> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Gateway v2 (HTTP/WebSocket)

> API Gateway v2 (HTTP/WebSocket) APIs with Cloud Adapter.

Preview

This page describes how API Gateway v2 (HTTP/WebSocket) maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Azure
* Google Cloud
* OCI

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of API Gateway v2 (HTTP/WebSocket) with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | API Gateway v2 (HTTP/WebSocket) | Azure, Google Cloud, and OCI · Envoy | Azure · Azure API Management | Google Cloud · Google Cloud API Gateway |
| - | - | - | - | - |
| Which APIs are served here | Every API | Every API; the backend an API resolves to unless a managed gateway's rule fits it entirely | An HTTP API whose every integration is HTTP\_PROXY or Lambda proxy; any authorizer kind | Only an API whose every route is JWT without scopes or NONE and whose every integration is HTTP\_PROXY or Lambda proxy |
| Client protocols | HTTP and WebSocket | HTTP routes and worker-owned WebSocket connections | HTTP only; WebSocket APIs are served on Envoy | HTTP only; WebSocket APIs are served on Envoy |
| Lambda proxy integration | Yes | Adapter-served - HTTP payload versions and WebSocket events are distinct | Adapter-served - Through the adapter's ingress, which holds the invocation authority | Adapter-served - Through the adapter's ingress, which holds the invocation authority |
| Caller identity | Protocol-specific authorizers | JWT for HTTP; NONE, AWS\_IAM or REQUEST authorization for WebSocket connect | JWT and NONE decided by API Management; AWS\_IAM and Lambda authorizers decided by the adapter through a policy callout | JWT without scopes, checked by the gateway; NONE |
| Lambda invocation permission | Function policy or integration role | Separate from caller admission and connection-management permission | Held by the adapter's ingress; API Management itself holds no AWS authority | Held by the adapter's ingress; the gateway itself holds no AWS authority |
| Private HTTP integrations | Yes | No - This profile covers Lambda integrations only | Partial - An inbound private endpoint on Standard v2; VPC links are outside this contract | No - The gateway reaches integrations over public URLs |
| Connection recovery | Application reconnects after disconnection | Reconnect and restore application state after socket-owner loss | Not applicable; WebSocket APIs are served on Envoy | Not applicable; WebSocket APIs are served on Envoy |
| API coverage | full | partial (HTTP Lambda proxy requests and WebSocket connections; connection operations use the separate management API.) | partial (HTTP APIs that fit the eligibility rule; the management API is served for every API.) | partial (HTTP APIs that fit the eligibility rule; the management API is served for every API.) |

## On Azure, Google Cloud, and OCI

### Envoy

| Capability | Area | Support | Operations | Notes |
| - | - | - | - | - |
| HTTP JWT authorizers | - | Adapter-served | - | Checks issuer, audience, signing keys, token times and route scopes; JWT authorization is HTTP-only. |
| HTTP Lambda authorizers | - | Adapter-served | - | Uses the selected event format and simple-response or IAM-policy mode with the configured identity sources and cache keys. |
| HTTP Lambda proxy payloads | - | Adapter-served | - | Select payload format 1.0 or 2.0; event fields, cookies and repeated-header handling depend on that choice. |
| Private WebSocket integrations | - | Out of scope | - | This mapping makes no private WebSocket integration or private frontend equivalence claim. |
| WebSocket restart recovery | - | Partial | - | Clients reconnect and receive new connection identifiers after socket-owner loss; durable application state must live outside the connection. |
| WebSocket route selection | - | Adapter-served | - | Selects connect, disconnect, default and message integrations; REQUEST authorization is applied at connection establishment. |

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DeleteConnection | WebSocket connections | Adapter-served | Common | Disconnects the named connection after ManageConnections authorization; the client must reconnect for another session. |
| GetConnection | WebSocket connections | Adapter-served | Common | Reads connection information through the API/stage management endpoint under the caller's own permission. |
| PostToConnection | WebSocket connections | Adapter-served | Common | Sends bytes to an owned connection after ManageConnections authorization; a gone connection is refused, and acceptance is not client receipt. |

#### HTTP APIs and WebSocket APIs

The Tensor9 service adapter runs your API Gateway v2 APIs on Envoy in the target cluster, and keeps their configuration itself. HTTP APIs route each request by method and path. WebSocket APIs open a connection and then pick an integration for each connection event and message. The protocol you choose when you create the API decides which authorizers, events and integration settings apply.

Management calls save routes, integrations, authorizers, deployments and stages. Envoy handles HTTP traffic, and each accepted WebSocket connection is held by one connection worker. Backend integrations run through their own service adapters; the Lambda service adapter runs functions.

Protocol Request path What is kept while it runs HTTP Request → route and authorization → integration → response Stage configuration and one request WebSocket Connection authorization → connection worker → message integration Connection ID and the open socket

#### HTTP events and authorizers

HTTP Lambda proxy integrations use payload format `1.0` or `2.0`. The choice changes the function's event and response, including cookies and repeated headers. Set it explicitly and use a handler written for that format; a REST proxy handler is not automatically a format `2.0` handler.

For an HTTP JWT authorizer, the adapter checks the configured issuer, audience, signing key, token times and route scopes. Lambda authorizers have separate format `1.0` and `2.0` events. A simple Boolean response and an IAM-policy response are different settings, with different caching and route-policy effects.

`AWS_IAM` uses target-environment credentials and an `execute-api:Invoke` check. Public routes use `NONE`. Backend permission is checked separately: allowing the caller does not let the integration invoke a function. The `AWS_PROXY` type alone does not mean a Lambda integration; other AWS service integration subtypes are not supported.

#### WebSocket connections

Authorization for a WebSocket connection runs on `$connect`, using `NONE`, `AWS_IAM` or a `REQUEST` Lambda authorizer. HTTP JWT authorization does not apply to this handshake. Once accepted, the connection gets an ID and stays with the worker holding its socket. Message routes and `$default` pick integrations using the configured route selection expression.

A connection ID is not a portable session. If its worker stops, clients reconnect, are authorized again and get a new ID. Applications must handle a missed `$disconnect` event and must not rely on it as their only cleanup.

`PostToConnection`, `GetConnection` and `DeleteConnection` use a management endpoint for the API and stage. The application making these calls authenticates separately from the connected client and needs `execute-api:ManageConnections` permission. A connection ID grants no permission by itself. Sending to a closed connection returns a gone response, and an accepted send does not mean the remote application received it.

#### Deployment changes and connectivity

HTTP stages can use explicit deployments or auto-deploy. WebSocket stages need explicit deployments. The adapter saves the API configuration, but saved configuration cannot reopen a socket after its worker is lost.

Changed route policies, integration settings and revoked credentials may not apply at once to WebSocket connections that are already open. For a change that must reach every WebSocket client, disconnect and reconnect those clients after you deploy the stage.

Public client access and private backend access are configured separately. An HTTP VPC link reaches a private HTTP integration; it does not make an HTTP or WebSocket API private. Lambda integrations use the Lambda service adapter and need no VPC link. Private HTTP and WebSocket integrations and AWS endpoint-identity policy conditions are not supported.

#### Limitations

Differences to review before moving an HTTP or WebSocket API

* **HTTP and WebSocket authorizers behave differently.** JWT authorization is for HTTP APIs only. WebSocket `REQUEST` authorization runs when the connection opens; if you need per-message user authorization, check it in your message handlers.
* **Open connections do not survive the loss of their worker.** Clients must reconnect, and your application must restore subscriptions, delivery positions and unfinished work. Moving a live socket and exactly-once message delivery are not supported.
* **You must disconnect clients to revoke access.** A stage deployment does not re-authorize every connected client at once. Disconnect a session explicitly when it must lose access.
* **Other API Gateway products are not supported.** Portal and product publishing, non-Lambda AWS service integration subtypes, private WebSocket integrations and private API endpoints are not part of this mapping.

