A donor registry is an unusual place to look for a software business model. Yet consider what NMDP needs to do: move sensitive information among hospitals, doctors, registries, and other partners whose computer systems were never designed as one machine. A promising match is useful only if the right information can travel. The distance between two databases can become a very human problem.
- WSO2 connects applications, manages APIs, and controls digital access.
- Its open-source software comes with paid cloud services, updates, and support.
- The latest bet: apply those controls to AI agents.
01 / The gap is the product
NMDP needed older SOAP services and newer REST APIs to coexist securely. Its previous middleware fell short of its combined requirements for cost and direct vendor support. It chose WSO2’s API and integration products, evaluated the open code, and worked through a three-phase deployment over 12 months. Custom authentication and configuration were part of the work.
The interesting detail is the calendar. Twelve months sounds unglamorous beside a software demo. It also tells you what enterprise integration involves: checking the exceptions, protecting confidential information, and making yesterday’s systems participate in tomorrow’s service. WSO2 occupies that territory. Its expertise lies in the connections and permissions that make a digital product usable beyond its own screen.
A second example comes from India’s Reserve Bank Innovation Hub. Its Unified Lending Interface uses WSO2 API Manager and Identity Server to help lenders reach financial and non-financial data through shared infrastructure. Previously, lenders faced separate connections to scattered providers. The distinction matters: adding another data source should not require every participant to invent the connection again. The work includes standardizing access and authenticating participants, rather than merely moving bytes faster. Healthcare and lending have different purposes, but both expose the same expensive habit: organizations repeatedly solving the boundaries between their systems.
moves the data
sets traffic rules
controls access
One business transaction can need all three.
02 / An open door into enterprise software
Sanjiva Weerawarana and Paul Fremantle founded WSO2 in 2005. Both brought IBM experience; Sri Lanka supplied the company’s roots. They entered a business in which buyers understandably worry about dependence. Once a bank builds its services around a vendor’s software, changing that software can mean changing much else.
Open source gives a buyer something concrete to inspect. Engineers can read the code, try an integration, and judge whether a product fits before making a commercial commitment. ScottishPower’s account of choosing WSO2 specifically mentions the ability to download and use API Manager at no additional cost. Evaluation becomes an engineering exercise, alongside the sales conversation.
WSO2’s alternatives include Google Apigee, Kong, MuleSoft, and cloud providers’ API services. Its particular appeal is the combination of API management, integration, and identity, with a choice of deployment environments. Those capabilities are available elsewhere in the market. The buying question is how well they fit together in your environment, and how much control your team needs.
03 / The download is only the beginning
An API is a defined way for one application to ask another for something. WSO2 API Manager helps teams publish those interfaces and enforce rules around their use. Its integration tools connect applications and transform information between them. Identity Server handles authentication and access; Asgardeo offers cloud identity services. The engineering platform addresses deploying and operating applications.
There is also Ballerina, the programming language WSO2 created for integration. Building a language is a revealing response to a customer problem. The company has gone down into the developer’s tools, as well as up into the enterprise’s control panels. That breadth can suit an organization with tangled systems and a substantial engineering team.
The commercial bargain starts after access to the code. WSO2 sells maintained distributions, updates, production support, onboarding, and cloud services. Its API Platform pricing, checked in October 2026, lists Growth from $119 a month, covering up to ten managed interfaces and ten million gateway events. Enterprise pricing is custom. That entry price should never be mistaken for a hospital network’s complete project budget.
Published starting price.
10 managed interfaces · 10M gateway events
October 2026. Enterprise plans are quoted separately.
Someone still has to configure permissions, monitor failures, apply patches, and pay for infrastructure. Self-hosting makes those responsibilities especially visible. For a small application with one straightforward connection, a broad middleware platform may add unnecessary work. For a regulated organization linking many systems, those same controls may be the reason to buy.
That suggests a useful procurement exercise. Put a legacy endpoint, an external partner, and a sensitive record into the same trial. Ask who can call the service, what happens when the destination fails, and who will diagnose the fault at night. Compare the staffing and support requirements across deployment options. This is an editorial test for buyers, rather than a promise from WSO2: a successful demonstration should expose the work your team will inherit, as well as the features it will receive.
04 / The cloud took a change of mind
In a February 2022 essay, Weerawarana described a company learning to think beyond individual middleware products toward the experience of building applications. He said identifying those experiences had taken time. Choreo and Asgardeo represented the move toward cloud services that absorbed more operational complexity for developers. The ambition remained familiar; the delivery model was changing.
Capital followed that direction. Goldman Sachs supplied a $90 million first tranche in November 2021; RedStart Labs joined the Series E, which closed at $93 million in May 2022. EQT completed its acquisition of WSO2 in August 2024. In May 2025, WSO2 bought Moesif, bringing API analytics and monetization into the portfolio.
“What is the problem you’re trying to solve?”
Sanjiva Weerawarana · McKinsey interview, 2025
The founder’s description of WSO2’s culture puts debate near the center: people should explain their disagreement, and revise their views when evidence changes. For a company selling infrastructure, that is a useful discipline. A beautifully argued architecture still has to survive the customer’s awkward, specific system.
05 / Now the caller is an agent
In May 2026, WSO2 announced Agent Manager in beta: a control plane for identifying agents, enforcing policies, and tracing their activity across environments. In August it added fully self-managed AI Workspace deployment. Harry Ault became CEO that month, following Weerawarana’s departure from the role in May and an interim leadership period.
The new vocabulary can obscure an old question. If software can take an action, who authorized it? WSO2 is extending its existing work on connections and access into that question. The practical lesson for a buyer is equally grounded: choose one difficult transaction, test its permissions and failure paths, and measure the effort to operate it. Start where the systems disagree. That is where the value has to show up.