CloudWatch Metric Guide
5XXErrorAmazon API Gateway CloudWatch metric
5XXError counts server-side errors returned by API Gateway in a given period — responses indicating the backend integration failed, timed out, or API Gateway itself hit an internal problem. The Sum statistic gives the raw count; the Average statistic gives the error rate (5XXError count divided by total Count).
What it measures
About 5XXError
5XXError counts server-side errors returned by API Gateway in a given period — responses indicating the backend integration failed, timed out, or API Gateway itself hit an internal problem. The Sum statistic gives the raw count; the Average statistic gives the error rate (5XXError count divided by total Count).
| Namespace | AWS/ApiGateway |
| Metric name | 5XXError |
| Unit | Count |
| AWS docs | Official Amazon API Gateway metrics reference |
Why this metric matters
5XXError is the clearest signal that something is actually broken on the server side — unlike 4XXError, which is dominated by normal client behavior, a 5XXError means API Gateway or your backend failed to do its job. A spike here almost always correlates with a real customer-facing outage: failed logins, broken checkouts, missing data.
API Gateway itself returns specific 5XX codes for specific failure modes worth knowing: 502 typically means the backend (often a Lambda function) returned a malformed response API Gateway couldn't parse, 503 means the endpoint is unavailable, and 504 means the integration timed out (API Gateway's own integration timeout is a hard ceiling — 29 seconds for REST APIs — independent of whatever timeout your backend thinks it has). Distinguishing these requires looking at execution logs, but the 5XXError metric is what should wake someone up first.
Recommended alarm threshold for 5XXError
Recommended threshold
Average (error rate) ≥ 1% over 5 minutes, OR any 5XXError on low-traffic APIs
AWS does not publish a target 5XX rate — 0% is the implicit goal, but the practical alarm threshold (Nuberio recommendation) needs to tolerate the occasional transient error without paging on noise. On APIs with low request volume, a rate-based (Average) alarm can be too insensitive — a Sum-based alarm on any 5XXError count is often more appropriate there. On higher-volume APIs, 1% sustained for 5 minutes distinguishes a real backend problem from a handful of isolated failures.
Is your 5XXError alarm already set up correctly?
The free Nuberio Audit scans your CloudWatch setup and flags missing or misconfigured alarms — including 5XXError — in 5 minutes.
Common failures that show up in 5XXError
When 5XXError reaches an alarm threshold, these are the most common root causes — in order of how often Nuberio sees them across customer AWS accounts.
Backend integration timeout (504) — the Lambda function, HTTP endpoint, or VPC link target takes longer than API Gateway's integration timeout to respond
Malformed Lambda response (502) — a Lambda proxy integration returns a response that doesn't match the shape API Gateway expects (missing statusCode, invalid JSON body)
Backend deployment failure — a bad deploy takes the integration target down entirely (Lambda throwing on every invocation, ECS service with zero healthy tasks)
Downstream dependency outage — the backend is healthy but the database, cache, or third-party API it depends on is not, and errors propagate up as 5XX
Concurrency/throttle limits on the backend — a Lambda integration hits its reserved concurrency ceiling and API Gateway surfaces the resulting throttle as a 5XX to the client
How the Nuberio Audit checks 5XXError
The free Audit scans every Amazon API Gateway resource in your account and checks whether a 5XXError alarm exists, whether its threshold and evaluation period are configured sensibly, and flags it if it's missing entirely. Every finding comes with the exact CLI command to fix it — read-only access, no credit card, results in about 5 minutes.
Nuberio Audit
Scans your CloudWatch setup for missing or misconfigured 5XXError alarms. Free, 5-minute read-only scan.
Related Amazon API Gateway metrics
5XXError rarely fails in isolation. These metrics tend to correlate — monitor them together for complete Amazon API Gateway coverage.
FAQ
Frequently asked questions about 5XXError
Common questions about setting up CloudWatch alarms for 5XXError in Amazon API Gateway.
What is the recommended CloudWatch alarm threshold for 5XXError?+
Average (error rate) ≥ 1% over 5 minutes, OR any 5XXError on low-traffic APIs. AWS does not publish a target 5XX rate — 0% is the implicit goal, but the practical alarm threshold (Nuberio recommendation) needs to tolerate the occasional transient error without paging on noise. On APIs with low request volume, a rate-based (Average) alarm can be too insensitive — a Sum-based alarm on any 5XXError count is often more appropriate there. On higher-volume APIs, 1% sustained for 5 minutes distinguishes a real backend problem from a handful of isolated failures.
Which CloudWatch namespace does 5XXError belong to?+
5XXError is published in the AWS/ApiGateway namespace with a unit of Count. You can find it in the CloudWatch console under "Metrics" → "AWS/ApiGateway". See the Amazon API Gateway CloudWatch metrics reference in the AWS documentation.
Does Nuberio automatically create CloudWatch alarms for 5XXError?+
No — the free Nuberio Audit does not create alarms for you. It scans your CloudWatch setup and tells you which Amazon API Gateway resources are missing a 5XXError alarm, then gives you the exact CLI command to create it yourself.
Can I use Nuberio without already having a 5XXError alarm set up?+
Yes. The free Audit works whether or not you have any 5XXError alarm configured — it reads the resource directly from CloudWatch and tells you which resources need one, plus the copy-paste AWS CLI command to create it.
This page is part of the CloudWatch metric guide — thresholds and debugging guidance for every metric across RDS, Lambda, ECS, ALB, EC2, and DynamoDB. To find which Amazon API Gateway alarms your account is missing — including 5XXError — run the free CloudWatch alarm audit. The scan takes under 5 minutes and requires no account.