#### Other considerations

* **Moving from AWS.** Recreate APIs and backend permissions, set up target-environment credentials and certificates, then switch HTTP endpoints or reconnect WebSocket clients. AWS connection IDs cannot reach sockets in the target environment.
* **Who runs what.** Tensor9 maintains the service adapter and how it manages connections. The target platform supplies gateway compute, configuration storage, networking and TLS termination. Allow only the gateway's own components to reach its internal worker and authorization endpoints.
* **Application recovery.** Keep subscription or workflow state in your application, not in the live socket. Give retried messages application-level IDs and acknowledge them in your application when delivery matters.
* **Capacity.** Track concurrent connections, message sizes, slow-client queues and integration concurrency separately. An HTTP request rate does not tell you the capacity needed for long-lived WebSocket connections.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### API Gateway HTTP execution · API execution requests per second

Feature: API Gateway HTTP execution.

Estimated monthly service charges by API execution requests per second. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![API Gateway HTTP execution · API execution requests per second: monthly service charges by API execution requests per second. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/23d95eaf08aa436f336d0862a5b0246ea2ee96ec97a5aa80f8147eb1b7f49057-light.svg)

![API Gateway HTTP execution · API execution requests per second: monthly service charges by API execution requests per second. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/6b98cec66256a3dd2476f38abeeaaadcefc219477b2e2b9509354cc052585ebf-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| API execution requests per second (requests/s) | API Gateway v2 (HTTP/WebSocket) | Target scenario | Envoy | Difference |
| -: | -: | - | -: | -: |
| 0 | 0.00 | Envoy (one copy) | 80.90 | 80.90 |
| 0 | 0.00 | Envoy (two copies) | 161.79 | 161.79 |
| 1 | 2.63 | Envoy (one copy) | 82.10 | 79.47 |
| 1 | 2.63 | Envoy (two copies) | 163.00 | 160.37 |
| 10 | 26.28 | Envoy (one copy) | 92.93 | 66.65 |
| 10 | 26.28 | Envoy (two copies) | 173.82 | 147.54 |
| 100 | 262.80 | Envoy (one copy) | 201.20 | -61.60 |
| 100 | 262.80 | Envoy (two copies) | 282.09 | 19.29 |
| 1,000 | 2,628.00 | Envoy (one copy) | 1,193.89 | -1,434.11 |
| 1,000 | 2,628.00 | Envoy (two copies) | 1,274.78 | -1,353.22 |
| 10,000 | 26,280.00 | Envoy (one copy) | 8,631.04 | -17,648.96 |
| 10,000 | 26,280.00 | Envoy (two copies) | 8,924.63 | -17,355.37 |
| 100,000 | 262,800.00 | Envoy (one copy) | 83,930.65 | -178,869.35 |
| 100,000 | 262,800.00 | Envoy (two copies) | 87,343.66 | -175,456.34 |

Estimated allocation, not benchmark calibrated: sized from 2 vCPU, 8 GiB memory and 100 GiB SSD at 0 requests/s to 96 vCPU, 384 GiB memory and 100 GiB SSD at 100,000 requests/s.

**Curve assumptions**

| Target scenario | Assumption | Value | Unit |
| - | - | -: | - |
| Envoy (one copy) | Origin list price · API execution requests | 0.000001 | USD/Requests |
| Envoy (one copy) | Origin list price · API management requests | 0 | USD/Requests |
| Envoy (one copy) | Proxy requests per vCPU-second | 4,000 | requests/vCPU-second |
| Envoy (one copy) | Target proxy CPU utilization | 0.7 | fraction |
| Envoy (one copy) | Peak / average execution requests | 2 | multiplier |
| Envoy (one copy) | Proxy CPU per replica | 0.5 | vCPU |
| Envoy (one copy) | Proxy RAM per replica | 0.375 | GiB |
| Envoy (one copy) | Minimum allocated proxy replicas | 2 | replicas |
| Envoy (one copy) | Billable response bytes per request | 4,096 | bytes |
| Envoy (one copy) | Target price guess · read | 0 | USD/read |
| Envoy (one copy) | Target price guess · write | 0 | USD/write |
| Envoy (one copy) | Target price guess · provider operation | 0 | USD/provider operation |
| Envoy (one copy) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Envoy (one copy) | Target price guess · published GiB | 0 | USD/published GiB |
| Envoy (one copy) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Envoy (one copy) | Target list price · network GiB | 0.12 | USD/network GiB |
| Envoy (one copy) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Envoy (one copy) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Envoy (one copy) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Envoy (one copy) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Envoy (one copy) | Target price guess · resource-month | 0 | USD/resource-month |
| Envoy (one copy) | Target price guess · input token | 0 | USD/input token |
| Envoy (one copy) | Target price guess · output token | 0 | USD/output token |
| Envoy (one copy) | Target monthly base charge | 0 | USD/month |
| Envoy (one copy) | Approximate target service minimum | 0 | USD/month |
| Envoy (one copy) | Minimum primary CPU | 2 | vCPU |
| Envoy (one copy) | Minimum primary RAM | 8 | GiB |
| Envoy (one copy) | Minimum primary disk | 100 | GiB |
| Envoy (one copy) | Additional full-price standby copy | 0 | 0 or 1 |
| Envoy (one copy) | Allocated share of provisioned cost | 1 | fraction |
| Envoy (one copy) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Envoy (one copy) | Planning peak / mean work | 2 | multiplier |
| Envoy (one copy) | Planning primary CPU utilization | 0.7 | fraction |
| Envoy (one copy) | Resident state reserved in RAM | 0.1 | fraction |
| Envoy (one copy) | Planning disk utilization | 0.8 | fraction |
| Envoy (one copy) | Maintenance and log disk reserve | 20 | GiB |
| Envoy (one copy) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Envoy (one copy) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Envoy (one copy) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Envoy (one copy) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Envoy (one copy) | Dependent object sink write price guess | 0.000005 | USD/write |
| Envoy (two copies) | Origin list price · API execution requests | 0.000001 | USD/Requests |
| Envoy (two copies) | Origin list price · API management requests | 0 | USD/Requests |
| Envoy (two copies) | Proxy requests per vCPU-second | 4,000 | requests/vCPU-second |
| Envoy (two copies) | Target proxy CPU utilization | 0.7 | fraction |
| Envoy (two copies) | Peak / average execution requests | 2 | multiplier |
| Envoy (two copies) | Proxy CPU per replica | 0.5 | vCPU |
| Envoy (two copies) | Proxy RAM per replica | 0.375 | GiB |
| Envoy (two copies) | Minimum allocated proxy replicas | 2 | replicas |
| Envoy (two copies) | Billable response bytes per request | 4,096 | bytes |
| Envoy (two copies) | Target price guess · read | 0 | USD/read |
| Envoy (two copies) | Target price guess · write | 0 | USD/write |
| Envoy (two copies) | Target price guess · provider operation | 0 | USD/provider operation |
| Envoy (two copies) | Target list price · GiB-month | 0.1 | USD/GiB-month |
| Envoy (two copies) | Target price guess · published GiB | 0 | USD/published GiB |
| Envoy (two copies) | Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Envoy (two copies) | Target list price · network GiB | 0.12 | USD/network GiB |
| Envoy (two copies) | Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Envoy (two copies) | Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Envoy (two copies) | Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Envoy (two copies) | Target price guess · resource-hour | 0 | USD/resource-hour |
| Envoy (two copies) | Target price guess · resource-month | 0 | USD/resource-month |
| Envoy (two copies) | Target price guess · input token | 0 | USD/input token |
| Envoy (two copies) | Target price guess · output token | 0 | USD/output token |
| Envoy (two copies) | Target monthly base charge | 0 | USD/month |
| Envoy (two copies) | Approximate target service minimum | 0 | USD/month |
| Envoy (two copies) | Minimum primary CPU | 2 | vCPU |
| Envoy (two copies) | Minimum primary RAM | 8 | GiB |
| Envoy (two copies) | Minimum primary disk | 100 | GiB |
| Envoy (two copies) | Additional full-price standby copy | 1 | 0 or 1 |
| Envoy (two copies) | Allocated share of provisioned cost | 1 | fraction |
| Envoy (two copies) | Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Envoy (two copies) | Planning peak / mean work | 2 | multiplier |
| Envoy (two copies) | Planning primary CPU utilization | 0.7 | fraction |
| Envoy (two copies) | Resident state reserved in RAM | 0.1 | fraction |
| Envoy (two copies) | Planning disk utilization | 0.8 | fraction |
| Envoy (two copies) | Maintenance and log disk reserve | 20 | GiB |
| Envoy (two copies) | Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Envoy (two copies) | Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Envoy (two copies) | Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Envoy (two copies) | Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Envoy (two copies) | Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* Whole Envoy replica allocation grows with peak execution requests and selected utilization; the zero-traffic floor remains explicit.
* Native managed gateway backends price execution request meters; Envoy backends price the derived proxy resource-hours. Do not add both execution price paths.
* Self-hosted target: Envoy (Apache-2.0, [https://github.com/envoyproxy/envoy/blob/main/LICENSE](https://github.com/envoyproxy/envoy/blob/main/LICENSE)). Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.
* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.
* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.
* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.
* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.
* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.
* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).
* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.
* The workload family already selected resource-hours; the throughput coefficient is not applied again.
* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.
* AWS Price List API, AmazonApiGateway offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json)
* Amazon API Gateway pricing: [https://aws.amazon.com/api-gateway/pricing/](https://aws.amazon.com/api-gateway/pricing/)
* Compute Engine general-purpose machine pricing: [https://cloud.google.com/products/compute/pricing/general-purpose](https://cloud.google.com/products/compute/pricing/general-purpose)
* Disk and image pricing: [https://cloud.google.com/compute/disks-image-pricing](https://cloud.google.com/compute/disks-image-pricing)
* Network pricing: [https://cloud.google.com/vpc/network-pricing](https://cloud.google.com/vpc/network-pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Upstream Lambda/integration compute, external load balancer, DNS, certificates, cache, logs, custom authorizers and WebSocket connection minutes.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-2750406dd01b489f7c5eaa3e93d2aa5c67e6488c` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AmazonApiGateway offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json), [Amazon API Gateway pricing](https://aws.amazon.com/api-gateway/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

