API Governance at Scale & API Experience Hub (Course #api-governance)
For API product managers, platform owners, solution architects, C4E leads.
By the end, you can
By the end of this course, you will be able to run governance as a measured estate-wide property and publish that estate to its consumers — custom rulesets, governance profiles, CI conformance gates, a branded API Experience Hub portal — so that 90 % conformance and 30-minute developer onboarding are evidenced rather than asserted.
Running case study
Solvane Energy Group runs metering, billing and grid-telemetry integrations in 9 countries: 340 APIs published to Anypoint Exchange by 11 squads across 6 business groups, plus a hand-maintained wiki catalogue no consumer trusts. A smart-meter data-access mandate opens the estate to 250 external energy retailers within 12 months, and the first audit sample found 41 % of specifications conforming to no shared standard at all. Targets: 90 % specification conformance against one published ruleset, zero critical security-rule violations, developer time-to-first-successful-call under 30 min, portal p95 under 1.2 s at 4 000 concurrent developers.
Programme every line is something you do
5 modules · 15 topics · in course-flow order
-
Module 1
Measure the estate before fixing it
Objective. Diagnose Solvane's real conformance posture with governance profiles and rulesets, and deliver the baseline report every later target is measured against.
- Apply MuleSoft-provided governance rulesets to the Exchange assets and read the first conformance summary end to end (baseline: 41 % of 340 APIs conforming)
- Scope governance profiles by Exchange tag, category and business group so each of the 6 domains is filtered by exactly one active profile — no API governed twice, none ungoverned
- Rehearse in draft before you publish: run a profile in draft state, count the violations it would raise, and promote it to active only once that number is defensible
-
Module 2
Codify house rules as a ruleset
Objective. Construct a custom governance ruleset, publish it to Exchange as a versioned asset, and wire the CI gate that stops non-conforming OAS specs before merge.
- Scaffold with anypoint-cli-v4 governance:ruleset:init, or clone and tighten a MuleSoft ruleset, encoding 12 house rules over OAS 3.x — naming, pagination, RFC 7807 error model, mandatory securitySchemes
- Set severity per rule, then validate and ship the asset — governance:ruleset:validate, governance:document, exchange:asset:upload — so all 11 squads consume one pinned ruleset version
- Gate the pipeline on governance:api:validate: the build fails on any Violation-severity finding, and the spec check stays under 2 min per pipeline run
-
Module 3
Set the target, watch the drift
Objective. Evaluate estate-wide conformance against a dated target and produce the owned remediation backlog that closes the gap quarter by quarter.
- Read the API Governance dashboard as an estate metric, not a per-API verdict: governance coverage, services governed by controls, conformance status per business group
- Commit to a dated estate-wide target — 90 % conforming within 2 quarters, zero critical security-rule violations — and attach every remaining gap to a named owner and a date
- Detect drift after each publish: pull the governance report weekly and raise an alert when any domain falls more than 5 points below its target
-
Module 4
Stand up the developer portal
Objective. Design an API Experience Hub portal — connected org, curated catalog, branded pages — that a first-time external consumer navigates unaided.
- Connect the Anypoint organization to Salesforce Experience Cloud, provision the portal from an out-of-the-box template in a sandbox first, and size External Identity licences against forecast access-request volume
- Curate the catalog from Anypoint Exchange — APIs, MCP servers and LLM services — exposing at most 2 live versions per service so consumers never build on a version you intend to retire
- Brand the Home, API Catalog and API Details pages with logo, fonts and palette, then hold portal p95 under 1.2 s at 4 000 concurrent developers
-
Module 5
From landing page to first call
Objective. Prove the self-service path end to end — access request, client application, first successful call — and instrument the adoption funnel that judges the portal.
- Run the access-request workflow live: a developer requests access to an API instance, an approver grants it, and client application credentials are issued against the right SLA tier
- Cut time-to-first-successful-call under 30 min using interactive documentation and a working try-it call against a sandbox instance — measured on a developer who has never seen the portal
- Instrument adoption with Google Analytics and the Chatter feed — catalog views, access requests, activation rate — targeting 60 % of the 250 registered retailers calling within 30 days
References & Official Documentation every claim above has a source
Module 1
- Applying Rulesets to Identified APIsMuleSoft Docs
Module 2
- OpenAPI Specification v3.1.0Specification
- CLI Commands for API GovernanceMuleSoft Docs
- Creating Custom Governance RulesetsMuleSoft Docs
Module 3
- Monitoring API ConformanceMuleSoft Docs
Module 4
- Catalog ManagementMuleSoft Docs
- Connecting to SalesforceMuleSoft Docs
Module 5
- Requesting Access to a Service InstanceMuleSoft Docs