Originally announced April 7, 2020 via GlobeNewswire. This article summarises the key capabilities introduced in WSO2 API Manager 3.1 and WSO2 API Microgateway 3.1.
Overview
WSO2 released version 3.1 of its open source API Manager platform in April 2020, targeting three broad themes: expanded support for modern deployment architectures (Kubernetes, microservices, and serverless), stronger API security, and an improved developer experience. The release ships under the Apache License 2.0 and is backed by the WSO2 Subscription service.
WSO2 API Manager is positioned as a full-lifecycle API management platform covering API creation, publishing, consumption, and monitoring. Version 3.1 ships alongside a matching release of WSO2 API Microgateway, its cloud-native, decentralized gateway component aimed at microservices deployments.
WSO2 API Microgateway 3.1
The Microgateway is a lightweight, developer-centric API gateway designed for decentralized deployments alongside microservices. It integrates with WSO2 API Manager for centralized management while running independently at the edge — in Kubernetes clusters, containerized environments, service meshes, and hybrid deployments. WSO2 states it can boot in under one second.
Key additions in version 3.1 include:
- gRPC support: The Microgateway can now expose managed gRPC endpoints, making it suitable for microservices and mobile backends that use the gRPC remote procedure call protocol.
- Runtime language choice: Developers can select either Java or Ballerina (WSO2’s open source networking-oriented language) as the runtime for the Microgateway.
- Improved observability: Enhanced message tracing capabilities give operators better visibility into traffic flowing through the gateway.
- Strengthened authentication: New options include API key-based authentication, combined authentication schemas, and support for multiple JWT issuers.
Extended Support for Kubernetes, Containers, and Serverless
Kubernetes API Operator
WSO2 introduced native Kubernetes support via a Kubernetes API Operator in 2019 — treating API management configuration as a first-class Kubernetes resource. Version 3.1 extends that operator with:
- Support for multiple Docker registries: Docker Hub, Amazon ECR, Google Container Registry, Quay.io, and generic HTTP/HTTPS registries.
- The ability to expose multiple Swagger/OpenAPI definitions as a single API.
- Automatic microgateway deployment from a Swagger definition — intended to reduce time-to-deployment for microservices to minutes.
- Deployment and management of KNative (serverless) applications.
- API management applied to microservices running inside an Istio service mesh.
- Java interceptors for mediation logic when exposing APIs.
- API exposure via a Kubernetes Ingress controller to provide a single ingress point for API traffic.
AWS Lambda Integration
WSO2 API Manager 3.1 adds native AWS Lambda integration, allowing developers to front Lambda functions with managed API endpoints. The integration supports two credential models for invoking Lambda functions:
- Stored AWS credentials configured in the API Manager.
- Temporary credentials supplied by an AWS IAM role.
This makes it straightforward to apply API management policies — rate limiting, security, analytics — to serverless backends without changing the Lambda function itself.
Expanded API Security
API Security Audit Integration with 42Crunch
WSO2 partnered with 42Crunch to develop an open source extension that integrates the 42Crunch API Security Audit tool directly into WSO2 API Manager. The integration scores an API’s OpenAPI/Swagger definition across three dimensions:
- OpenAPI format compliance
- Security posture
- Data validation coverage
The audit report identifies specific lines in the API definition where issues exist, explains how each vulnerability could be exploited, and links to remediation guidance. Developers can edit the API definition using the built-in Swagger Editor inside WSO2 API Manager and immediately re-run the audit to verify the fix.
Enhanced JWT Authentication
WSO2 API Manager has supported JSON Web Tokens (JWT) for OAuth 2.0-secured APIs since an earlier release. Version 3.1 adds three enhancements:
- Backend JWT separation: The backend JWT is decoupled from the client JWT, preventing user information from being forwarded to backend services without explicit consent.
- User claims in backend JWTs: Developers can embed user claims into the JWT passed to the backend service, enabling user-context-aware logic inside the API implementation.
- Multiple JWT issuers: The API gateway can now validate tokens issued by multiple identity providers, allowing organizations to bring their own JWTs from external systems.
These enhancements are particularly relevant for hybrid and distributed API gateway deployments, where reducing round-trips to a central token validation service improves both scalability and operational cost.
Improved Developer Experience
AI-Powered API Recommendations
The API Store (developer portal) in WSO2 API Manager 3.1 gains an AI-powered recommendation engine. Rather than relying solely on keyword search, the system analyses developer behaviour and the application under development to surface APIs that are likely to be relevant — reducing discovery time for developers exploring a large API catalogue.
API Categories
API providers can assign a category to each API from a predefined list managed by the portal administrator. The developer portal then groups APIs by category, providing an alternative to tag-based browsing. Providers no longer need to follow tag naming conventions — they simply select the appropriate category. If no suitable category exists, providers can request that the administrator create one.
API Mocking
Building on the existing API prototyping feature, API mocking in version 3.1 allows developers to define mock response payloads for each response code and content type directly in the API definition. The inline script for payload generation is generated automatically from example values or response schemas in the OpenAPI definition. This lets API testers interact with a realistic simulated API before the actual backend is ready — without requiring a subscription.
Availability and Licensing
WSO2 API Manager 3.1 and WSO2 API Microgateway 3.1 are available as open source software under the Apache License 2.0. Enterprise support is available through WSO2 Subscription, which includes:
- WSO2 Update — continuous delivery of bug fixes, security patches, and performance improvements.
- WSO2 Support — 24×7 technical support.
- Flexible hosting: cloud, on-premises, or hybrid, under unified pricing.
About WSO2
Founded in 2005 and headquartered in Mountain View, CA, WSO2 provides an open source, API-first integration platform. At the time of this release, the company employed over 600 staff across offices in Australia, Brazil, Germany, Sri Lanka, the UK, and the US, and reported that its integration technologies processed over 6 trillion transactions annually for enterprise customers worldwide.
Source: GlobeNewswire press release, April 7, 2020.