Learn
AWS
Networking & content delivery
API Gateway

AWSGCP laterAzure later

API GatewayAmazon API Gateway

Networking & content deliveryCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

A managed front door for APIs: REST, HTTP and WebSocket APIs that take each call, check who is calling, throttle it, and pass it to Lambda, another service or any HTTP backend.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDDeveloper – AssociateHIGHSysOps Administrator – AssociateMEDSecurity – SpecialtyMED

Where API Gateway takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

The front door to your backend

Amazon API Gateway creates, publishes and secures APIs at any scale. It is the front door: it accepts the calls, handles authorization, throttling and monitoring, and passes each call to a backend such as a Lambda function, another AWS service, or an HTTP endpoint.

Three kinds of API. REST APIs have the most features: API keys, per-client throttling, request validation, caching, WAF and private endpoints. HTTP APIs have fewer features and a lower price. WebSocket APIs hold a two-way connection open, so the backend can push messages to clients.

Reach for it when

a web or mobile app needs an HTTPS API in front of Lambda functions
each partner needs its own key, rate limit and monthly quota
a chat or live feed must push messages to connected clients
an API must be reachable only from inside a VPC

It is the wrong tool when

a request takes minutes to finish: make it asynchronous, since the REST timeout is 29 seconds by default
you only need to spread traffic over instances: that is a load balancer

Mental model

A hotel's reception desk

A hotel's reception desk. Every guest's request comes to the desk first: the receptionist checks the room key, turns away anyone asking too often, answers common questions from a card on the counter, and passes the rest to the right department. Some guests keep a phone line open, so the desk can call them back.

The reception deskthe single entry point for every callAPI Gateway

Checking the room keydeciding who may callAuthorizer

Turning away frequent askerslimiting request ratesThrottling

The card of common answersresponses kept for a whileStage cache

The right departmentthe service that does the workIntegration

The open phone linea connection the backend can push toWebSocket API

How it works

Type, routes, protection, stage

Choose the API typeREST for the full feature set, HTTP for a lower price with fewer features, WebSocket for two-way messages.
Define routes and integrationsEach method or route passes to a Lambda function, an AWS service, an HTTP endpoint, or a private resource in a VPC.
Protect itIAM, Lambda authorizers or Cognito decide who may call; usage plans and throttling decide how often.
Deploy to a stageA stage such as prod has its own URL and settings and, on a REST API, an optional cache.

Account throttle: 10,000 requests/sper Region, with bursts of 5,000
When throttled: 429Too Many Requests
REST integration timeout: 29 secondsraisable on Regional and private APIs
HTTP API timeout: 30 secondsat most
Payload: 10 MBREST and HTTP APIs
WebSocket connection: 2 hoursand 10 minutes when idle

Authorizer
Does the Lambda authorizer or Cognito user pool accept the caller? No token means 401; a Deny policy means 403.
Throttling
Is the client within its usage plan's rate, and the account within its Regional limit? Otherwise, 429 Too Many Requests.
Stage cache
On a REST API with caching on, is a cached response still within its TTL, 300 seconds by default?
Integration
The backend must answer within the integration timeout, 29 seconds by default on a REST API.

Pick a case to follow the call through each check.

Architecture

A serverless API that also pushes

The app signs in, calls the REST API with its token, and keeps a WebSocket open so the functions can push order updates to it.

Sign in outside, check inside. The app signs in to a Cognito user pool, and the REST API's Cognito authorizer checks the token on every call.

Push instead of polling. The functions send status updates to connected clients through the WebSocket API's @connections API.

Filter first. A WAF web ACL on the REST API blocks common web exploits; an HTTP API could not use WAF.

Security

Who may call, and how often

Who may call. IAM for AWS callers, Cognito user pools for your users, Lambda authorizers for anything custom such as OAuth or SAML tokens, and resource policies for source addresses and VPC endpoints.

