Apigee vs Broadcom Layer7: API Gateway Comparison (2026)
By API7.ai Team
Last updated: August 2026
Apigee and Broadcom Layer7 both target enterprise API management, but from opposite directions — a cloud-managed platform on Google Cloud versus a self-hosted, security-first gateway. This guide compares architecture, deployment, protocols, security and compliance, legacy integration, observability, and pricing so you can pick the right fit.
Apigee is Google Cloud’s managed API platform — best when you want a cloud-operated control plane, an integrated developer portal, and built-in analytics. Layer7 is a self-hosted, security-first gateway — best for FIPS 140-2, air-gapped deployment, and native legacy transports like JMS and IBM MQ. The choice turns on cloud-managed convenience versus on-prem security and legacy depth.
- Cloud-managed API management on Google Cloud: Apigee
- FIPS 140-2, air-gapped, on-prem security: Broadcom Layer7
- Native legacy SOAP, JMS, and IBM MQ bridging: Broadcom Layer7
Apigee vs Layer7 at a glance
Apigee leads on cloud-managed convenience and integrated analytics; Layer7 leads on self-hosted security depth, compliance, and native legacy transports.
| Dimension | Apigee | Broadcom Layer7 |
|---|---|---|
| Best for | Cloud-managed API management on Google Cloud | Self-hosted, security-first enterprise gateway |
| Vendor & lineage | Google Cloud | Broadcom (formerly CA API Gateway) |
| Core & runtime | Managed runtime on Google Cloud (Cassandra-backed) | Java runtime + MySQL database |
| Deployment | Managed SaaS; Apigee hybrid for self-hosted Kubernetes | Software, virtual appliance, Docker/Kubernetes container |
| Legacy transports | SOAP over HTTP; no native JMS/MQ | ✓ SOAP, JMS, IBM MQ, LDAP, FTP |
| Compliance depth | Inherits Google Cloud certs; Advanced API Security add-on | ✓ FIPS 140-2, HSM, PCI-DSS, HIPAA; air-gapped |
| Pricing | Usage-based (custom; see vendor pricing) | Enterprise licensing (custom; contact sales) |
What is Apigee?
Apigee is Google Cloud’s API management platform — a managed service with an Apigee hybrid option for self-hosted Kubernetes runtimes, bundling proxies, a developer portal, analytics, and security policies.
Apigee is Google Cloud’s API management platform. It runs as a managed service on Google Cloud — with Apigee hybrid for self-hosted Kubernetes runtimes — and bundles an API proxy layer, a developer portal, analytics, and security policies for designing, securing, and publishing APIs.
Vendor
Google Cloud
Runtime
Managed runtime (Cassandra-backed)
Best for
Cloud-managed API management
Pros
- Fully managed — Google handles infrastructure, scaling, and upgrades
- Integrated developer portal and built-in API analytics
- OAuth2, JWT, API keys, SAML, and Advanced API Security
- Apigee hybrid for self-hosted Kubernetes runtimes
Cons
- Control plane is tied to Google Cloud
- No native JMS/MQ transports; message queues need adapters
- Advanced API Security (bot/abuse detection) is a paid add-on
- No fully air-gapped deployment option
What is Broadcom Layer7?
Broadcom Layer7 (formerly CA API Gateway) is a security-first enterprise gateway built on a Java runtime and a MySQL database, enforcing policy via a visual assertion palette across software, appliance, and container form factors.
Broadcom Layer7 (formerly CA API Gateway) is a security-first enterprise API gateway built on a Java runtime with a MySQL-backed database. It acts as a reverse proxy in the DMZ, enforcing policy via a visual assertion palette, and deploys as software, a virtual appliance, or a Docker/Kubernetes container.
Vendor
Broadcom (formerly CA)
Runtime
Java + MySQL database
Best for
Self-hosted, regulated environments
Pros
- FIPS 140-2 crypto, HSM, PCI-DSS/HIPAA controls
- Native SOAP, JMS, IBM MQ, LDAP, FTP for legacy integration
- Visual Policy Manager with fine-grained assertions
- Self-hosted and air-gapped deployment supported
Cons
- Heavier Java runtime and database to operate
- Proprietary policy configurations are non-portable
- Broadcom enterprise licensing and support contracts
- Less convenient than a fully managed cloud service
Architecture: cloud-managed vs self-hosted gateway
Apigee is a Google-managed runtime with a cloud-native control plane; Layer7 is a self-hosted Java gateway with a MySQL database that acts as a policy-enforcing reverse proxy in the DMZ.
Apigee runs as a managed service on Google Cloud: Google operates the runtime (Message Processors with Cassandra-backed storage), the control plane, and analytics, so you give up infrastructure control in exchange for managed scaling and upgrades. Apigee hybrid lets you run the runtime in your own Kubernetes cluster, but the management plane still depends on Google Cloud.
