Gravitee

Gravitee.io is an open-source API management platform from GraviteeSource, combining a high-performance API Gateway, full-lifecycle API Management, Access Management (IAM), Cockpit (multi-environment control plane), an Alert Engine, a Kubernetes Operator, and a new AI Agent Management suite with native MCP and LLM-proxy capabilities. The core projects are Apache 2.0 OSS, with an Enterprise commercial offering and a managed Gravitee Cloud SaaS. The platform supports synchronous and asynchronous APIs across REST, GraphQL, WebSocket, gRPC, SSE, Webhooks, Kafka, MQTT, AMQP, and Model Context Protocol (MCP).

Gravitee publishes 121 API contracts indexed on the APIs.io network, including Alerts API, Analytics API, API Products API, and 118 more. Tagged areas include API Gateway, API Management, Identity and Access Management, Identity, and Event-Driven.

The Gravitee catalog on APIs.io includes 1 JSON-LD context and 2 Spectral governance rulesets.

Gravitee’s developer surface includes CLI, API reference, signup flow, authentication, documentation, getting-started guide, engineering blog, and 44 more developer resources.

🌐 Visit website 📡 Profile data on GitHub

65.2/100 strong ▬ flat Agent 30/100 agent ready Front door AI 6/6 dominant Heartbeat 96/100 alive open core · Apache-2.0 Full breakdown ↓
scored 2026-11-06 · rubric v0.27.0 · Show this score on your site →

AccessFreemiumSelf serve⚡ Free to try

3 published contracts 1 MCP Servers 3 Agent Skills

API Gateway API Management Identity and Access Management Identity Event-DrivenKafka GatewayKafka MQTT GraphQL gRPC AI Gateway MCP A2A LLM ProxyMulti-Gateway FederationDeveloper Portal Open Source Apache 2.0

What this lets a business do 4

Business capabilities this provider's published APIs can perform, derived from its own contracts. Browse all capabilities →

Cybersecurity Management

BC-620

Authentication Device NotifierGroup MembershipsPassword PolicyRolesapplicationauthorization engine

POST /organizations/{orgId}/environments/{envId}/configuration/groups/{group}/members

Developer Platform & API Ecosystem Management

BC-4270

API DefinitionAPI KeysAPI PagesAPI PlansAPI SubscriptionsAPIs

POST /environments/{envId}/apis POST /environments/{envId}/apis/{apiId}/_deploy POST /organizations/{orgId}/environments/{envId}/portal/pages POST /organizations/{orgId}/environments/{envId}/applications/{application}/subscriptions

SaaS Platform Operations Management

BC-4220

API HealthGatewayLogsPlatform AlertsPlatform Logs

GET /organizations/{orgId}/environments/{envId}/instances/{instance}/monitoring/{gatewayId} GET /organizations/{orgId}/environments/{envId}/platform/alerts POST /organizations/{orgId}/environments/{envId}/platform/alerts GET /organizations/{orgId}/environments/{envId}/platform/logs

Application Identity & Verification

AE-160

bot detection

Kin Score

Kin Score How this is scored →
scored 2026-11-06 · rubric v0.27.0

Composite quality — 65.2/100 · strong

Contract Quality 8.3 / 16

Developer Ergonomics 8.9 / 13

Access Clarity 11.1 / 13

Operational Transparency 3.1 / 8

Contract Governance 3.0 / 8

Discoverability 5.2 / 7

Regulatory Posture 3.5 / 15

Open Source Surface 5.0 / 10

Create-or-Update Ergonomics 5.0 / 10

Agent readiness — 30/100 · agent ready

Machine-Readable Contract 18 / 18

Agentic Access Contract 10 / 10

Documented Reversibility 6 / 6

MCP Server 0 / 12

Machine-Readable Auth 10 / 10

Idempotency 0 / 9

Stable Error Semantics 8 / 8

Request/Response Examples 7 / 7

Rate-Limit Signaling 7 / 7

Typed Event Surface 0 / 6

Agent Skills 5 / 5

Well-Known Catalog 0 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 8 / 8

Dry-Run / Simulate Mode 4 / 4

Delegated User Identity 0 / 6

Protected Resource Metadata 5 / 5

Registration Without a Human 0 / 6

Agentic Commerce Well-Known Document 0 / 5

Pagination 0 / 5

Distinct Operations 0 / 3

MCP Tool Quality 6 / 6

Regulatory Posture applies to this provider. Its tags matched the Horizontal (data, software, accessibility, platform) regime, so Regulatory Posture carries 15 points of the composite. If this regime is wrong for your business, say so on your provider repo — the applicability map is public and we will correct it.