API keys are not authentication. AWS warns against using them to control access: a key valid for one API in a usage plan works for every API in that plan.

Throttling is a target, not a wall. Usage plan limits are applied on a best-effort basis; use WAF to manage requests and AWS Budgets to watch costs.

Private APIs can be called only from a VPC, through an interface VPC endpoint.

Cost

How you are charged, not what it costs today

REST and HTTP APIs are charged per million calls received, plus data transfer out; HTTP APIs cost less.

WebSocket APIs are charged for messages, metered in 32 KB units, and for connection minutes.

A REST API cache is charged by the hour for its size, and is not in the free tier.

The free tier covers a million REST calls, a million HTTP calls, a million WebSocket messages and 750,000 connection minutes a month, for the first 12 months.

Prices change, so none are printed here. Check the API Gateway pricing page on aws.amazon.com.

Comparison

REST or HTTP, and which endpoint

Feature	REST API	HTTP API
Price	Higher	Lower
Endpoint types	Edge-optimized, Regional, private	Regional
API keys and per-client throttling	Yes	No
Caching	Yes	No
AWS WAF	Yes	No
JWT authorizers	Through a Lambda authorizer	Built in
Integration timeout	29 s by default, raisable on Regional and private APIs	30 s at most

REST endpoint type	Reached through	Choose it when
Edge-optimized	The nearest CloudFront point of presence	Clients spread around the world; the default
Regional	The Region itself, or your own CloudFront	Callers in one Region, or your own distribution in front
Private	An interface VPC endpoint only	APIs used only inside your network

SAA traps

The phrase in the question, and what it means

push real-time updates to connected clientsA WebSocket API

The backend posts to clients through the @connections API.

a rate limit and monthly quota for each customerUsage plans with API keys

REST APIs only; HTTP APIs have no API keys.

use API keys to authenticate usersNo: IAM, Cognito or a Lambda authorizer

AWS says API keys should not be used to control access.

clients start receiving 429 errorsThrottling

The account default is 10,000 requests a second per Region, with bursts of 5,000.

a backend call through a REST API takes 45 secondsPast the 29-second default

Make it asynchronous, or raise the timeout on a Regional or private API, trading away account throughput.

cache responses to cut calls to the backendStage caching on a REST API

The TTL is 300 seconds by default and 3600 at most; HTTP APIs have no cache.

an API reachable only from inside the VPCA private REST API

It is called through an interface VPC endpoint.

the cheapest API in front of Lambda, with JWT authorizationAn HTTP API

Fewer features, a lower price, and JWT authorizers built in.

protect the API from SQL injectionAWS WAF on a REST API

HTTP APIs cannot use WAF.

authorize callers with a third-party OAuth tokenA Lambda authorizer

It checks the token and returns an IAM policy, which can be cached.

Scenario

Exam style, marked when you answer

A company sells access to its pricing API, backed by Lambda. Each customer must have its own rate limit and monthly quota, requests must be checked for common web exploits, and repeated identical requests should not reach the Lambda function every time. What should a solutions architect use?

Practice

Fill the gap, the way the challenges work

A mobile app needs an HTTPS API in front of Lambda functions. Each partner app gets its own key with a rate limit and monthly quota, and requests are checked against a WAF web ACL. What receives the app's calls?

Mobile app· Partner's mobile appPick a service belowLambda· Handler functions

Quick revision

The night before the exam

What: A managed front door: REST, HTTP and WebSocket APIs.
REST or HTTP: REST: keys, caching, WAF, private. HTTP: cheaper, JWT built in.
Throttling: 10,000 requests a second per Region, burst 5,000, then 429.
Timeouts: REST 29 s by default; HTTP API 30 s at most.
Who may call: IAM, Cognito, Lambda authorizers; never API keys alone.
Caching: REST stages; TTL 300 s by default, 3600 at most.
WebSocket: Push through @connections; 2 hours, 10 minutes idle.
Endpoints: Edge-optimized, Regional, private.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.