APIM 4.x: the big picture¶
Which version is this?
This section describes the database of WSO2 API Manager 4.7.0. Other 4.x releases share the same core design, but newer releases add tables.
APIM in one paragraph¶
API Manager lets API creators design APIs in the Publisher and deploy them to gateways. API consumers find those APIs in the Developer Portal, create an application, subscribe it to APIs and generate OAuth keys. Their software then gets an access token and calls the API through the gateway, which checks the token, the subscription and the rate limits. Almost every one of those steps leaves rows in the database. This section explains those rows.
The numbers¶
| What | Count |
|---|---|
Tables in the APIM database (WSO2AM_DB) |
247 |
Tables in the shared database (WSO2SHARED_DB) |
51 |
| Total tables | 298 |
AM_* tables (API Manager's own) |
112 |
GOV_* tables (API governance) |
14 |
Tables inherited from WSO2 Identity Server (IDN_*, SP_*, IDP_*, CM_*, FIDO*) |
114 |
WF_* workflow engine tables |
7 |
Registry (REG_*) and user store (UM_*) tables |
17 + 34 |
About 210 relationships are real foreign keys (168 in the APIM DB, 43 in the shared DB). Roughly another 60 are logical links that only the code enforces: the columns match, but the database doesn't check them. The domain pages call out every one of them.
The hub: the tables everything else hangs off¶
This diagram shows only the most important tables and how they connect. Everything else in the database hangs off one of these.
flowchart LR
SUB[Subscriber] --> APP[Application]
APP --> S[Subscription]
API[API] --> S
API --> URL[Resources / URL mappings]
API --> REV[Revision]
REV --> ENV[Gateway environment]
APP --> KEY[Key mapping]
KEY -.logical.-> OAUTH[OAuth client & tokens]- Left side (consumers). A subscriber owns applications, and an application subscribes to APIs.
- Right side (creators). An API has resources and gets snapshotted into revisions, which are deployed to gateway environments.
- Bottom (security). Each application has key mappings that point to an OAuth client in the key manager. The dashed line means the database doesn't enforce that link.
| Box | Main table |
|---|---|
| Subscriber | AM_SUBSCRIBER |
| Application | AM_APPLICATION |
| Subscription | AM_SUBSCRIPTION |
| API | AM_API |
| Resources | AM_API_URL_MAPPING |
| Revision | AM_REVISION |
| Gateway environment | AM_GATEWAY_ENVIRONMENT |
| Key mapping | AM_APPLICATION_KEY_MAPPING |
| OAuth client & tokens | IDN_OAUTH_CONSUMER_APPS, IDN_OAUTH2_ACCESS_TOKEN |
Rate limits (throttling policies) attach to three of these boxes: to the subscription (subscription tier), to the application (application tier) and to each resource (resource tier). See Throttling policies.
Where to go next¶
Domains (groups of related tables):
| Domain | What it covers |
|---|---|
| Tenants & users | Tenants, organizations, users and roles, plus per-organization settings |
| Registry | The generic store that keeps each API's full metadata and documents |
| API definition | The API itself: resources, endpoints, certificates, categories, service catalog |
| Scopes | Permission names attached to API resources |
| Operation policies | Reusable mediation attached to APIs, resources and gateways |
| API products | Bundles of resources from several APIs |
| Revisions & deployment | Snapshots of APIs and getting them onto gateways |
| Lifecycle & labels | Created → Published → Retired history, and API labels |
| Applications & subscriptions | Consumers, their apps and what they subscribe to |
| Keys & tokens | Key managers, OAuth clients, access tokens, API keys |
| Revocation | How revoked tokens and apps are remembered |
| Throttling policies | Rate limits at every level |
| Workflows | Approval steps |
| Governance | Rulesets, policies and compliance results |
| AI APIs | LLM providers, AI API configuration and MCP servers |
| Developer Portal extras | Comments, ratings, portal content, webhooks |
| Everything else | Monetization, alerts, analytics uploads, housekeeping |
Core flows (step-by-step stories): start at All flows, or jump to Create an API, Deploy a revision, Subscribe or Generate keys.
Before you query anything, read the Gotchas. They'll save you from the most common wrong joins.
Different in 3.x
3.x has no revisions, gateway environments in the database, organizations, operation policies, governance or AI tables, and its AM_API table has no UUID column. See the 3.x overview and the 3.x vs 4.x comparison.