Mastering API Product Governance

POSTED : May 31, 2022

BY : Lena Chipman

Today, companies of all sizes, in all industries, depend on delivering on the potential of their application programming interfaces (APIs) for future success. To accomplish this, you need a robust API product governance model.

Unfortunately, most companies look narrowly at infrastructure or compliance governance when designing governance models, instead of thinking about how a properly governed API program can generate value for the business. A good API program creates:

Capability democratization: The ability to give API consumers access to capabilities that they require to conduct business and create value, without having to go through internal gatekeepers.
Consumer independence: Building APIs to serve as answers to the consumer’s problem — whether that consumer is someone inside the organization, a partner, or a customer— while enabling self-service by understanding, testing, requisitioning, and going live with an API with little or no human intervention.

These two key drivers of an API program’s business value accelerate delivery by providing ready access to your core capabilities and, in doing so, enable innovation. Since single-variant productized APIs can replace dozens of integrations, you can create trusted security patterns and reduce the number of potential attack points. Independent API consumption also increases organizational efficiency by freeing IT resources to focus on creating value elsewhere, instead of helping customers consume existing value. Through a strong API governance framework, democratization and consumer independence reduce friction and increase agility throughout the organization.

API governance makes all this happen. Here are a few key areas that API governance should encompass:

Productization: Governance should determine consumer orientation, design, packaging, and self-service. Productization—the act of treating APIs more like products as opposed to one-off internal projects—gives you a foundation of strategic, reusable APIs that create a flywheel effect, delivering economies of scale while accelerating delivery.
Security: While you may have policies, procedures, and protections in place for run-of-the-mill breaches, such as phishing and malware, you may be caught off guard by the new threat APIs pose. You can protect sensitive customer and organizational data from bad actors seeking to exploit vulnerabilities in your APIs through a strong governance model. API governance should yield tight security measures, such as transport and message security, threat modeling, and AuthN/AuthZ patterns.
Organization: API governance should create dedicated, multi-functional teams that are aligned with the value derived by the business. Multi-functional teams are more efficient, more effective, and happier, and they are focused on tangible deliverables that can be measured for value and provide job satisfaction. In addition, a well-organized API governance enables you to understand scalability, resilience, high availability, and points-of-presence—all the aspects of the system that will ensure your organization satisfies the demand that’s driving the value of the company.

To learn the six other areas that API product governance should address, download our whitepaper, The API Economy Playbook.