of 5,000. The best-known limit is the integration timeout: 29 seconds for REST and WebSocket APIs and 30 seconds for HTTP APIs. Since June 2024 you can ask AWS to raise it for Regional and private REST APIs, possibly in exchange for a lower throttle quota. Since November 2025 REST APIs of every endpoint type can also stream responses for up to 15 minutes and past the 10 MB payload cap, as long as the stream doesn’t sit idle (5 minutes on Regional and private endpoints, 30 seconds on edge-optimised ones). HTTP and WebSocket APIs stay capped.

Why teams pick it

  • No servers: you pay only for the calls you receive and the data sent out
  • Auth, throttling and usage plans in front of Lambda without writing that code yourself
  • Direct AWS service integrations can write to SQS, Step Functions or DynamoDB with no function in between
  • WebSocket APIs manage the open connections, so your backend only handles messages

Watch out for

  • The 29- or 30-second integration timeout rules out long synchronous calls unless you raise it or stream the response on a REST API
  • Request and response payloads are capped at 10 MB (streamed REST responses excepted), and WebSocket messages at 128 KB
  • REST vs HTTP is a real fork: caching, WAF, API keys and request validation exist only on REST APIs
  • Per-request pricing gets expensive at sustained high volume, where an ALB is often cheaper

Alternatives

What all api gateways have in common →
Cloudflare AI GatewayCommercialA proxy between your application and AI model providers such as OpenAI, Anthropic, Google and Workers AI that logs, caches, rate-limits, retries and bills every call in one place.

How it fits with other technologies

Quick-create an HTTP API in front of a Lambda function · bash

aws apigatewayv2 create-api --name orders \
  --protocol-type HTTP \
  --target arn:aws:lambda:eu-west-1:123456789012:function:orders

aws lambda add-permission --function-name orders \
  --statement-id apigw-invoke --action lambda:InvokeFunction \
  --principal apigateway.amazonaws.com \
  --source-arn "arn:aws:execute-api:eu-west-1:123456789012:a1b2c3d4e5/*"

See it in a real stack

Serverless web app on AWS →
Live model
What you’re watchingPage loads go to CloudFront and are mostly cache hits; misses fetch from S3. API calls go to API Gateway, pass its throttle and run on Lambda, which reads and writes DynamoDB. Watch Lambda add instances, with cold starts in amber, when calls bunch up.
CQRS with a static read sideCommands update PostgreSQL; a Lambda projector rewrites the affected JSON views in S3, and CloudFront serves every read without touching a database.Amazon API GatewayAWS LambdaPostgreSQLAmazon SQSAmazon S3Amazon CloudFront
Where it came from2015–2025

Before 2015, putting an API on the internet meant building far more than the API. Each team wrote its own authorization, access control, traffic limits, monitoring and versioning, and often maintained client SDKs for several languages too. As Jeff Barr put it, the code devoted to that infrastructure “can dwarf the actual implementation of the service”.

AWS launched Amazon API Gateway on 9 July 2015 to take that layer off developers’ hands. You described routes, imported existing Swagger definitions if you had them, and pointed each one at a backend. Paired with Lambda, it let teams build APIs that were “totally server-less”: no machines to run even for the front door. Custom domains were served through CloudFront, and the console could generate JavaScript, iOS and Android SDKs.

The service then split into products for different needs. WebSocket APIs arrived in December 2018 for chat and games. In December 2019 AWS previewed HTTP APIs, a slimmer version for the common case of proxying to Lambda or an HTTP backend, at up to 71% less than REST APIs. More recently, longer timeouts and response streaming were added for generative AI workloads that take more than 29 seconds to answer.

Why it’s built this way

Serve APIs through CloudFront’s edge by default
The original API endpoints ran behind CloudFront, so callers anywhere connected to a nearby edge. In 2017 Regional endpoints were added because callers in the same Region didn’t need the extra hop.
Integrations instead of servers
Each route maps straight to a Lambda function, an HTTP URL or an AWS API call, so a whole backend can exist without any instance to patch or scale.
Import Swagger and generate client SDKs
Mobile and web teams were spending time hand-writing SDKs for every platform. Driving the API from a machine-readable definition let the gateway produce them.
A cheaper, leaner HTTP API alongside REST
Many serverless APIs just proxy to Lambda or an HTTP backend. HTTP APIs leave out API keys, caching and request validation so that common case can be offered for less.

Timeline

  1. 2015

    Amazon API Gateway launches on 9 July for REST APIs

  2. 2017

    Regional endpoints, and VPC Link to reach private backends via an NLB

  3. 2018

    Private APIs inside VPCs; WebSocket APIs arrive in December

  4. 2020

    HTTP APIs, previewed in December 2019, become generally available in March

  5. 2024

    Regional and private REST APIs can raise the 29-second integration timeout

  6. 2025

    REST APIs gain response streaming, with streams up to 15 minutes long

Sources12 · facts checked 5 October 2026

Improve this page on GitHub