canonical: https://jentic.com/apis/amazonaws.com/apigateway

# AWS Amazon API Gateway

Jentic publishes the only available OpenAPI specification for Amazon API Gateway, keeping it validated and agent-ready. Amazon API Gateway is a managed service for creating and operating REST and WebSocket APIs at any scale, fronting AWS Lambda, EC2-hosted services, and any HTTP backend. The control-plane API exposes 120 operations covering REST API definitions, resources, methods, integrations, deployments, stages, custom domain names, API keys, usage plans, authorizers, and documentation parts. Platform teams use it to drive infrastructure-as-code workflows that go beyond what CloudFormation exposes.

## For AI agents

Create and manage REST APIs, resources, methods, integrations, deployments, custom domains, API keys, and usage plans on Amazon API Gateway through 120 operations.

## Scope

Does not handle the runtime traffic or message delivery of deployed APIs - use for control-plane configuration of REST and WebSocket APIs, custom domains, API keys, and usage plans only.

## Capabilities

- Create and version REST APIs with resources, methods, and request and response models
- Wire methods to AWS Lambda, HTTP backends, and AWS service integrations including IAM and Cognito authorisers
- Promote API revisions through stages with stage variables and per-stage caching configuration
- Provision and rotate API keys, group them into usage plans, and attach throttling and quota limits
- Bind custom domain names with ACM certificates and route them to specific API stages
- Author OpenAPI documentation parts inline so generated SDKs and developer portals stay in sync

## Use cases

### Programmatic REST API Provisioning

Platform teams use the API Gateway control plane to provision REST APIs without leaning on CloudFormation for every change. POST /restapis creates a new API, then POST /restapis/{restapi_id}/resources and PUT /restapis/{restapi_id}/resources/{resource_id}/methods/{http_method} build out paths and methods. CreateDeployment publishes the configuration to a named stage where it becomes live.

Example prompt: Call POST /restapis with name=orders-api, then POST /restapis/{id}/resources to create the /orders path, PUT a GET method on it, and POST /restapis/{id}/deployments to publish to the prod stage

### API Key and Usage Plan Management

Product teams that monetise APIs use API Gateway's usage plans to assign per-customer rate limits and quotas. POST /apikeys creates a key, POST /usageplans creates a plan with throttling and quota settings, and POST /usageplans/{usageplan_id}/keys attaches the key to the plan. Customers then send the key in the x-api-key header and API Gateway enforces limits at the edge.

Example prompt: Call POST /apikeys to create a key for customer-acme, POST /usageplans for a tier with 100 rps and 10000 daily quota, then POST /usageplans/{id}/keys to attach

### Custom Domain Name Binding

Marketing and platform teams bind acquired domains to API stages so consumers see api.example.com instead of an AWS-owned URL. POST /domainnames registers the domain with an ACM certificate, then POST /domainnames/{domain_name}/basepathmappings maps a base path to a specific REST API stage. The same domain can host multiple APIs by base path.

Example prompt: Call POST /domainnames with domain=api.example.com and certificateArn from ACM, then POST /domainnames/api.example.com/basepathmappings mapping /v1 to the prod stage of restapi-id

### AI Agent API Operator

An AI agent invoked through Jentic operates API Gateway to provision new APIs in response to a chat or ticket flow. The agent searches Jentic for the create-rest-api and create-deployment operations, executes them with the requested resources and integrations, and returns the resulting invoke URL. Jentic handles SigV4 signing, so the agent only deals with the structured payloads.

Example prompt: Search Jentic for create rest API on API gateway, execute it for the named API, then create resources, methods, and a deployment to a stage in sequence

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /restapis | Create a new REST API |
| GET | /restapis/{restapi_id}/resources | List the resources tree for a REST API |
| POST | /restapis/{restapi_id}/deployments | Create a deployment that publishes the API to a stage |
| POST | /apikeys | Create an API key |
| POST | /usageplans | Create a usage plan with throttling and quota |
| POST | /domainnames | Register a custom domain name with an ACM certificate |
| POST | /restapis/{restapi_id}/authorizers | Create a Lambda, IAM, or Cognito authorizer for an API |