**API Gateway HTTP execution → Envoy: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: API execution requests | 262.80 |
| Origin: API management requests | 0.00 |
| Target: Provisioned primary CPU | 46.15 |
| Target: Provisioned primary RAM | 24.74 |
| Target: Provisioned primary disk | 10.00 |
| Target: Selected billable network | 120.30 |
| Target: Independent provisioned resources | 0.00 |
| Target: Independent managed resources | 0.00 |
| **Origin service subtotal** | **262.80** |
| **Target service subtotal** | **201.20** |

Estimated allocation, not benchmark calibrated: sized at 2 vCPU, 8 GiB memory and 100 GiB SSD for this scenario.

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Upstream Lambda/integration compute, external load balancer, DNS, certificates, cache, logs, custom authorizers and WebSocket connection minutes.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · API execution requests | 0.000001 | USD/Requests |
| Origin list price · API management requests | 0 | USD/Requests |
| Proxy requests per vCPU-second | 4,000 | requests/vCPU-second |
| Target proxy CPU utilization | 0.7 | fraction |
| Peak / average execution requests | 2 | multiplier |
| Proxy CPU per replica | 0.5 | vCPU |
| Proxy RAM per replica | 0.375 | GiB |
| Minimum allocated proxy replicas | 2 | replicas |
| Billable response bytes per request | 4,096 | bytes |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target price guess · provider operation | 0 | USD/provider operation |
| Target list price · GiB-month | 0.1 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.12 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target list price · vCPU-hour | 0.031611 | USD/vCPU-hour |
| Target list price · GiB-hour | 0.004237 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| API execution requests | 262,800,000 | Requests |
| API management requests | 100,000 | Requests |

* Translated reads: 100,000 operations.

* Translated writes: 0 operations.

* Translated resident physical data: 0 GiB-month.

* Native provider operations: 262,800,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 730 vCPU-hour.

* Allocated execution RAM: 547.5 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 1,003 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.

* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.

* Whole Envoy replica allocation grows with peak execution requests and selected utilization; the zero-traffic floor remains explicit.

* Native managed gateway backends price execution request meters; Envoy backends price the derived proxy resource-hours. Do not add both execution price paths.

* Self-hosted target: Envoy (Apache-2.0, [https://github.com/envoyproxy/envoy/blob/main/LICENSE](https://github.com/envoyproxy/envoy/blob/main/LICENSE)). Selected CPU, RAM and physical disk allocation grow with workload; no per-operation price is assumed. No vendor charge: the target runs on the customer's Kubernetes nodes, so CPU, RAM and disk bill at the Kubernetes node reference rates, Compute Engine N2 in us-central1 (USD 0.031611/vCPU-hour, 0.004237/GiB-hour) with pd-balanced disk (0.10/GiB-month) and Premium Tier egress. The cost-optimized E2 series lists 0.02181159/vCPU-hour and 0.00292353/GiB-hour; AWS m6i/r6i and Azure D2s v5/E2s v5 both decompose to 0.033/vCPU-hour and 0.00375/GiB-hour. Requested CPU and RAM are billed; node bin-packing waste, system reservations and the cluster control-plane fee are not.

* Row-store throughput (capacityOpsPerVcpuSecond, default 1500) is measured-by-tensor9 as a lower bound: the DynamoDB adapter on Cloud SQL db-custom-2-7680 (2 vCPU, PostgreSQL 16, us-west1) served 2,974 ops/s of YCSB-A at 16 threads without recorded saturation (src/main/kotlin/t9/prime/equiv/generated/eval/CloudsqlPostgresqlYcsbAT16GoYcsbV1\_0\_0.kt). Published CPU-bound pgbench reaches 3,101 read-write transactions and 20,289 point reads per vCPU-second (AWS z1d.2xlarge, PostgreSQL 14.5), so actual capacity is likely higher. Reads and writes share one coefficient: at the same adapter version, read-only YCSB-C was not faster than 50%-update YCSB-A.

* Log-broker throughput (capacityStreamMiBPerVcpuSecond 20 at 0.5 utilization, 4 GiB RAM per vCPU) is provider-documented by Google Managed Service for Apache Kafka sizing ([https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/plan-cluster-size)): write-equivalent bytes are replicated writes plus a quarter of reads. Producer batches below 10 KB lower per-CPU throughput; that penalty is not modeled.

* Disk utilization 0.8 is provider-documented headroom below Cloud SQL automatic storage increase, which triggers near 91-95% full ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)). The 20 GiB reserve exceeds PostgreSQL's 1 GB default max\_wal\_size; the remainder of that reserve is unmeasured.

* CPU tiers double from 2 vCPUs to the target's largest node at 4 GiB per vCPU; each target's documented largest node bounds CPU, RAM, RAM per vCPU and disk, and the durable staging database uses Cloud SQL Enterprise (96 vCPU, 6.5 GiB per vCPU, 624 GiB, 64 TiB). Targets billed per capacity unit or throughput unit are sized by their backend instead.

* No public evidence: peak/mean work (2) and the RAM working-set fraction (0.1). Proposed measurements: the p99 one-minute rate over the monthly mean from customer CloudWatch metrics; the buffer hit ratio while stepping RAM under a fixed YCSB-B load.

* Node bounds: Cloud SQL Enterprise allows 1-96 vCPUs at 0.9-6.5 GB per vCPU and up to 64 TB with a dedicated vCPU ([https://docs.cloud.google.com/sql/docs/postgres/instance-settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings)).

* Stored GiB already includes the origin family's physical footprint assumptions; no second storage amplification is applied.

* The workload family already selected resource-hours; the throughput coefficient is not applied again.

* Copies and allocation fractions change cost only; they do not increase modeled primary capacity.

List prices read: 2026-10-22. Model: `plan-2750406dd01b489f7c5eaa3e93d2aa5c67e6488c` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AmazonApiGateway offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json), [Amazon API Gateway pricing](https://aws.amazon.com/api-gateway/pricing/), [Compute Engine general-purpose machine pricing](https://cloud.google.com/products/compute/pricing/general-purpose), [Disk and image pricing](https://cloud.google.com/compute/disks-image-pricing), [Network pricing](https://cloud.google.com/vpc/network-pricing).