Open Source Surface applies to this provider. This product is open source and we read its repository directly, so Open Source Surface carries 10 points of the composite. It is scored from what the repository actually publishes — a security policy, a contribution guide, a release history, a code of conduct — read live from the provider rather than inferred from our own catalog pointers. This facet adds; nothing was taken away to make room for it. An open-source project is not excused from the commercial facets, because exemption would strip it of the points it does earn. If we have the wrong repository, or this product is not open source, say so on your provider repo and we will drop the facet rather than have you publish against it.

Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it carries 10 points of the composite. It is scored from the published contracts themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in front of it, and the first time that check is skipped a duplicate record is created. Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet, not penalised by it.

The six quality facets above are damped to 65 points between them, because both conditional facets apply and carry 35 points together. That is why each facet's contribution is shown against a damped maximum: raising a quality facet moves the composite by 65% of its nominal weight, not 100%. The full arithmetic is at apis.io/rating/.

Show this score on your site.

It updates itself when the score changes. Paste this where you link to your API docs:

<a href="https://apis.io/providers/gravitee/"><img src="https://apis.io/badge/gravitee/card.svg" alt="Gravitee on APIs.io — Kin Score by API Evangelist"></a>

Other styles, a README pill and a shields.io endpoint are on the badge page.

Raise your score.

Agent readiness — checks not met, largest first (exact, from this profile):

MCP Server +12 pts — deployment.mode + probe verdict on the mcp/ manifest, not the pointer; an unprobed slug falls back to authorship
Idempotency +9 pts — OpenAPI mutating operations declare an idempotency key — a header, a request-body property, or a named de-duplication token whose own description says so (verified); else common[].type matches /idempoten/i (documented)
Registration Without a Human +6 pts — a `registration_endpoint` in the served RFC 8414 / OIDC discovery document
Delegated User Identity +6 pts — a served discovery document listing authorization_code in grant_types_supported (served), else an oauth2 authorizationCode flow or openIdConnect declared in an OpenAPI (documented)
Typed Event Surface +6 pts — AsyncAPI document, OR webhooks/callbacks objects in the as-published OpenAPI, OR common[].type includes Webhooks
Pagination +5 pts — share of collection GETs (an array, or one wrapped in data/items/results ...) that declare a page/limit/offset/cursor parameter, a Link header or a next/cursor field; na with no collection GETs

4 more unmet checks in the Agent Readiness table above.

Kin Score — facets with the most composite points still available (weight × headroom):

Contract Quality scores 50.8 — up to +12.3 composite points
Operational Transparency scores 36.8 — up to +8.2 composite points
Contract Governance scores 37.9 — up to +7.5 composite points

Each check links to what satisfies it. Publish the artifact, or tell us where it already lives, and the score moves on the next scoring run.

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. Every facet and dimension name above is a link: it opens that measurement's own page — what it means, the exact checks that feed it, how the whole catalog distributes on it, and the providers at the top of it. This rating is computed from the provider profile at artifacts.apis.io/gravitee/apis.yml: open an issue on github.com/api-evangelist/gravitee to ask a question or point us at an artifact you publish. Submit an artifact on GitHub — free → Manage your own listing — the Influence plan, $499/mo →

Gravitee is an area vendor: providers adopt it to run part of their developer surface. This is the Kin Score checks its features can move for a provider that adopts it, what each one really earns, and what it earns nothing for.

api gatewaycapability map5 features checked 2026-09-25 · rubric v0.22.0

Gravitee reaches further into agent auth than the other gateways, but only through Access Management: a provider running AM serves an OIDC discovery document that advertises authorization_code and a registration_endpoint, which can earn auth_clarity served, delegated_identity served and dynamic_client_registration — conditional because AM scopes discovery under /{domain}/oidc/, not the host root. On API Management it earns the portal set once declared, and the MCP entrypoint serves OpenAPI-generated tools on the provider’s own gateway (templated, 0.6). Its rate-limit headers are off by default and named X-Rate-Limit-*, a spelling score.rb’s /\A(x-)?ratelimit/ header test does not match.

