HttpApi

An API Gateway HTTP API with throttling, one-year access logs and strict CORS by default. Add a custom domain or protect every route in one line.

API & Auth · anvil:aws:HttpApi

Throttling defaults to 1000 rps / 500 burst so a single route can't exhaust the account-wide limit shared across all your APIs.

Minimal

The smallest config that deploys.

import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';

export default new App({
  run(ctx) {
    const handler = new anvil.aws.Lambda('users', {
      runtime: 'nodejs24.x',
      handler: 'functions/users/index.handler',
    });

    new anvil.aws.HttpApi('api', {
      routes: [{ method: 'GET', path: '/users', consumer: { lambda: { arn: handler.arn } } }],
    });
  },
});

import anvil_cloud as anvil

def infra(ctx: anvil.Context):
    handler = anvil.aws.Lambda("users",
        runtime="nodejs24.x",
        handler="functions/users/index.handler",
    )

    anvil.aws.HttpApi("api",
        routes=[{"method": "GET", "path": "/users", "consumer": {"lambda_": {"arn": handler.arn}}}],
    )

anvil.App(run=infra)

package main

import (
    "github.com/anvil-cloud/anvil/sdk/go/anvil"
    anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
    anvil.Run(anvil.AppConfig{
        Run: func(ctx *anvil.Context) error {
            handler, err := anvilaws.NewLambda(ctx.PulumiCtx(), "users", &anvilaws.LambdaArgs{
                Runtime: anvilaws.LambdaRuntime_Nodejs24_x,
                Handler: pulumi.String("functions/users/index.handler"),
            })
            if err != nil {
                return err
            }

            _, err = anvilaws.NewHttpApi(ctx.PulumiCtx(), "api", &anvilaws.HttpApiArgs{
                Routes: anvilaws.HttpApiRouteArray{
                    anvilaws.HttpApiRouteArgs{
                        Method:   anvilaws.HttpApiMethod("GET"),
                        Path:     pulumi.String("/users"),
                        Consumer: anvilaws.HttpApiRouteConsumerArgs{Lambda: &anvilaws.HttpApiLambdaConsumerArgs{Arn: handler.Arn}},
                    },
                },
            })
            if err != nil {
                return err
            }
            return nil
        },
    })
}

Good to know

Routes are public unless you set defaultAuthorizerId from a CognitoAuth or OAuthAuthorizer. Then every route needs a valid token, and skipAuth opts single routes out.
Throttling defaults to 1,000 requests a second with bursts of 500, so one API can't use up the account-wide limit your other APIs share.
CORS is off until you set cors. allowOrigins is required, and '*' is rejected.
With domain, Anvil creates the certificate and DNS record and turns off the default execute-api URL, so all traffic goes through your domain.
AWS WAF can't attach to HTTP APIs. Verify webhook signatures and use an authorizer instead.

The Full example tab has a complete program. Every argument and attribute is on the Reference tab.