## On Azure

### Azure API Management

| Capability | Area | Support | Operations | Notes |
| - | - | - | - | - |
| AWS\_IAM authorization | - | Adapter-served | - | A policy on the operation sends the request's signature to the adapter, which verifies the SigV4 credential and evaluates execute-api:Invoke before the backend is reached. Each such request makes that callout. |
| Eligibility rule | - | Partial | - | An HTTP API is served here when every integration is an HTTP\_PROXY to a URL or a Lambda proxy. Any of the four authorizer kinds is accepted. An API outside the rule is refused when the ineligible route or integration is created and is served on Envoy as a whole. |
| HTTP proxy integrations | - | Supported | - | Each route becomes an API Management operation whose backend is the integration URL; the response is returned as the backend sent it. |
| JWT authorizers | - | Supported | - | Issuer, audience, signing keys, token times and required scopes are checked by an API Management validate-jwt policy on the operation. |
| Lambda authorizers | - | Adapter-served | - | A policy on the operation calls the adapter, which runs the authorizer with the configured identity sources and cache keys and returns the decision. Each such request makes that callout unless cached. |
| Lambda proxy integrations | - | Adapter-served | - | The operation's backend is the adapter's ingress, which builds the payload format 1.0 or 2.0 event and invokes the function under the integration's own authority. |
| Public routes (NONE) | - | Supported | - | Served as operations with no authorization policy. |
| WebSocket APIs | - | Out of scope | - | A WebSocket API is served on Envoy, where the adapter's connection worker owns the socket. |

#### How an API lands on Azure API Management

Your tooling calls the API Gateway v2 management API unchanged. The adapter records the API, its routes, integrations, authorizers, deployments and stages, and when a stage is deployed it writes an API Management API with one operation per route and method, each with the policies its authorization needs and a backend pointing at the integration. Requests from your clients go to the API Management hostname and are handled by Azure.

The decision to use this backend is made once per API. Every route, authorizer and integration is checked against the rule below as it is created, and an API that fits is served here in full. An API that does not fit is served on Envoy in full; routes are never split between the two backends.

#### The eligibility rule

Azure API Management serves an HTTP API when every integration is an HTTP\_PROXY to a URL, or a Lambda proxy (AWS\_PROXY) reached through the adapter's ingress. Any of the four authorizer kinds is accepted: NONE and JWT are decided by API Management's own policies, and AWS\_IAM and Lambda authorizers are decided by the adapter through a policy callout on each request. A WebSocket API is outside the rule and is served on Envoy. A CreateRoute, CreateAuthorizer or CreateIntegration outside the rule is refused when it is made, with the reason.

#### Authorizers and the callout

A JWT authorizer becomes a validate-jwt policy on each of its operations: issuer, audience, signing keys, token times and required scopes are checked by API Management. A public route has no authorization policy.

An AWS\_IAM route or a route with a Lambda authorizer has a policy that sends the request's identity material to the adapter before the backend is called. For AWS\_IAM the adapter verifies the SigV4 signature and evaluates execute-api:Invoke against the caller's permissions; for a Lambda authorizer it runs your authorizer function with the configured identity sources and honours its cache settings. A deny is returned to the client as API Gateway would return it, and the backend is not reached. The callout is a network hop on every such request, so an AWS\_IAM or Lambda-authorizer route on API Management has higher latency than the same route on Envoy, where the check is in-cluster.

#### Integrations, deployments and stages

An HTTP\_PROXY integration becomes the operation's backend URL. A Lambda proxy integration's backend is the adapter's ingress, which builds the payload format 1.0 or 2.0 event, invokes the function under the integration's own authority and returns the function's status, headers and body; API Management holds no AWS credential and cannot invoke a function itself.

A deployment records a fixed revision of the API and a stage selects one. A stage change is a set of operation and policy writes on API Management, applied together; propagation is a matter of seconds, not the minutes of an API config rollout. Exercise a route after deploying before moving traffic.

#### Limitations

* **WebSocket APIs are not served here.** They are served on Envoy, where the adapter's connection worker owns the socket. - **AWS\_IAM and Lambda-authorizer routes cost a callout.** Each such request makes a synchronous call to the adapter before the backend; measure the added latency for your routes before choosing API Management for a latency-sensitive API. - **One operation per route and method.** A route key with ANY becomes one operation per HTTP method, and the policy document that decides eligibility grows with the route count; a very large API may exceed API Management's policy size limit and is refused with the reason. - **API Management reaches backends over HTTP/1.1.** There is no HTTP/2 from the gateway to the backend. - **Custom domains and certificates are configured on API Management**, not through the API Gateway v2 domain-name calls.

#### Other considerations

* **Operations and ownership.** Azure runs API Management; the adapter owns your API configuration, the authorization callouts and the Lambda ingress. Gateway capacity, request logs and metrics are Azure's, and the Standard v2 tier is the one this mapping provisions. - **Private ingress.** Standard v2 supports an inbound private endpoint, so the gateway can be made reachable only through your network; configure that on API Management. - **Choosing between the two backends.** Pick this backend when you want Azure to run the request path and your authorizer mix is mostly JWT or public. An API whose routes are mostly AWS\_IAM or Lambda-authorized keeps lower latency on Envoy. - **Migration.** Recreate the API, deploy a stage, confirm the API Management hostname answers, then repoint clients or DNS.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### API Gateway HTTP execution · API execution requests per second

Feature: API Gateway HTTP execution.

Estimated monthly service charges by API execution requests per second. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: East US; currency: USD.

![API Gateway HTTP execution · API execution requests per second: monthly service charges by API execution requests per second. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/a06755ac2ed341adeb18e646e55da4e7d34af5e8459f12f548d73b572e355e3c-light.svg)

![API Gateway HTTP execution · API execution requests per second: monthly service charges by API execution requests per second. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/0dae43b69161c5f8c2510e844d14808495989ed0deab903c180b7cb6a1011482-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| API execution requests per second (requests/s) | API Gateway v2 (HTTP/WebSocket) | Azure API Management | Difference |
| -: | -: | -: | -: |
| 0 | 0.00 | 700.00 | 700.00 |
| 1 | 2.63 | 700.00 | 697.37 |
| 10 | 26.28 | 700.02 | 673.74 |
| 100 | 262.80 | 1,310.51 | 1,047.71 |
| 1,000 | 2,628.00 | 8,008.47 | 5,380.47 |
| 10,000 | 26,280.00 | 73,991.99 | 47,711.99 |
| 100,000 | 262,800.00 | 711,473.49 | 448,673.49 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · API execution requests | 0.000001 | USD/Requests |
| Origin list price · API management requests | 0 | USD/Requests |
| Proxy requests per vCPU-second | 4,000 | requests/vCPU-second |
| Target proxy CPU utilization | 0.7 | fraction |
| Peak / average execution requests | 2 | multiplier |
| Proxy CPU per replica | 0.5 | vCPU |
| Proxy RAM per replica | 0.375 | GiB |
| Minimum allocated proxy replicas | 2 | replicas |
| Billable response bytes per request | 4,096 | bytes |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0.0000025 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.087 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Included before billing · provider operation | 50,000,000 | provider operation |
| Included before billing · network GiB | 100 | network GiB |
| Target monthly base charge · list price | 699.997 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → East US, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* Whole Envoy replica allocation grows with peak execution requests and selected utilization; the zero-traffic floor remains explicit.
* Native managed gateway backends price execution request meters; Envoy backends price the derived proxy resource-hours. Do not add both execution price paths.
* Azure API Management Standard v2 bills one always-on unit (USD 700/month) with 50 million calls included, then USD 2.50 per million calls; more units add capacity at USD 0.68493 per secondary-unit hour, which is not sized here. Responses leave over Azure internet egress (Microsoft global network routing): the first 100 GB a month free, then USD 0.087 per GB to 10 TB, 0.083 to 50 TB, 0.07 to 150 TB and 0.05 beyond. The Consumption tier (no base, USD 3.50 per million calls after 1 million free) and Basic v2 (USD 150/month with 10 million calls) are not selected. Do not also charge an Envoy replica allocation.
* AWS Price List API, AmazonApiGateway offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json)
* Amazon API Gateway pricing: [https://aws.amazon.com/api-gateway/pricing/](https://aws.amazon.com/api-gateway/pricing/)
* Azure Retail Prices API: [https://prices.azure.com/api/retail/prices](https://prices.azure.com/api/retail/prices)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Upstream Lambda/integration compute, external load balancer, DNS, certificates, cache, logs, custom authorizers and WebSocket connection minutes.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-c6e0477f7fa6ee16c9c5d845aa7adec01fd8867f` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AmazonApiGateway offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json), [Amazon API Gateway pricing](https://aws.amazon.com/api-gateway/pricing/), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

**API Gateway HTTP execution → Azure API Management: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: East US. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: API execution requests | 262.80 |
| Origin: API management requests | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations after 50000000 included | 532.00 |
| Target: Selected billable network after 100 included | 78.52 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| Target: Target monthly base charge | 700.00 |
| **Origin service subtotal** | **262.80** |
| **Target service subtotal** | **1,310.51** |

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Upstream Lambda/integration compute, external load balancer, DNS, certificates, cache, logs, custom authorizers and WebSocket connection minutes.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · API execution requests | 0.000001 | USD/Requests |
| Origin list price · API management requests | 0 | USD/Requests |
| Proxy requests per vCPU-second | 4,000 | requests/vCPU-second |
| Target proxy CPU utilization | 0.7 | fraction |
| Peak / average execution requests | 2 | multiplier |
| Proxy CPU per replica | 0.5 | vCPU |
| Proxy RAM per replica | 0.375 | GiB |
| Minimum allocated proxy replicas | 2 | replicas |
| Billable response bytes per request | 4,096 | bytes |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0.0000025 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.087 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Included before billing · provider operation | 50,000,000 | provider operation |
| Included before billing · network GiB | 100 | network GiB |
| Target monthly base charge · list price | 699.997 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| API execution requests | 262,800,000 | Requests |
| API management requests | 100,000 | Requests |

* Translated reads: 100,000 operations.

