What is Amazon API Gateway?
Amazon API Gateway is a regional AWS service that publishes APIs at scale. You define routes (REST/HTTP) or routes and connections (WebSocket), attach integrations that run your code or call backends, and deploy to stages such as dev, staging, and prod. It integrates natively with AWS Lambda, Application Load Balancer, HTTP endpoints, and AWS services (for example DynamoDB via direct integration in supported designs).
REST API vs HTTP API vs WebSocket API
| API type | Best for | Notes |
|---|
| HTTP API | New public APIs, Lambda backends, JWT authorizers | Lower latency and cost for many workloads; fewer legacy knobs than REST. |
| REST API | Usage plans & API keys, request validation, private integrations | Broadest feature surface; use when you need a specific capability. |
| WebSocket API | Stateful bidirectional streams, collaboration, fan-out | Routes and integrations differ from HTTP; manage connection lifecycle explicitly. |
Integration patterns
Lambda proxy integration
The most common pattern maps an entire method to one Lambda. The function receives a normalized event (path, query, headers, body) and returns status code, headers, and body—ideal for BFFs and micro-APIs.
HTTP proxy and private integrations
Forward requests to existing HTTP services or to resources inside a VPC via VPC link (Network Load Balancer). Essential for strangling monoliths or connecting to private microservices without exposing them publicly.
Mock integrations
Return fixed responses for health checks, contract testing, or gradual rollouts while backends catch up—useful in simulation and canary planning.
Security and access control
API Gateway supports IAM signing (SigV4) for machine-to-machine calls, Amazon Cognito user pools or JWT authorizers for OAuth/OIDC flows, and Lambda authorizers for custom token or policy logic. Combine with resource policies to restrict invokers by IP or account. For public internet exposure, always terminate TLS at the edge and avoid embedding secrets in client apps—prefer short-lived tokens.
Throttling, quotas, and reliability
Each stage can enforce rate and burst limits. Usage plans tie API keys to quotas for partners or tiers. In practice, Lambda concurrency, downstream database connection pools, or NLB targets often limit throughput before API Gateway does—capacity planning should include end-to-end chains, not just API limits.
Observability
Enable access logging to capture request identifiers, latency, and integration status. Use Amazon CloudWatch metrics for 4xx/5xx, integration latency, and cache hits. For distributed traces, integrate with AWS X-Ray where supported so you can see API Gateway alongside Lambda and downstream calls.
Pricing signals
Billing typically includes API calls, optional data transfer, and—for REST APIs—caching if enabled. HTTP APIs often reduce cost for high-volume Lambda-backed APIs. WebSocket charges include message volume and connection minutes. Treat pricing as a function of call volume × regions × caching—model growth scenarios before committing to cache tiers or multi-region patterns.
How Pinpole fits
Pinpole helps teams visualize API Gateway alongside Lambda, VPC links, and data stores, then simulate traffic and configuration choices to surface latency and failure modes before deployment. Use this page as reference architecture context; map your own routes and stages in the canvas to stress-test assumptions.