🔗Interactive Checklist
API Strategy & Governance Checklist
Assess API programme maturity across design, security, documentation, and lifecycle.
20 items0%
Critical items (marked ★) carry higher weight. Prioritise Strategy & Design and Security & Access — these are foundational to a scalable, secure API programme.
Strategy & Design
Define a coherent API strategy aligned with business and technology goals.
0/5
An API strategy is documented and aligned with enterprise architecture and business platform goals.★ Critical
API design standards are defined (e.g., RESTful conventions, naming, versioning, pagination, error handling).★ Critical
An API-first design approach is adopted for new services, with contracts defined before implementation.
Domain-driven design principles are applied to define bounded contexts and API boundaries.
API product management practices are in place, treating APIs as products with consumers, roadmaps, and feedback loops.
Security & Access
Secure APIs against abuse and enforce appropriate access controls.
0/5
API authentication and authorisation use industry standards (OAuth 2.0, OpenID Connect, API keys with scoping).★ Critical
Rate limiting and throttling are configured to prevent abuse and protect backend systems.
Input validation and output encoding are enforced to prevent injection attacks.
API traffic is encrypted in transit (TLS 1.2+) and sensitive data is not exposed in URLs or logs.
API security testing (DAST, fuzzing) is integrated into the CI/CD pipeline.
Lifecycle Management
Manage APIs across their full lifecycle from creation to retirement.
0/5
An API catalogue or developer portal provides discoverable, up-to-date documentation for all APIs.
API versioning strategy is defined and consistently applied (e.g., URI versioning, header versioning).
Deprecation and sunset policies are published, with advance notice and migration support for consumers.
API monitoring tracks availability, latency, error rates, and usage patterns in real time.★ Critical
Contract testing validates that API changes do not break existing consumer integrations.
Governance & Standards
Establish governance to maintain quality and consistency at scale.
0/5
An API governance body or community of practice reviews new APIs for compliance with standards.
Automated linting enforces API design standards at build time (e.g., Spectral, Optic).
API usage analytics inform investment decisions, deprecation timing, and consumer engagement.
SLAs are defined for Tier 1 APIs with availability, latency, and throughput commitments.
API governance metrics (standards compliance, documentation coverage, breaking change rate) are tracked and reported.