* Translated writes: 0 operations.

* Translated resident physical data: 0 GiB-month.

* Native provider operations: 262,800,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 730 vCPU-hour.

* Allocated execution RAM: 547.5 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 1,003 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.

* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.

* Whole Envoy replica allocation grows with peak execution requests and selected utilization; the zero-traffic floor remains explicit.

* Native managed gateway backends price execution request meters; Envoy backends price the derived proxy resource-hours. Do not add both execution price paths.

* Azure API Management Standard v2 bills one always-on unit (USD 700/month) with 50 million calls included, then USD 2.50 per million calls; more units add capacity at USD 0.68493 per secondary-unit hour, which is not sized here. Responses leave over Azure internet egress (Microsoft global network routing): the first 100 GB a month free, then USD 0.087 per GB to 10 TB, 0.083 to 50 TB, 0.07 to 150 TB and 0.05 beyond. The Consumption tier (no base, USD 3.50 per million calls after 1 million free) and Basic v2 (USD 150/month with 10 million calls) are not selected. Do not also charge an Envoy replica allocation.

List prices read: 2026-10-22. Model: `plan-c6e0477f7fa6ee16c9c5d845aa7adec01fd8867f` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AmazonApiGateway offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json), [Amazon API Gateway pricing](https://aws.amazon.com/api-gateway/pricing/), [Azure Retail Prices API](https://prices.azure.com/api/retail/prices).

## On Google Cloud

### Google Cloud API Gateway

| Capability | Area | Support | Operations | Notes |
| - | - | - | - | - |
| AWS\_IAM and Lambda authorizers | - | Out of scope | - | Google Cloud API Gateway cannot evaluate a SigV4 signature or run a Lambda authorizer. An API that uses either is served on Envoy. |
| Eligibility rule | - | Partial | - | An API is served here only when every route is JWT without scopes or NONE and every integration is an HTTP\_PROXY to a URL or a Lambda proxy. A CreateRoute, CreateAuthorizer or CreateIntegration outside that rule is refused when it is made, and the API is served on Envoy as a whole; routes are never split between the two. |
| HTTP proxy integrations | - | Supported | - | Each route forwards to its integration URL; Google Cloud API Gateway returns the backend's status, headers and body. |
| JWT authorizers without scopes | - | Supported | - | Issuer, audience, signing keys and token times are checked by the gateway. A JWT authorizer that requires route scopes is outside this backend's rule. |
| Lambda proxy integrations | - | Adapter-served | - | The gateway forwards to the adapter's ingress, which builds the payload format 1.0 or 2.0 event and invokes the function under the integration's own authority. |
| Public routes (NONE) | - | Supported | - | Served as public gateway routes. |
| WebSocket APIs | - | Out of scope | - | Google Cloud API Gateway serves HTTP APIs only. A WebSocket API is served on Envoy. |

#### How an API lands on Google Cloud API Gateway

Your tooling calls the API Gateway v2 management API unchanged. The adapter records the API, its routes, integrations, authorizers, deployments and stages, and when a stage is deployed it renders that stage as an OpenAPI document, creates a Google Cloud API Gateway API config from it and points a gateway at the config. Requests from your clients go to the gateway's hostname and are handled by Google; the adapter is not on the request path.

The decision to use this backend is made once per API. Every route, authorizer and integration is checked against the rule below as it is created, and an API that fits is served here in full. An API that does not fit is served on Envoy in full. Routes are never split between the two backends, because a custom domain has one DNS target and every API mapped under it must resolve the same way.

#### The eligibility rule

Google Cloud API Gateway serves an API when:

* every route's authorization is a JWT authorizer with no required scopes, or NONE; and - every integration is an HTTP\_PROXY to a URL, or a Lambda proxy (AWS\_PROXY) reached through the adapter's ingress.

A route with AWS\_IAM authorization, a Lambda authorizer, or a JWT authorizer that requires scopes takes the API outside the rule, because the gateway cannot evaluate a SigV4 signature, run your authorizer function, or check scopes. A CreateRoute, CreateAuthorizer or CreateIntegration outside the rule is refused when it is made, with the reason, rather than accepted and served differently.

#### Authorizers and integrations

For a JWT authorizer the gateway checks issuer, audience, signing keys and token times against the configured identity provider, and passes the verified claims to the backend. A public route (NONE) is served without a check.

An HTTP\_PROXY integration forwards the request to the integration URL and returns the backend's response. A Lambda proxy integration forwards to the adapter's ingress, which builds the payload format 1.0 or 2.0 event, invokes the function under the integration's own authority and returns the function's status, headers and body; the gateway holds no AWS credential and cannot invoke a function itself.

#### Deployments and stages

A deployment records a fixed revision of the API; a stage selects one. Each stage change becomes a new API config and a gateway update, and Google Cloud propagates a config change over minutes rather than seconds, so a stage update is a rollout rather than an instant switch. Deploy the stage, wait for the gateway to report the new config, and exercise the route before moving traffic.

#### Limitations

* **The rule is the boundary.** AWS\_IAM routes, Lambda authorizers, JWT scopes and WebSocket APIs are not expressible on Google Cloud API Gateway; an API that uses any of them is served on Envoy in full. - **Config changes propagate over minutes.** A stage update is an API config rollout on Google's side; plan cutovers around that, and do not treat CreateStage's response as serving readiness. - **Integrations are reached over public URLs.** The gateway does not join your network; a private backend needs its own exposure, and VPC links are outside this contract. - **The gateway hostname is Google's.** Custom domains and certificates are configured on Google Cloud, not through the API Gateway v2 domain-name calls.

#### Other considerations

* **Operations and ownership.** Google Cloud runs the gateway; the adapter owns your API configuration and the Lambda ingress. Gateway quotas, request logs and metrics are Google's. - **Choosing between the two backends.** If any API you deploy needs AWS\_IAM or a Lambda authorizer, the Envoy backend serves everything and keeps one operating model. Pick this backend when your APIs are JWT or public and you want Google to run the request path. - **Migration.** Recreate the API, deploy a stage, confirm the gateway's hostname answers, then repoint clients or DNS.

#### Example monthly charges

This Tensor9 Cloud Adapter scenario estimates service charges for the named origin and target services. Adapter hosting and commercial Tensor9 fees need separate allocations. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method and what the estimates include.

##### API Gateway HTTP execution · API execution requests per second

Feature: API Gateway HTTP execution.

Estimated monthly service charges by API execution requests per second. Adapter hosting and Tensor9 fees are excluded. Source: us-east-1; target: us-central1; currency: USD.

![API Gateway HTTP execution · API execution requests per second: monthly service charges by API execution requests per second. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/79e5b473998ebc26417a995782574d60766e9e70e16d5f9004c16fe758c9baf2-light.svg)

![API Gateway HTTP execution · API execution requests per second: monthly service charges by API execution requests per second. Exact values are in the following table.](https://docs.tensor9.com/images/cloud-adapter-early-access/diagrams/service-cost/b830513ea6b15a07552c536599c79a54c91667116a4f43d851d5704d2ad7366f-dark.svg)

Comparison pills describe all sampled scale points; amounts beside each service are for the named workload. Costs The Same means within 20% at every point. Costs Depend includes mixed results and unpriced samples.

