API Umbrella is an MIT-licensed, Ruby-based open source API management platform that runs as a layer above existing web service APIs so that access control, rate limiting, analytics, and unified documentation are handled by the platform instead of by each individual API's code.

What it is

API Umbrella is an open source API management platform for exposing web service APIs, released under the MIT license and developed primarily in Ruby. It lives in the API gateway and API management ecosystem, and its traffic-handling layer is built on the OpenResty stack — nginx with Lua and LuaJIT, as reflected in the repository topics api-gateway, api-management, api-manager, lua, luajit, nginx, and openresty. Rather than living inside an application, it sits in front of APIs as a proxy and gateway, which is what allows it to add behaviour without the API being modified.

The concrete problem it solves is duplication and fragmentation. Without a layer of this kind, every API reimplements the boring parts: access control, rate limiting, and analytics each get written again inside each service, each service issues its own credentials, and each service documents itself separately. API Umbrella takes over that common functionality so that an API "can assume the boring stuff is already taken care of" whenever a request arrives through the gateway. It also addresses fragmented API offerings, letting APIs that run on different servers or are written in different programming languages be presented as one cohesive product at a single endpoint, reached with the same API key credentials and documented in a single place in a similar fashion.

Key capabilities

• Acts as a gateway and reverse proxy above existing APIs, so API code does not need to be modified to gain platform features.
• Centralizes access control across every registered API, so all APIs can be reached with the same API key credentials.
• Applies rate limiting at the platform layer rather than requiring each API to implement it.
• Collects API analytics as a built-in platform function instead of per-service instrumentation.
• Unifies disparate APIs — different servers, different languages — behind a single endpoint for the API consumer.
• Standardizes documentation by publishing all APIs in one place and in a consistent format.
• Ships documented onboarding paths: a getting started tutorial and a separate development setup guide for working on the codebase itself.

Who uses it and how

• api.data.gov is listed in the README as a deployment, showing the platform used to front a public API programme.
• The NREL Developer Network at developer.nrel.gov is listed as a deployment; the repository itself lives under the NREL GitHub organization.
• api.sam.gov is listed as a deployment.
• Organizations that expose several APIs written in different languages or hosted on different servers use it to present them as one offering at a single endpoint under one key.
• Teams that want rate limiting, access control, and analytics without touching the code of each service use it as an added layer above their existing APIs.

Getting started

The README points to the getting started tutorial at api-umbrella.readthedocs.org/en/latest/getting-started.html, with a separate development setup guide at api-umbrella.readthedocs.org/en/latest/developer/dev-setup.html for working on the code itself. The facts do not name an install package, Docker image, or compose file.

How it compares

The facts provided name no comparable tools, so there is nothing here to set it against by name. It stands alone in this registry as the only entry of its kind described.

When to use it — and when not to

A self-hoster must run and maintain the OpenResty serving stack — nginx with Lua and LuaJIT — alongside the Ruby application components, and the facts do not describe any further operational dependencies, so the running infrastructure should be confirmed from the project's own documentation before committing. The repository carries 256 open issues against 2198 stars, which suggests a sizeable maintenance backlog, and the README is short, deferring almost all setup detail to external Read the Docs pages; teams wanting a managed service with vendor support, or unwilling to operate nginx and OpenResty themselves, should look elsewhere. Its most recent push was 2026-08-29, so the project is not dormant.