What is Amazon API Gateway?
Learn how API Gateway creates, publishes, secures, monitors, and operates HTTP, REST, and WebSocket APIs for AWS and external backends.
What is Amazon API Gateway?
Amazon API Gateway is a managed AWS service for creating, publishing, maintaining, monitoring, and securing REST, HTTP, and WebSocket APIs. It acts as an application front door and routes client traffic to Lambda functions, AWS services, or HTTP backends.
How this topic fits
APIs & integration
Design REST, HTTP, WebSocket, and GraphQL interfaces with explicit contracts, authorization, throttling, and backend integrations.
API Gateway as an application front door
API Gateway receives client connections on an AWS-provided or custom domain, matches routes, and forwards requests to configured integrations. The backend can be serverless compute, an AWS service API, a private resource, or another HTTP endpoint.
Keeping the public interface separate from the backend allows teams to evolve integration details while maintaining a deliberate client contract. It also creates one place for common traffic, identity, logging, and deployment controls.
A streamlined option for HTTP routes, JWT or IAM authorization, and common Lambda or HTTP integrations.
A broader feature set for REST interfaces that need additional transformation, policy, caching, or deployment capabilities.
Persistent, full-duplex connections that route messages for real-time application interactions.
Routes, stages, and integrations
A route combines an HTTP method or WebSocket route key with an integration. Stages provide deployment and configuration boundaries, while mappings can transform selected request or response data when the contract requires it.
Prefer transparent proxy-style integrations when the backend owns the application contract. Use transformations deliberately when they create a stable boundary rather than distributing business logic across configuration that is difficult to test.
Access control and traffic management
API Gateway can work with IAM authorization, JWT authorizers, Amazon Cognito, Lambda authorizers, resource policies, and network controls depending on API type and audience. Authentication identifies a principal; application authorization still decides which business action that principal may perform.
Throttling, quotas, request validation, AWS WAF integration, and payload limits help protect the backend, but they do not replace workload-specific abuse controls. Define expected traffic and failure behavior before selecting defaults.
Deploy and operate API Gateway
Define APIs as infrastructure as code so routes, integrations, domains, authorization, and logging can be reviewed together. Use controlled stages or release strategies and test the generated public contract before shifting traffic.
Enable useful access logs and metrics for latency, integration latency, client errors, server errors, and throttling. Correlate a gateway request with backend logs and traces so operators can follow one customer operation across the full path.
Go deeper with AWS
Read the primary AWS documentation behind the service definitions and architecture guidance in this guide.
Next steps
Continue with the concepts that most directly shape this decision.
What is a serverless API?
Understand the request path, authentication, routing, compute, data, throttling, observability, and failure controls behind a serverless API on AWS.
Serverless identity with Cognito
Learn user pools, identity pools, tokens, federation, API authorization, tenant boundaries, and secure identity flows for web and mobile applications.
What is AWS Lambda?
Understand how AWS Lambda runs code, how functions are invoked, where permissions and state live, and when Lambda is a good compute choice.
Questions about this topic
Browse all serverless concepts
Explore compute, APIs, events, workflows, data, security, reliability, operations, delivery, and AI from one connected AWS serverless learning path.
What is serverless?
Learn what serverless computing means, how it works on AWS, what the cloud provider manages, and which trade-offs still belong to your team.
What is AWS Lambda?
Understand how AWS Lambda runs code, how functions are invoked, where permissions and state live, and when Lambda is a good compute choice.
What is serverless architecture?
Learn how managed compute, APIs, events, queues, workflows, data, identity, and observability fit together in a serverless architecture on AWS.
AWS serverless security
A practical guide to identity, least privilege, event validation, secrets, data protection, dependencies, and incident visibility in AWS serverless systems.
What is agentic AI?
Learn what makes an AI system agentic, how models, tools, memory, orchestration, identity, and evaluation fit together, and where serverless patterns help on AWS.
What is cloud computing?
Understand how on-demand infrastructure and managed services change the way teams provision, scale, pay for, and operate software systems.
What is event-driven architecture?
Learn how producers, routers, and consumers communicate through events, and how to design schemas, delivery, retries, and ownership deliberately.
What is a serverless API?
Understand the request path, authentication, routing, compute, data, throttling, observability, and failure controls behind a serverless API on AWS.
What are serverless workflows?
Learn when explicit workflow state improves retries, branching, parallel work, human approval, visibility, and recovery in distributed applications.
What is Amazon API Gateway?
Learn how API Gateway creates, publishes, secures, monitors, and operates HTTP, REST, and WebSocket APIs for AWS and external backends.
What is Amazon EventBridge?
Understand EventBridge event buses, rules, pipes, schemas, targets, schedules, permissions, delivery, and recovery in event-driven AWS systems.
Make the next serverless decision explicit.
Explore focused products for repeatable work, or bring the architecture decision that needs context and experienced review.