Access Clarity13.0 of 38 pts

Agent Readiness31.7 of 139 pts

Developer Ergonomics11.0 of 42 pts

Check	Earns	Through
MCP Servertemplated Agent ReadinessTools are generated from the provider’s own OpenAPI and served by the provider’s gateway at the API’s /mcp path — `templated` (0.6); `verified` only when the catalog probe of the provider’s mcp/ manifest passes. Edition not stated on the fetched page.	7.2 of 12	MCP entrypoint — Generate Tools from OpenAPI
Rate-Limit Signalingpartial Agent Readiness`verified` reads response headers declared in the provider’s OpenAPI, matched by score.rb’s /\A(x-)?ratelimit\|\Aretry-after\z/i. Gravitee’s X-Rate-Limit-* spelling does NOT match that pattern (the hyphen after “rate” breaks it); only the Retry-After it adds…	3.5 of 7	addHeaders option (X-Rate-Limit-Limit / -Remaining / -Reset)
Self-service sign-up Access ClarityAllow consumer sign-up and declare the page as SignUp or Login in apis.yml common[].	5.0 of 5	Developer Portal
Developer portal Developer ErgonomicsDeclare the portal URL as a DeveloperPortal entry in apis.yml common[].	4.0 of 4	Developer Portal
Documentationsaturated Developer Ergonomics95% of providers with a contract, docs and a reference already earn this; the vendor cannot move it for most of its buyers.	4.0 of 4	Developer Portal
Console or sandbox Developer ErgonomicsDeclare the portal’s endpoint-testing view as a Console entry in apis.yml common[].	3.0 of 3	Developer Portal
Machine-Readable Authconditional Agent ReadinessOnly if the provider runs AM on its own host and the catalog’s discovery probe reaches AM’s path-scoped document (/{domain}/oidc/.well-known/openid-configuration) with its `issuer`; a probe of the host root will not find it.	9.0 of 10	Gravitee Access Management — OIDC provider with DCR
Delegated User Identityconditional Agent ReadinessSame discovery-path condition; AM supports the authorization code flow, which the served grade needs listed in grant_types_supported.	6.0 of 6	Gravitee Access Management — OIDC provider with DCR
Registration Without a Humanconditional Agent ReadinessOnly if DCR is enabled in the AM security domain and the discovery document carrying registration_endpoint is reachable by the catalog probe.	6.0 of 6	Gravitee Access Management — OIDC provider with DCR
Plans publishedconditional Access ClarityOnly if the provider’s plans are visible publicly and describe commercial tiers — Gravitee plans are security/access plans (keyless, API key, JWT, OAuth2, mTLS) without prices, and the plans artifact is harvested from public pages.	8.0 of 8	Developer Portal

Across 8977 providers that publish a contract, adopting Gravitee would move 8866. Median lift: composite +4.0 (90th percentile +6.0), agent readiness +5.2 (+7.7). Conditional rows excluded.

What Gravitee ships that earns nothing (2)

Rate Limit, Quota and Spike Arrest policies — Policies enforce limits; the check counts limits the provider publishes in a harvested rate_limits artifact.
Developer Portal — The portal lists access plans, not prices; there is no pricing page to point at.

A model, not a score. Adopting this vendor changes a provider's Kin Score only when the provider publishes the resulting artifacts on its own surface; nothing here writes a score, and no sponsorship or partnership can. The rating is not for sale → · Full vendor facets artifact

Markets this provider is in provisional

The Kin Score Market layer reads a provider inside its market: its position, and how deep its integrations go. Depth is only comparable within a position. Provisional and unweighted: not part of the Kin Score or agent readiness.

Market	Position	Depth	Registered MCP server	Declares compatibility
Streaming (Apache Kafka protocol)	standard	37.9	-	1
API Management (gateways, portals, service mesh, proxies)	standard	37.9	-	1
GraphQL Ecosystem (Foundation, graphql.org listings, public GraphQL APIs)	standard	37.9	-	1
OpenID Certified Implementations (OIDC, FAPI, OpenID4VC)	standard	37.9	-	1
Artifact Hub Cloud-Native Packages	standard	37.9	-	1
Buf Schema Registry (public Protocol Buffers modules, gRPC / ConnectRPC schema publishers)	standard	37.9	-	1

Registered MCP server and declares compatibility are report only — not weighted. Undeclared means we found nothing we can read, so there is no number: we never infer integrations.

Standards implemented 9

Standards this provider implements or carries. De facto ones are profiled and measured by the API Commons; formal ones come from the standards directory and are linked by the provider's own tags. The evidence column says how each claim was established — not that it was made.

Agent2Agent

measured — observed by APIs.io (flavored)

GraphQL