Skip to content
Apiway Docs

Govern my existing APIs

You already have APIs running. You want governance around them — design standards, approval flows, compliance — without rebuilding anything.

What you need

Section titled “What you need”
  • An Apiway tenant (register free — £1,000 credit included)
  • Your existing OpenAPI specs

The pipeline

Section titled “The pipeline”

  1. Register your APIs

    Upload each OpenAPI spec to create a governed record. No redeployment required — this registers the contract, not the runtime.

    Terminal window
    curl -X POST https://core.api.apiway.net/v1/programmes \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "name": "Orders API",
        "specification": "<base64-encoded OAS>"
      }'

  2. Review the compliance score

    The platform analyses your spec against your organisation’s design standards and returns a compliance report:

    Terminal window
    curl https://core.api.apiway.net/v1/programmes/{id}/compliance \
      -H "Authorization: Bearer $TOKEN"

    Common findings: missing descriptions, inconsistent naming, no security definitions, missing versioning headers.

  3. Accept or dismiss recommendations

    The platform suggests improvements — accept the ones that matter, dismiss the rest. Your spec is updated automatically.

  4. Configure approval workflows

    Set who approves API changes for your organisation:

    • By team, by environment, or by API classification
    • Auto-approve for non-breaking changes
    • Require manual review for breaking changes or new APIs

    See Approval Flows for configuration details.

  5. Enable drift detection

    Once governed, the platform compares your live implementation against the registered spec. Drift is flagged automatically — shadow endpoints, mismatched types, undocumented responses.

What you got

Section titled “What you got”
  • Design standards enforced — every API checked against the same rules
  • Approval workflows — changes reviewed before they reach production
  • Drift detection — know when code diverges from the contract
  • Audit trail — who approved what, when, and why
  • Compliance score — organisation-wide view of API quality

Next steps

Section titled “Next steps”