Anypoint API Governance Overview

We updated the terminology in the API Governance UI to reflect a broader range of asset types. Where Governance previously used "APIs," it now uses "Services." There are no changes to functionality. During this transition, this documentation includes a mix of the new and previous terms.

Anypoint API Governance is a component of Anypoint Platform that lets you apply governance rules to your services, including APIs, agents, MCP servers, and gateways, as part of the service lifecycle.

With Anypoint API Governance:

Improve your organization’s service quality:

Identify conformance issues in governed services and add governance strategies to resolve them and enforce standards.
Customize governance rules using Controls strategies, available only in the enhanced MuleSoft experience:

To access the full ruleset library with conditions configuration, rule-level selection, and severity customization, create Controls directly in the enhanced MuleSoft experience.
Apply consistent governance from design time to deployment:

Use governance strategies to apply centralized governance across your services from API specifications at design time to gateway-enforced policies at deployment, targeting Omni Gateways, Mule Gateways, or all runtimes.
Apply consistent governance across multiple gateway runtimes, available only in the enhanced MuleSoft experience:

Create governance strategies that target Omni Gateways, Mule Gateways, or all runtimes simultaneously to ensure uniform governance posture across your entire service infrastructure. See Working with Governance Strategies.
Enforce governance within your DevOps organization:

Automate service governance in your CI/CD pipeline with CLI commands or through the experience API. Use Controls strategies to optionally block non-compliant actions and enforce standards at the gateway level.

Governance Dashboard

The API Governance Dashboard offers an organization-wide view of your service landscape. Review the overall status of your services, identify areas that require attention, and take steps to improve your governance posture.

From the API Governance Dashboard:

View metrics such as Governance Coverage, the number of services governed by Controls, services governed by Automated Policies, and overall compliance posture across your service portfolio.
Understand the distribution of your services by type, including REST API, AsyncAPI, HTTP API, agent, MCP server, LLM proxies, and gateways.
Understand your governance posture, including conformance status and nonconformance severity for governed services.
Take action from the Dashboard based on the presented metrics, such as creating new governance strategies to govern unprotected services and viewing lists of services for further review.

See Governance Dashboard Overview for details.

Governance Strategies

Governance Strategies is available only in the enhanced MuleSoft experience. For the complete workflow, see Working with Governance Strategies.

In the Governance Strategies page, governance administrators can:

Create governance strategies of two types, Controls or Automated Policies, to apply governance rules to a targeted set of services.
Monitor compliance posture, notify developers, and optionally enforce blocking rules to prevent non-compliant actions across targeted services.

Governance Strategy Types

Controls: Validate targeted services against selected control rules and optionally block non-compliant actions, while automatically publishing your live compliance posture. Controls created in Anypoint API Governance have limited ruleset selection. For advanced features such as conditions configuration, rule-level selection, and severity customization, create controls directly in the enhanced MuleSoft experience.
Automated Policies: Enforce consistent policy requirements across targeted services to ensure uniform governance and automated security.

See Governance Console Overview for details.

Governance Across Anypoint Platform

In addition to viewing conformance information in the Governance Strategies page, these personas can view governance information and take action across Anypoint Platform:

Governance Leads and Security Architects: Create and manage cross-gateway governance strategies, review coverage metrics, and enforce standards across all service types.
API Owners: Review policy posture and conformance status for their services in Exchange.
API Admins: Connect Omni Gateways and Mule Gateways as governance targets and manage runtime-level enforcement.
Developers and Architects: Check specification conformance during the API design phase.
Implementors: Review governance reports for API instances in API Manager.

Exchange
- API owners can view conformance status details for published API specifications, discover rulesets, and publish custom rulesets.
- Implementors can view rulesets to determine how to fix API instance conformance issues.

Anypoint Code Builder and Design Center:
- Developers or architects can check API specification conformance in the API design phase by applying governance rulesets directly to API specifications as dependencies.

API Manager:
- Implementors can check API instance conformance by viewing comprehensive governance reports.

Gateway Management (enhanced MuleSoft experience only):
- API admins can connect Omni Gateways and Mule Gateways as governance targets and view per-gateway compliance posture from the Governance Strategies scope configuration.

Anypoint API Governance Concepts

These are the key concepts for using Anypoint API Governance.

governance profiles: A governance profile applies selected governance rulesets to a filtered group of APIs. API Governance then validates the APIs against the rulesets to determine governance conformance.

active profiles: Use active profiles to share API conformance information with developers and notify them of conformance issues. APIs targeted by active profiles are governed APIs and their conformance information is shown across Anypoint Platform.

draft profiles: Use draft profiles to test settings before revealing their targeted APIs' conformance information across Anypoint Platform. APIs targeted by draft profiles are governed, but their conformance information isn’t shown outside of the draft profile view unless they’re also targeted by an active profile.

governance rulesets

Governance rulesets are collections of rules, or guidelines, that can be applied over the metadata extracted from APIs in Anypoint Platform. Examples of things you can use governance rulesets to help enforce are:

Internal and external best practice guidelines, such as naming conventions
Industry-specific government standards, such as encryption for sensitive API data (HTTPS)

MuleSoft provides several rulesets in Exchange, such as Anypoint API Best Practices, OpenAPI Best Practices, Authentication Security Best Practices, and Mule API Management Best Practices. Discover rulesets in Exchange by filtering the search by the Rulesets type. See Search for Assets.

governed APIs: APIs are governed if they’re identified by the selection criteria of at least one governance profile. If an API is governed, all versions of that API are considered one governed API. Subscription limits are set based on your organization’s purchased capacity. The UI gives information about usage and shows alerts when you near or exceed your subscription capacity.

API: The entire API, including all its aspects. In Anypoint Platform, aspects of an API might also be called just API in context with the product that is managing them. For example, in Exchange, API might refer to the API specification, documentation, and catalog. In API Designer, API might refer to the API specification. In API Catalog, API might refer to the API instance, policies, and contracts.

API aspects: Parts of an API. Examples of API aspects include specifications, instances, catalog information, and documentation.

API specification: Details the functional and expected behavior of an API, as well as the fundamental design philosophy and supported data types. It contains both documentation and API definitions to create a contract that people and software can read.

API implementation: A realization of the API specification to make the API functional.

API instance: An instantiation of the API implementation. An API can have multiple instances across different environments and gateways, which can be used by clients to make API calls. Instances that are configured but not deployed are also captured as part of this aspect.

An instance can be either a proxy of an API that serves the upstream or an application endpoint.

API documentation: Helps consumers understand and use the API, with content such as examples, use cases, and tutorials.

API catalog information: Properties related to an API’s entry in an API catalog, such as name, version, owner (contact), tags, and categories. In Anypoint Exchange, these properties are associated with APIs in asset portal information.