Sampled monthly charges in USD, rounded to cents. Difference means target minus origin; a positive difference means the target costs more.

| API execution requests per second (requests/s) | API Gateway v2 (HTTP/WebSocket) | API Gateway | Difference |
| -: | -: | -: | -: |
| 0 | 0.00 | 0.00 | 0.00 |
| 1 | 2.63 | 2.94 | 0.31 |
| 10 | 26.28 | 83.37 | 57.09 |
| 100 | 262.80 | 887.66 | 624.86 |
| 1,000 | 2,628.00 | 6,488.63 | 3,860.63 |
| 10,000 | 26,280.00 | 49,190.02 | 22,910.02 |
| 100,000 | 262,800.00 | 459,172.15 | 196,372.15 |

**Curve assumptions**

| Assumption | Value | Unit |
| - | -: | - |
| Origin list price · API execution requests | 0.000001 | USD/Requests |
| Origin list price · API management requests | 0 | USD/Requests |
| Proxy requests per vCPU-second | 4,000 | requests/vCPU-second |
| Target proxy CPU utilization | 0.7 | fraction |
| Peak / average execution requests | 2 | multiplier |
| Proxy CPU per replica | 0.5 | vCPU |
| Proxy RAM per replica | 0.375 | GiB |
| Minimum allocated proxy replicas | 2 | replicas |
| Billable response bytes per request | 4,096 | bytes |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0.000003 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.105 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Included before billing · provider operation | 2,000,000 | provider operation |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |

* Only this native meter varies; all other source usage and translation assumptions retain the displayed defaults. Other native meters and workload assumptions retain their explicitly displayed default quantities. Workload translation and capacity assumptions are not benchmark measurements.
* Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts. Rates as of 2026-10-22: us-east-1 → us-central1, USD/month.
* Source prices are reference charges, not an invoice. Target lines cover selected service usage/configuration only; adapter hosting and Tensor9 fees are excluded.
* Samples of explicit prices are not performance measurements or capacity qualification. No interpolation or break-even guarantee is implied.
* Variant assumptions show the first axis sample; any axis-dependent configuration is described by this curve's workload note.
* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.
* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.
* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.
* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.
* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.
* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.
* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.
* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.
* Whole Envoy replica allocation grows with peak execution requests and selected utilization; the zero-traffic floor remains explicit.
* Native managed gateway backends price execution request meters; Envoy backends price the derived proxy resource-hours. Do not add both execution price paths.
* Google API Gateway bills API calls per billing account: the first 2 million a month free, USD 3.00 per million to 1 billion, 1.50 beyond. Responses leave over Premium Tier internet transfer at the rates the API Gateway page lists for North America (USD 0.105 per GiB to 10 TiB, 0.08 to 150 TiB, 0.06 beyond). Do not also charge an Envoy replica allocation.
* AWS Price List API, AmazonApiGateway offer: [https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json)
* Amazon API Gateway pricing: [https://aws.amazon.com/api-gateway/pricing/](https://aws.amazon.com/api-gateway/pricing/)
* API Gateway pricing: [https://cloud.google.com/api-gateway/pricing](https://cloud.google.com/api-gateway/pricing)

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Upstream Lambda/integration compute, external load balancer, DNS, certificates, cache, logs, custom authorizers and WebSocket connection minutes.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

List prices read: 2026-10-22. Model: `plan-4ba6ce66e96af951f5fb664c0dace9deda4a2f38` / `2026-10-22.planning.2`. Curve: `workload-1`.

Sources: [AWS Price List API, AmazonApiGateway offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json), [Amazon API Gateway pricing](https://aws.amazon.com/api-gateway/pricing/), [API Gateway pricing](https://cloud.google.com/api-gateway/pricing).

**API Gateway HTTP execution → Google Cloud API Gateway: Authored native-usage planning example.** Native monthly usage priced at the cited provider list prices; listed target allowances apply where present, excluding invoice credits, taxes and negotiated discounts.

Scenario source region: us-east-1. Scenario target region: us-central1. Currency: USD.

| Monthly component | USD |
| - | -: |
| Origin: API execution requests | 262.80 |
| Origin: API management requests | 0.00 |
| Target: Target retained physical data | 0.00 |
| Target: Additional broker replica storage | 0.00 |
| Target: Target native provider operations after 2000000 included | 782.40 |
| Target: Selected billable network | 105.26 |
| Target: Independent native resources | 0.00 |
| Target: Independent native resources | 0.00 |
| **Origin service subtotal** | **262.80** |
| **Target service subtotal** | **887.66** |

Unestimated components: Adapter hosting, Tensor9 fees. A modeled adapted total and savings require these costs.

Cost scope: Modeled target native service and explicitly modeled state allocation; hosting and Tensor9 fees only when supplied.

Excluded costs and workload features:

* Upstream Lambda/integration compute, external load balancer, DNS, certificates, cache, logs, custom authorizers and WebSocket connection minutes.
* Taxes, discounts, credits and free-tier allowances not explicitly listed by this model.
* Unmodeled dependent services, task execution and operations outside the selected workload family.

**Scenario assumptions**

| Input | Value | Unit |
| - | -: | - |
| Origin list price · API execution requests | 0.000001 | USD/Requests |
| Origin list price · API management requests | 0 | USD/Requests |
| Proxy requests per vCPU-second | 4,000 | requests/vCPU-second |
| Target proxy CPU utilization | 0.7 | fraction |
| Peak / average execution requests | 2 | multiplier |
| Proxy CPU per replica | 0.5 | vCPU |
| Proxy RAM per replica | 0.375 | GiB |
| Minimum allocated proxy replicas | 2 | replicas |
| Billable response bytes per request | 4,096 | bytes |
| Target price guess · read | 0 | USD/read |
| Target price guess · write | 0 | USD/write |
| Target list price · provider operation | 0.000003 | USD/provider operation |
| Target price guess · GiB-month | 0 | USD/GiB-month |
| Target price guess · published GiB | 0 | USD/published GiB |
| Target price guess · delivered GiB | 0 | USD/delivered GiB |
| Target list price · network GiB | 0.105 | USD/network GiB |
| Target price guess · replica GiB-month | 0 | USD/replica GiB-month |
| Target price guess · vCPU-hour | 0 | USD/vCPU-hour |
| Target price guess · GiB-hour | 0 | USD/GiB-hour |
| Target price guess · resource-hour | 0 | USD/resource-hour |
| Target price guess · resource-month | 0 | USD/resource-month |
| Target price guess · input token | 0 | USD/input token |
| Target price guess · output token | 0 | USD/output token |
| Included before billing · provider operation | 2,000,000 | provider operation |
| Target monthly base charge | 0 | USD/month |
| Approximate target service minimum | 0 | USD/month |
| Minimum primary CPU | 2 | vCPU |
| Minimum primary RAM | 8 | GiB |
| Minimum primary disk | 100 | GiB |
| Additional full-price standby copy | 0 | 0 or 1 |
| Allocated share of provisioned cost | 1 | fraction |
| Read/write work per vCPU-second | 1,500 | operations/vCPU-second |
| Planning peak / mean work | 2 | multiplier |
| Planning primary CPU utilization | 0.7 | fraction |
| Resident state reserved in RAM | 0.1 | fraction |
| Planning disk utilization | 0.8 | fraction |
| Maintenance and log disk reserve | 20 | GiB |
| Staging database CPU unit-price guess | 0.0413 | USD/vCPU-hour |
| Staging database RAM unit-price guess | 0.007 | USD/GiB-hour |
| Staging database disk unit-price guess | 0.17 | USD/GiB-month |
| Dependent object sink storage price guess | 0.023 | USD/GiB-month |
| Dependent object sink write price guess | 0.000005 | USD/write |
| API execution requests | 262,800,000 | Requests |
| API management requests | 100,000 | Requests |

* Translated reads: 100,000 operations.

* Translated writes: 0 operations.

* Translated resident physical data: 0 GiB-month.

* Native provider operations: 262,800,000 operations.

* Published payload: 0 GiB.

* Delivered payload: 0 GiB.

* Allocated execution CPU: 730 vCPU-hour.

* Allocated execution RAM: 547.5 GiB-hour.

* Independent resource allocation: 0 resource-hour.

