Ming Wen, Chairman of Apache APISIX, recently posted a blog about data-driven analysis of API gateway adoption on LinkedIn. The analysis uses two methods: internet-wide scans (FOFA) to identify publicly exposed API gateway instances and company adoption data (BuiltWith) to reveal which businesses are using them.
Key Takeaways
Internet-wide scans give us a broad view of API gateway deployment but may be influenced by large-scale deployments from a few organizations.
Company-based data from sources like BuiltWith helps us understand which businesses use specific API gateways, adding context to raw adoption numbers.
Different API gateways have varying levels of adoption across industries and regions, suggesting that market preferences play a role in selection.
Combining multiple data sources provides a more balanced perspective on API gateway adoption trends.
Introduction
API gateways play a crucial role in modern software architecture, acting as a control point for routing, security, and performance optimization. With a variety of options available, engineers often consider adoption rates as a key factor when selecting an API gateway. While reports from firms like Gartner and G2 provide valuable insights, they rely on surveys and curated datasets, which may be influenced by vendor-driven narratives. Instead, I wanted to explore a more data-driven, large-sample, and manipulation-resistant method to analyze API gateway adoption rates.
Measuring API Gateway Adoption with Internet-Wide Scans
To find a more objective measure, I turned to internet-wide scanning techniques that reveal API gateways publicly exposed on the internet. Most API gateways are designed to expose services to external consumers, making them discoverable via network scanning tools. I initially explored both FOFA and Shodan as internet search engines but found FOFA’s dataset to be more comprehensive for this analysis.
By querying FOFA for public-facing instances of Kong, Apache APISIX, WSO2, and Traefik as of early February 2025, I obtained the following results:
As of early February 2025, Kong API Gateway had 345,000 deployments, Apache APISIX had 147,000, while WSO2 and Traefik had 14,000 and 2,700, respectively.
These results provide a broad sample size and offer a high-level perspective on API gateway adoption. However, there are potential biases: a single organization deploying thousands of nodes could skew the data, and this method does not reveal which companies are using a particular API gateway. If smaller companies dominate the dataset, the practical implications for enterprise adoption may be limited.
A Different Perspective: Identifying API Gateway Usage by Companies
To complement the internet-wide scan, I analyzed API gateway adoption from a company-centric perspective using BuiltWith, a service that tracks technology adoption across websites. BuiltWith allows us to see which companies use specific API gateways rather than just counting exposed nodes. I searched for Kong, Apache APISIX, and KrakenD but could not find data on other API gateways. If anyone has insights into other sources, I’d be happy to update this analysis.
Here are the BuiltWith results:
Based on BuiltWith data, in early February 2025, 37,000 companies were using Kong API Gateway, 5,200 companies were using Apache APISIX, and 2,000 companies were using KrakenD.
Most companies using Kong are based in the United States, KrakenD is primarily adopted in Europe, while Apache APISIX has adopters distributed across the United States and China.
These results provide a different view—one that highlights enterprise adoption trends across different regions and industries. By examining this data, we can infer not just overall adoption but also sector-specific preferences for API gateways.