Introduction

Finding the ARN for an API Gateway stage is one of those AWS tasks where the answer depends on what you mean by “stage ARN.” API Gateway uses more than one ARN format, and the correct one depends on whether you are referring to the management resource itself or to the invoke-style ARN used in IAM and Lambda permissions.

The safest approach is to identify which API type you have, collect the API ID and stage name, and then build the ARN in the format required by your use case.

Know Which ARN You Need

There are two common stage-related ARN patterns:

• the API Gateway management ARN for the stage resource itself
• the execute-api ARN used when you refer to invoked routes or methods

For a REST API stage resource, AWS documents the stage ARN in this form:

arn:aws:apigateway:region::/restapis/api-id/stages/stage-name

For an HTTP API or WebSocket API stage resource, the documented form is:

arn:aws:apigateway:region::/apis/api-id/stages/stage-name

If you are writing an IAM policy or Lambda permission for invocation, you will often need an execute-api ARN instead, such as:

arn:aws:execute-api:region:account-id:api-id/stage-name/GET/my-resource

That distinction is the source of most confusion.

Get the API ID and Stage Name

You can find both values in the AWS console, but the AWS CLI is often faster and less error-prone.

For a REST API:

aws apigateway get-rest-apis
aws apigateway get-stages --rest-api-id a1b2c3d4e5

For an HTTP API:

aws apigatewayv2 get-apis
aws apigatewayv2 get-stages --api-id a1b2c3d4e5

Once you know the api-id and the stage-name, the ARN is usually just string construction.

Build the Stage Resource ARN

If the question is specifically about the stage as an API Gateway resource, build the management ARN directly.

Example for a REST API stage named prod in us-east-1:

arn:aws:apigateway:us-east-1::/restapis/a1b2c3d4e5/stages/prod

Example for an HTTP API stage named dev:

arn:aws:apigateway:us-east-1::/apis/a1b2c3d4e5/stages/dev

Notice that these management ARNs do not include your AWS account ID in the same way execute-api ARNs do.

Build the Invoke ARN When Permissions Need It

A lot of people ask for the “stage ARN” when what they really need is the invoke ARN used in policies or lambda add-permission.

For a REST API or HTTP API invocation pattern, that usually looks like this:

arn:aws:execute-api:us-east-1:123456789012:a1b2c3d4e5/prod/GET/orders

You can widen it with wildcards when appropriate:

arn:aws:execute-api:us-east-1:123456789012:a1b2c3d4e5/prod/*/*

That form is commonly used when granting API Gateway permission to invoke a Lambda function or when restricting who can call particular routes.

A Small Shell Helper

If you already know the values, building the ARN is trivial.

1REGION="us-east-1"
2API_ID="a1b2c3d4e5"
3STAGE="prod"
4
5echo "arn:aws:apigateway:${REGION}::/restapis/${API_ID}/stages/${STAGE}"

For an invoke ARN:

1REGION="us-east-1"
2ACCOUNT_ID="123456789012"
3API_ID="a1b2c3d4e5"
4STAGE="prod"
5
6echo "arn:aws:execute-api:${REGION}:${ACCOUNT_ID}:${API_ID}/${STAGE}/*/*"

Use the Console if You Prefer Visual Confirmation

In the API Gateway console, open the API, go to the stage list, and note the stage name and API ID from the dashboard or URL. The console is fine for one-off lookups, but the CLI is better when you want repeatable infrastructure documentation or scripting around deployments.

Common Pitfalls

The biggest mistake is mixing up the management ARN and the invoke ARN. They are both valid, but they serve different purposes.

Another issue is using the wrong service namespace. The stage resource itself uses the apigateway namespace, while route invocation permissions typically use execute-api.

People also sometimes forget whether the API is REST or HTTP API. The management ARN path differs: REST APIs use /restapis/..., while HTTP APIs use /apis/....

Finally, avoid guessing the account ID part for invoke ARNs. Pull it from AWS CLI with aws sts get-caller-identity if you are not sure.

Summary

• “Stage ARN” can mean either the API Gateway stage resource ARN or an execute-api invoke ARN.
• For REST API stage resources, use arn:aws:apigateway:region::/restapis/api-id/stages/stage-name.
• For HTTP API stage resources, use arn:aws:apigateway:region::/apis/api-id/stages/stage-name.
• For invoke permissions, use the arn:aws:execute-api:... pattern instead.
• Use the AWS CLI to fetch the api-id and stage-name before constructing the ARN.