* Independent inventory: 0 resource-month.

* Input tokens: 0 tokens.

* Output tokens: 0 tokens.

* Billable network: 1,003 GiB.

* Dependent object sink retained data: 0 GiB-month.

* Dependent object sink writes: 0 writes.

* Rates are cited provider list prices, editable for discounts, commitments or another region. Workload translation and capacity coefficients remain editable planning assumptions, not benchmark measurements or a commercial quote.

* Default-zero rates are explicit assumptions, not evidence that the deployed service or resource is free.

* Provisioned-unit minimums use an editable approximate allocation floor. Modeled target service cost is max(usage/allocation, minimum), with billable network, durable staging and dependent sinks added separately; actual RU/TU sizing, scaling increments and throughput remain unqualified.

* Durable staging is priced once: provisioned targets include adapter state in their selected allocation; native targets add a separate staging allocation when required. Adapter hosting is a separate allocation and must exclude resources already priced as staging, workers or target capacity.

* A declared adapter mapping and cost model do not establish implementation availability or service equivalence.

* This is a declared directed mapping; a planning estimate does not establish deployment or request-serving support.

* Origin unit prices are cited provider list prices; capacity coefficients and translation assumptions are editable authored planning guesses, not measured capacity or a provider quote.

* Management requests do not reveal resource allocation or workload traffic. Provisioned resources and traffic are independent inputs.

* Whole Envoy replica allocation grows with peak execution requests and selected utilization; the zero-traffic floor remains explicit.

* Native managed gateway backends price execution request meters; Envoy backends price the derived proxy resource-hours. Do not add both execution price paths.

* Google API Gateway bills API calls per billing account: the first 2 million a month free, USD 3.00 per million to 1 billion, 1.50 beyond. Responses leave over Premium Tier internet transfer at the rates the API Gateway page lists for North America (USD 0.105 per GiB to 10 TiB, 0.08 to 150 TiB, 0.06 beyond). Do not also charge an Envoy replica allocation.

List prices read: 2026-10-22. Model: `plan-4ba6ce66e96af951f5fb664c0dace9deda4a2f38` / `2026-10-22.planning.2`. Scenario: `planning-example`.

Sources: [AWS Price List API, AmazonApiGateway offer](https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonApiGateway/current/us-east-1/index.json), [Amazon API Gateway pricing](https://aws.amazon.com/api-gateway/pricing/), [API Gateway pricing](https://cloud.google.com/api-gateway/pricing).

## Costs

Estimated monthly service charges for each backend with a published cost model, at one sampled workload from that model's cost curve. Adapter hosting and Tensor9 fees are excluded. [How Tensor9 estimates costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/overview.md) explains the method, what the estimates include and how to read their qualifications.

| Origin API | Backend | Sampled workload | Price basis | Origin USD/month | Backend USD/month | Difference | Mapping |
| - | - | - | - | -: | -: | -: | - |
| `aws::1.0.0::api-gateway::v1` | Envoy | API execution requests per second: 100 requests/s; one copy | Cited list prices, 2026-10-22 | 919.80 | 201.20 | -718.60 | Service adapter |
| `aws::1.0.0::api-gateway::v2` | API Gateway | API execution requests per second: 100 requests/s | Cited list prices, 2026-10-22 | 262.80 | 887.66 | +624.86 | Service adapter |
| `aws::1.0.0::api-gateway::v2` | Azure API Management | API execution requests per second: 100 requests/s | Cited list prices, 2026-10-22 | 262.80 | 1,310.51 | +1,047.71 | Service adapter |
| `aws::1.0.0::api-gateway::v2` | Envoy | API execution requests per second: 100 requests/s; one copy | Cited list prices, 2026-10-22 | 262.80 | 201.20 | -61.60 | Service adapter |

Difference means backend minus origin; a positive difference means the backend costs more. Workloads and target configurations differ by model, so compare each row's difference at its stated workload rather than charges across rows.
Cost curves across workload sizes, with every assumption and exclusion: [API Gateway (REST) costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-api-gateway-v1), [API Gateway v2 (HTTP/WebSocket) costs](https://docs.tensor9.com/cloud-adapter-early-access/costs/additional-services/aws-api-gateway-v2).

## Service level agreements

> [!WARNING]
>
> These tables show Tensor9's standard service levels and adapters whose standard terms are still being defined. Your signed agreement determines the SLAs, covered adapters and operations, limits, remedies and support terms that apply to your deployment.

Listed terms cover requests sent through this service adapter. They do not cover direct connections to the target service or replace the cloud provider's own SLA. Each origin-to-target pair has its own terms or an explicit pending status.

See the [SLA tables](https://docs.tensor9.com/cloud-adapter-early-access/support/service-adapter-slas.md), [measurement rules](https://docs.tensor9.com/cloud-adapter-early-access/support/service-levels.md), and [scaling conditions](https://docs.tensor9.com/cloud-adapter-early-access/support/scaling-and-limits.md).

### API Gateway v2 (HTTP/WebSocket) to Azure API Management

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| API Gateway authoring reads adapter-added latency | +5 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes` | Point read or at most 100 returned records; configuration at most 1 MiB. |
| API, route, integration and authorizer mutation adapter-added latency | +12 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute` | One resource per call; API configuration at most 1 MiB. |
| Deployment and stage coordination adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage` | at most 100 routes and at most 20 authorizers/integrations; provider propagation separate. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::api-gateway::v2`: `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes`, `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute`, `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage` | A deployment is an immutable complete revision, stages select one revision atomically, dependent routes never become public when an authorizer is removed, and invocation authority remains separate from caller authority. Unsupported private links or custom-domain shapes fail explicitly. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Authoring calls validate and store API, route, integration, authorizer, deployment and stage records. Deployment materialization onto azure::1.0.0::api-management is coordinated separately. For served requests, ingress parsing, authorization callouts, Lambda-event construction and response conversion remain adapter work; backend integration execution is separately spanned.

#### How the latency targets were chosen

**API Gateway authoring reads: +5 ms monthly p99 (adapter-added).** `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes`. Indexed control-state read and bounded response encoding.

**API, route, integration and authorizer mutation: +12 ms monthly p99 (adapter-added).** `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute`. Validation and one durable authoring-state mutation.

**Deployment and stage coordination: +25 ms monthly p99 (adapter-added).** `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage`. Immutable snapshot construction and reconciliation scheduling.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Authoring scales by API while mutations to one API are generation ordered. Reads and bounded lists scale horizontally. Qualification fixes routes, integrations, authorizers, stages, document bytes and list-page size; deployment trials include materialization fan-out without folding provider propagation time into local processing.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

A deployment is an immutable complete revision, stages select one revision atomically, dependent routes never become public when an authorizer is removed, and invocation authority remains separate from caller authority. Unsupported private links or custom-domain shapes fail explicitly.

#### Example and diagnosis

CreateDeployment snapshots 50 routes and five authorizers. The coordinated-write target covers snapshot construction and durable admission. Writing those routes and policies to API Management or Google API Gateway is measured as propagation; stage traffic changes only when the selected revision is ready under the profile contract.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

### API Gateway v2 (HTTP/WebSocket) to Envoy

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| WebSocket connection management adapter-added latency | +5 ms monthly p99 | `aws::1.0.0::api-gateway-management-api`: `DeleteConnection`, `GetConnection`, `PostToConnection` | One owned connection and at most 32 KiB posted data; client receipt is not implied. |
| API Gateway authoring reads adapter-added latency | +5 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes` | Point read or at most 100 returned records; configuration at most 1 MiB. |
| API, route, integration and authorizer mutation adapter-added latency | +12 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute` | One resource per call; API configuration at most 1 MiB. |
| Deployment and stage coordination adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage` | at most 100 routes and at most 20 authorizers/integrations; provider propagation separate. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::api-gateway-management-api`: `DeleteConnection`, `GetConnection`, `PostToConnection` `aws::1.0.0::api-gateway::v2`: `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes`, `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute`, `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage` | A deployment is an immutable complete revision, stages select one revision atomically, dependent routes never become public when an authorizer is removed, and invocation authority remains separate from caller authority. Unsupported private links or custom-domain shapes fail explicitly. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Authoring calls validate and store API, route, integration, authorizer, deployment and stage records. Deployment materialization onto envoy::1.0.0::proxy is coordinated separately. For served requests, ingress parsing, authorization callouts, Lambda-event construction and response conversion remain adapter work; backend integration execution is separately spanned.