Layer7 is self-hosted by design. It runs on a Java Virtual Machine with a MySQL database storing policies, audits, and configuration, and sits in the DMZ as a reverse proxy that enforces policy assertions on every message. Modern Layer7 (11.x) ships as software, a virtual appliance, or a Container Gateway for Kubernetes — giving you full control over the environment, including air-gapped networks.
Security & compliance
Layer7 is built around hardware-grade security — FIPS 140-2, HSM, PCI-DSS/HIPAA, and air-gapped deployment. Apigee provides solid OAuth2/JWT security and inherits Google Cloud certifications, with advanced threat detection as a paid add-on.
Layer7 originated as a security gateway for government and financial services, and that heritage shows: FIPS 140-2 validated cryptography, HSM integration, PCI-DSS and HIPAA controls, mTLS, and XML/SOAP firewalling, all running in environments you fully control — up to and including air-gapped deployments.
Apigee covers the common ground — OAuth2, JWT, API keys, SAML, and threat protection — and inherits Google Cloud's compliance certifications. Its more advanced controls (bot detection, abuse prevention, API risk assessment) ship as the Advanced API Security add-on, and because the control plane is Google-managed, your security posture is tied to Google's infrastructure rather than your own.
Apigee vs Layer7: feature comparison
Across architecture, deployment, protocols, security, and pricing, Apigee trades infrastructure control for managed convenience, while Layer7 trades convenience for self-hosted security and legacy depth.
| Feature | Apigee | Broadcom Layer7 |
|---|---|---|
| Architecture | Google-managed runtime with Message Processors; Cassandra-backed storage; cloud-native control plane | Java-based gateway with a MySQL database layer; reverse proxy in the DMZ enforcing policy assertions |
| Deployment | Fully managed on Google Cloud; Apigee hybrid runs the runtime in your own Kubernetes cluster | Software install (RHEL/CentOS), virtual appliance (VMware), and Container Gateway (Docker/Kubernetes via Helm or Operator) |
| Protocols | HTTP/1.1, HTTP/2, REST, gRPC, SOAP (over HTTP), GraphQL, WebSocket | HTTP/S, SOAP, REST; plus JMS, IBM MQ (MQ Native), LDAP, and FTP transports |
| Legacy integration | SOAP-to-REST and pass-through SOAP proxies; message queues need adapters or extra services | Native SOAP, JMS, IBM MQ, LDAP, FTP — built to bridge legacy and modern systems |
| Security & auth | OAuth2, JWT, API keys, SAML, threat protection; bot/abuse detection via Advanced API Security (add-on) | FIPS 140-2 validated crypto, HSM integration, mTLS, PCI-DSS/HIPAA controls; XML/SOAP firewalling |
| Policy model | JavaScript/Java policies, Shared Flows, and API products for packaging and access control | Visual Policy Manager with a drag-and-drop assertion palette for fine-grained, per-message policy |
| Developer portal | Integrated developer portal: self-service onboarding, interactive docs, API-key management | Layer7 API Developer Portal: API catalog, documentation, and developer onboarding |
| Observability | Built-in analytics dashboards and custom reports; Google Cloud Monitoring and Logging | Audit logging and transaction tracking; integrates with APM and third-party SIEM tools |
| Air-gapped / on-prem | No fully air-gapped option; Apigee hybrid still depends on a Google-hosted control plane | ✓ Fully self-hosted and air-gapped deployment supported |
| Vendor lock-in | Control plane tied to Google Cloud; hybrid still relies on Google-hosted management | Proprietary Broadcom stack; policy configurations are non-portable across products |
| Pricing model | Usage-based: evaluation, pay-as-you-go, and subscription (environments, API calls, deployment units) | Broadcom enterprise licensing, typically per-deployment with separate support contracts |
When to choose Apigee vs Layer7
Choose Apigee for cloud-managed API management on Google Cloud with integrated analytics; choose Layer7 for self-hosted security depth, compliance, and native legacy transports.
Choose Apigee if you…
- Want a fully managed API platform on Google Cloud
- Value an integrated developer portal and built-in analytics
- Are building modern HTTP/REST/gRPC APIs over legacy MQ transports
Choose Broadcom Layer7 if you…
- Need FIPS 140-2, HSM, and air-gapped, fully self-hosted deployment
- Must bridge legacy SOAP, JMS, and IBM MQ systems natively
- Operate in heavily regulated banking, government, or defense settings
Bottom line: pick Apigee when you want a fully managed API platform on Google Cloud with a developer portal and built-in analytics; pick Broadcom Layer7 when you need FIPS 140-2, air-gapped deployment, and native SOAP/JMS/MQ bridging in a self-hosted gateway. If you're weighing open-source API gateways more broadly, Apache APISIX is another option worth a look — see Apache APISIX vs Kong.
Frequently asked questions
Related comparisons
Apigee vs MuleSoft · Apigee vs Kong · Apache APISIX vs Kong · All gateway comparisons
Ready to get started?
For more information about full API lifecycle management, please contact us to Meet with our API Experts.
