# API Audit — API Productization Cycle Canonical page: https://apiopscycles.com/cycles/api-productization-cycle/stations/api-audit Language: en Entity ID: api-audit Cycle: [API Productization Cycle](https://apiopscycles.com/cycles/api-productization-cycle.md) Read [shared station guidance](https://apiopscycles.com/stations/api-audit.md) first. The sections below supplement or replace the corresponding shared sections for this cycle. Sections not repeated here retain the shared guidance. ## Journey entry criteria - The chosen architecture, platform, and implementation style have been validated with the relevant architecture, security, and platform stakeholders. — The chosen API architecture and platform patterns have been validated with the relevant architecture, security, and platform stakeholders. (ID: architecture-patterns-validated) - The selected interface provides an appropriate abstraction for consumers. — The API is intended to shield consumers from backend complexity and inconsistencies. (ID: hide-backend-discrepancies) - The interface design and exposed capabilities trace back to business value and consumer needs. — The API design and exposed capabilities clearly trace back to business value and user needs. (ID: design-reflects-business-value) - The interface design follows agreed design standards and conventions. — The API design follows our shared API product and design conventions. (ID: api-consistency) ## Journey exit criteria - The chosen architecture, platform, and implementation style have been validated with the relevant architecture, security, and platform stakeholders. — The chosen API architecture and platform patterns have been validated with the relevant architecture, security, and platform stakeholders. (ID: architecture-patterns-validated) - The interface design and exposed capabilities trace back to business value and consumer needs. — The API design and exposed capabilities clearly trace back to business value and user needs. (ID: design-reflects-business-value) - The interface and its capabilities are documented clearly enough for review, audit, and onboarding. — The API and its exposed capabilities are described clearly enough for review, audit, and onboarding. (ID: api-description-available) - The interface design follows agreed design standards and conventions. — The API design follows our shared API product and design conventions. (ID: api-consistency) - The interface contract has been validated and tested against functional and non-functional requirements. — The API contract is tested and meets functional and non-functional requirements. (ID: api-contract-tested) ## Description Validate that APIs meet business, design, and operational standards before release. ## Why it matters APIs are long-lived products and must meet expectations for quality, consistency, and compliance. The audit connects design decisions, implementation, and operational readiness to defined standards, reducing risk before exposure. ## Apply in work Establish a consistent audit process that evaluates API readiness across lifecycle stages using defined criteria, evidence, and standards. Ensure gaps are identified early and resolved before release. ## Outcomes - APIs meet internal and external standards - Clear documentation of API design and implementation decisions - Security, performance, and compliance validated - Reduced risk of issues in production ## Steps 1. Conduct audits to ensure APIs meet organizational, technical, and legal standards before release. 2. Use checklists, linters, and testing tools to verify consistency and conformance with standards. 3. Collaborate with governance teams and domain experts to ensure APIs are ready for production. 4. Decide whether the release is ready, ready with conditions, requires remediation, or is not approved. 5. Record the decision owner, decision date, and evidence used. 6. Confirm that nothing proceeds to release without clear business and operational ownership. ## Questions - Conduct audits to ensure APIs meet organizational, technical, and legal standards before release. - Use checklists, linters, and testing tools to verify consistency and conformance with standards. - Collaborate with governance teams and domain experts to ensure APIs are ready for production. - Establish a consistent audit process that evaluates API readiness across lifecycle stages using defined criteria, evidence, and standards. Ensure gaps are identified early and resolved before release. - APIs are long-lived products and must meet expectations for quality, consistency, and compliance. The audit connects design decisions, implementation, and operational readiness to defined standards, reducing risk before exposure. ## Role participation and responsibilities - [API Governance Owner](https://apiopscycles.com/roles/governance-specialist.md) (lead): Represents review, audit, and organization-wide governance practices for API quality and conformity. - [API Designer](https://apiopscycles.com/roles/api-designer.md) (core): Shapes the interface contract, interaction model, consistency, and usability of the exposed capabilities. - [Compliance and Legal Specialist](https://apiopscycles.com/roles/compliance-specialist.md) (core): Clarifies legal, privacy, regulatory, and contractual requirements that affect the capability, API, interface, or automation. - [Delivery Engineer](https://apiopscycles.com/roles/api-engineer.md) (core): Owns implementation, automation, testing, and release flow concerns needed to deliver the capability, API, or automation reliably. - [Security Specialist](https://apiopscycles.com/roles/security-specialist.md) (core): Ensures security risks, controls, and trust boundaries are addressed throughout the API lifecycle. - [API Product Owner](https://apiopscycles.com/roles/api-product-owner.md) (consulted): Drives the API opportunity, prioritization, and product-level decisions across the lifecycle. - [Business Owner](https://apiopscycles.com/roles/business-owner.md) (consulted): Represents business goals, funding, and expected outcomes for the capability, API, or automation initiative. - [Platform Architect](https://apiopscycles.com/roles/platform-architect.md) (consulted): Guides platform, integration, scalability, and architecture decisions that shape how the capability or API is built and operated. - [Support and Operations Owner](https://apiopscycles.com/roles/operations-specialist.md) (consulted): Represents runtime support, incident handling, observability, and operational readiness for the capability, API, or automation. ## Resources - [API Audit Checklist](https://apiopscycles.com/resources/api-audit-checklist.md)