#### How the latency targets were chosen

**WebSocket connection management: +5 ms monthly p99 (adapter-added).** `DeleteConnection`, `GetConnection`, `PostToConnection`. Authorization, connection-owner lookup and bounded frame admission or metadata response.

**API Gateway authoring reads: +5 ms monthly p99 (adapter-added).** `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes`. Indexed control-state read and bounded response encoding.

**API, route, integration and authorizer mutation: +12 ms monthly p99 (adapter-added).** `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute`. Validation and one durable authoring-state mutation.

**Deployment and stage coordination: +25 ms monthly p99 (adapter-added).** `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage`. Immutable snapshot construction and reconciliation scheduling.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Authoring scales by API while mutations to one API are generation ordered. Reads and bounded lists scale horizontally. Qualification fixes routes, integrations, authorizers, stages, document bytes and list-page size; deployment trials include materialization fan-out without folding provider propagation time into local processing.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

A deployment is an immutable complete revision, stages select one revision atomically, dependent routes never become public when an authorizer is removed, and invocation authority remains separate from caller authority. Unsupported private links or custom-domain shapes fail explicitly.

#### Example and diagnosis

CreateDeployment snapshots 50 routes and five authorizers. The coordinated-write target covers snapshot construction and durable admission. Writing those routes and policies to API Management or Google API Gateway is measured as propagation; stage traffic changes only when the selected revision is ready under the profile contract.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

### API Gateway v2 (HTTP/WebSocket) to Google Cloud API Gateway

| SLA | Service level | What is covered | Conditions |
| - | - | - | - |
| API Gateway authoring reads adapter-added latency | +5 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes` | Point read or at most 100 returned records; configuration at most 1 MiB. |
| API, route, integration and authorizer mutation adapter-added latency | +12 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute` | One resource per call; API configuration at most 1 MiB. |
| Deployment and stage coordination adapter-added latency | +25 ms monthly p99 | `aws::1.0.0::api-gateway::v2`: `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage` | at most 100 routes and at most 20 authorizers/integrations; provider propagation separate. |
| Documented adapter behavior | Preserve the supported behavior documented for this adapter | `aws::1.0.0::api-gateway::v2`: `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes`, `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute`, `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage` | A deployment is an immutable complete revision, stages select one revision atomically, dependent routes never become public when an authorizer is removed, and invocation authority remains separate from caller authority. Unsupported private links or custom-domain shapes fail explicitly. |
| Endpoint reachability | 99.9% per calendar month | Adapter endpoint reachability | The agreed production deployment has healthy target connectivity and receives a valid adapter health probe. This measures the adapter endpoint, not the target provider's service. |
| Adapter autoscaling and limits | Automatic scaling within the workload and deployment limits in your agreement | Adapter behavior across requests | Your agreement states the maximum request rate, burst size, request and response sizes, concurrency, and target calls per request. Tensor9 maintains adapter capacity inside that envelope. Target-service quotas and capacity are separate. |

**Adapter-added latency.** A + prefix marks time added by the adapter, not the total time your application waits. Total request time includes adapter processing, backend service time and network time. The backend provider's SLA applies independently. Only separately measured target-service wait may be subtracted, and only when your agreement permits it; internal metadata, coordination and retry processing still count. For one request, 12 ms of adapter processing plus 90 ms waiting for the backend means at least 102 ms total. This example does not add monthly p99 values.

**What Tensor9 covers.** These service levels cover the adapter between the origin API and target API. They do not replace the target provider's SLA.

**How latency is counted.** Adapter work, including metadata and coordination, counts. Only separately measured permitted target waits are excluded.

**Which terms apply.** Your signed agreement names the covered operations, workload limits, remedies, and final service levels for your deployment.

#### What this adapter does

Authoring calls validate and store API, route, integration, authorizer, deployment and stage records. Deployment materialization onto google::1.0.0::api-gateway is coordinated separately. For served requests, ingress parsing, authorization callouts, Lambda-event construction and response conversion remain adapter work; backend integration execution is separately spanned.

#### How the latency targets were chosen

**API Gateway authoring reads: +5 ms monthly p99 (adapter-added).** `GetApi`, `GetApis`, `GetAuthorizer`, `GetAuthorizers`, `GetIntegration`, `GetIntegrations`, `GetRoute`, `GetRoutes`. Indexed control-state read and bounded response encoding.

**API, route, integration and authorizer mutation: +12 ms monthly p99 (adapter-added).** `CreateApi`, `CreateAuthorizer`, `CreateIntegration`, `CreateRoute`, `DeleteApi`, `DeleteAuthorizer`, `DeleteIntegration`, `DeleteRoute`, `UpdateApi`, `UpdateAuthorizer`, `UpdateIntegration`, `UpdateRoute`. Validation and one durable authoring-state mutation.

**Deployment and stage coordination: +25 ms monthly p99 (adapter-added).** `CreateDeployment`, `CreateStage`, `DeleteStage`, `GetDeployment`, `GetDeployments`, `GetStage`, `GetStages`, `UpdateStage`. Immutable snapshot construction and reconciliation scheduling.

Your signed agreement sets the terms for your deployment. A target does not add an operation or option that the compatibility tables mark unavailable.

#### What counts toward latency

For a request-response row, measure from the agreed ingress boundary to dispatch of the complete response. A row that explicitly names a first response chunk ends at that chunk; its number does not cover the rest of the stream. A long-poll row names the intentional wait and when adapter delay starts. Include parsing, authorization, admission, translation, serialization, adapter-owned storage and coordination, retries and response handling. Subtract only separately measured target-workload waits and external network segments allowed by the measurement rules. The adapter's own response handling and dispatch remain covered. A database used for adapter metadata is still adapter work, even if a cloud provider hosts it.

For concurrent calls, exclude the union of permitted wait intervals, not the sum of overlapping spans. Calculate each request's adapter duration first, then the monthly p99. Do not subtract one service's p99 from another's. Known adapter timeouts are over-budget samples; failed or incomplete requests cannot disappear to improve the percentile. Missing measurements do not become zero latency. An SDK call span alone does not prove how much of its duration can be excluded.

#### Endpoint reachability and request failures

The endpoint-reachability target measures adapter health checks. Correctly forwarding a target quota or permission error is different from producing that error because the adapter sent the wrong request. Adapter-caused failures remain Tensor9's responsibility even when the target is healthy.

Correctness and data-integrity requirements apply to every supported request. Endpoint reachability does not measure request correctness or grant an allowance for incorrect results.

#### Scaling and target-service capacity

Authoring scales by API while mutations to one API are generation ordered. Reads and bounded lists scale horizontally. Qualification fixes routes, integrations, authorizers, stages, document bytes and list-page size; deployment trials include materialization fan-out without folding provider propagation time into local processing.

Tell Tensor9 the expected steady rate, bursts, concurrency, payload sizes and operation mix. Tensor9 sizes and scales the adapter for the agreed load; you choose and monitor the target service's capacity with Tensor9's help. A latency budget is not a requests-per-second rating. Larger requests and higher rates need explicit terms, not silent inheritance of a small-request SLA.

#### Data and behavior guarantees

A deployment is an immutable complete revision, stages select one revision atomically, dependent routes never become public when an authorizer is removed, and invocation authority remains separate from caller authority. Unsupported private links or custom-domain shapes fail explicitly.

#### Example and diagnosis

CreateDeployment snapshots 50 routes and five authorizers. The coordinated-write target covers snapshot construction and durable admission. Writing those routes and policies to API Management or Google API Gateway is measured as propagation; stage traffic changes only when the selected revision is ready under the profile contract.

Use `tensor9 explain` and the documented explain headers to understand the selected adapter and its behavior. Correlate available request diagnostics with the target provider's latency, throttling and capacity metrics. An explain report helps diagnose a request; it is not by itself a qualified SLA timing measurement. Share the operation, request shape, timestamps and request identifiers with support, with credentials and customer payloads removed.

### API Gateway v2 (HTTP/WebSocket) to Tensor9 Trivial

**SLA status:** Not applicable

The application or appliance ingress supplies this routing capability; there is no API Gateway adapter endpoint to measure for this mapping.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::api-gateway::v2
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.