## Key resources

- **REST APIs** — Create, list, update, and delete REST API definitions
- **Resources and Methods** — Build the path tree and HTTP methods that make up an API
- **Integrations** — Wire methods to Lambda, HTTP, or AWS service backends
- **Deployments and Stages** — Promote API revisions through stages with caching and stage variables
- **API Keys** — Create and rotate API keys for client identification
- **Usage Plans** — Group keys with throttling and quota policies for tiered access
- **Domain Names** — Register custom domains with ACM certificates and map them to stages
- **Authorizers** — Configure Lambda, IAM, and Cognito authorizers on methods
- **Documentation** — Author documentation parts that flow into generated SDKs and portals

## Why Jentic

- **Setup:** Wiring Amazon API Gateway by hand means signing every control-plane request with AWS Signature Version 4, resolving the apigateway.{region}.amazonaws.com host, and navigating a very large operation surface. Through Jentic you install once, import Amazon API Gateway from the API Directory, store your AWS access key and secret once, and your agent calls it.
- **Permission scoping:** API Gateway puts the REST API id in the URL path (/restapis/{restapi_id}/resources, /restapis/{restapi_id}/deployments, and similar), so a rule can pin the agent to one REST API and its resources, deployments, and authorizers. You choose the operations it may call, so account-wide actions like creating API keys with POST /apikeys or usage plans with POST /usageplans are not included unless you add them.
- **Credential handling:** Your AWS access key and secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a REST API' or 'create a usage plan with throttling', and Jentic returns the matching API Gateway operation with its input schema so the agent does not have to memorise the whole operation surface.

## Related APIs

- **API Gateway Management API** — Manages runtime aspects of deployed WebSocket APIs, including sending messages back to connected clients
- **AWS Certificate Manager** — Issues SSL certificates required when binding custom domains to API Gateway
- **Cloudflare** — Cloudflare Workers and API Shield offer an alternative API edge platform with built-in WAF and DDoS protection

## FAQ

### Why is there no official OpenAPI spec for Amazon API Gateway?

AWS does not publish an OpenAPI specification for the API Gateway control plane; the official surface is the AWS SDKs and the Smithy model. Jentic generates and maintains this spec so that AI agents and developers can call Amazon API Gateway via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Amazon API Gateway control plane API use?

API Gateway uses AWS Signature Version 4 (SigV4) signed with an IAM access key id and secret access key, optionally with an STS session token. Through Jentic these credentials are stored encrypted in the vault and SigV4 signing is performed server side, so the agent never handles the raw secret access key.

### Can I attach a custom domain to a specific stage with the Amazon API Gateway API?

Yes. POST /domainnames registers the custom domain with an ACM certificate, then POST /domainnames/{domain_name}/basepathmappings creates a mapping that routes a base path to a specific REST API id and stage. The same domain can host multiple APIs by giving each one a distinct base path.

### What are the rate limits for the Amazon API Gateway control plane API?

API Gateway throttles control-plane operations per region; create and update operations like CreateRestApi and PutMethod have lower per-second limits than read operations like GetRestApis and GetResources. Throttling errors should be retried with exponential backoff. Data-plane request limits apply separately on the deployed APIs themselves.

### How do I create a REST API with the Amazon API Gateway API through Jentic?

Install the SDK with pip install jentic, search Jentic for create rest API on API gateway, load the CreateRestApi operation schema, and execute it with a name and description. Jentic handles SigV4 signing and returns the new restapi_id, which you can then use to create resources, methods, and deployments.

### Can I import an OpenAPI definition with the Amazon API Gateway API?

Yes. PUT /restapis/{restapi_id}#mode=import with an OpenAPI 2.0 or 3.0 document in the request body imports the definition into an existing API; POST /restapis with the body and mode=import creates a new API from an OpenAPI document. The same flow is used by the AWS Console import feature.

### Can I limit what my agent is allowed to do with the Amazon API Gateway API?

Yes. Because you run Jentic One yourself, you decide which API Gateway operations the agent may call and which AWS credentials it uses. Since the REST API id sits in the path (for example /restapis/{restapi_id}/resources and /restapis/{restapi_id}/deployments), your own rules can pin the agent to a single REST API and its resources, deployments, and authorizers. Account-wide operations such as creating API keys with POST /apikeys or usage plans with POST /usageplans stay off limits unless you explicitly grant them.