1. How are security issues / CVEs patched and notified

We monitor continuously for security issues in your version of Apiman. This includes the specific distribution and setup you are using.

As soon as we detect a potential issue, we begin the process of assessing and creating patches. We proactively reach out to customers to advise them of the level of risk posed, and how best to proceed, whether that be a patch or application of configuration changes.

• Detection: we use CVE scanning tools and monitor public CVE repositories to find out as soon as possible when an issue might affect your version of Apiman. This is not just Apiman code itself, but also in libraries and platforms that Apiman uses.
• Notifications: we inform you promptly via our support portal about vulnerabilities, and any initial mitigations that may be required. You get to find out about issues as soon as possible, rather than having to monitor.
• Patch and deploy: we immediately begin working on patching the problem. We inform you as soon as this work has been completed, ensuring you can roll it out promptly. Instructions are provided, as required.
• Assessment: our Apiman experts assess all potential CVEs to determine whether Apiman is affected by the disclosed security issue and what the severity of the problem is. It requires a deep understand of the Apiman codebase to understand whether the vulnerable code is used, and whether the vulnerability can actually be exploited.

2. Which platforms do you support?

We support Apiman on WildFly, EAP, and Tomcat.

We also support the Vert.x Apiman Gateway.

Note, our support is for Apiman and not for the unrelated functionality in the underlying platform, although we do provide CVE alerts, where relevant.

If you use a paid-for platform like Red Hat EAP, you will need to hold those subscriptions separately (i.e. we don't sell EAP itself).

3. Do you offer long-term support for older version of Apiman?

Yes.

There may be some limitations, depending on the specifics of the version you are still using.

4. Can you provide advice and assistance for migrating to newer version of Apiman?

Yes, as part of our support, we help customers migrate to newer versions of Apiman. Please contact us.

5. How are cores counted?

We have a separate guide that provides extra detail, but in short:

• Physical core: each physical core would be counted, if running on bare metal/physical deployment.
• Virtual core: each virtual core is counted, as long as it does not span more than a single physical core.
• Resource isolation (e.g. cgroups): if the operating system imposes a strictly guaranteed limit, the number of assigned cores is counted.

Our pricing model is as flexible and transparent as possible, avoiding the bill shock that comes with per-request pricing that is common in other supported API Management platforms.

Whether you are using cloud or on-prem, we want to make Apiman work for you.

Income we receive helps fund the continued development of the open source project.

6. Can you answer our development and operational questions?

Absolutely. Developer questions are included in our support packages, allowing you to open a defined number of questions in parallel with our team.

As the main developers and co-founders of Apiman, we have a comprehensive understanding of the project. With our support packages you get direct access to the expertise of the development team.

Whether it's answering questions about writing custom Apiman plugins, Apiman components, or advice integration issues — we can help.

If more hands-on support is required, we also provide consulting: we've helped customers seamlessly integrate API Management capabilities into their platforms, write custom plugins, debug complex issues, and much more besides. All packages are bundled with some hours of consulting, and we can sell additional hours of our as needed on top of support.

Please contact us, we'd be delighted to help you.