Sign in Get started

API Platform & Lifecycle · Capstone

Capstone: Launch an API Program

Set up the platform, governance and DX for an organization opening public APIs.

Scenario

A logistics company with 12 product teams wants to open public APIs (shipments, tracking, pricing, webhooks) to partners within six months. Today each team designs APIs differently, specs are missing or stale, and nobody knows which internal APIs are exposed.

Requirements

  • Consistent design across teams
  • Automated quality gates
  • Self-service partner onboarding
  • Lifecycle and deprecation policy
  • Inventory of existing APIs

Constraints

  • No central team larger than 4 people
  • Teams keep their own deploy pipelines

Deliverables

  1. Describe the governance model and automated gates.
  2. Design partner onboarding and the developer portal.
  3. How will you build the inventory and handle existing exposed APIs?

Draft each deliverable below before revealing the model answer and rubric.

Further reading: Zalando RESTful API Guidelines

Deliverables

Describe the governance model and automated gates.

Model answer

  • Adopt a public style guide (e.g., Zalando/Google AIP) with company-specific additions; publish a Spectral ruleset package
  • Contract-first: every API has an OpenAPI/AsyncAPI spec in its repo; PR template with review checklist
  • CI gates: spectral (errors block), oasdiff breaking check (blocks unless approved with deprecation plan), example validation, Schemathesis against preview environments
  • Lightweight reviews by an API guild (rotating reviewers from teams), time-boxed to 2 days

Rubric

Strong answers federate ownership with a small enabling team and automate most checks. Misses: a central team that designs every API (bottleneck), manual-only reviews.

Design partner onboarding and the developer portal.

Model answer

Portal with quickstart, guides (auth, pagination, idempotency, webhooks), generated reference (Scalar/Redocly), SDKs (TS, Python, Java) generated on spec changes; self-service test/live keys with prefixes; sandbox with magic values; request logs per key; webhook tester; changelog + status page.

Rubric

Look for time-to-first-call focus, sandbox parity and key hygiene.

How will you build the inventory and handle existing exposed APIs?

Model answer

Catalog in Backstage generated from repos (catalog-info.yaml required for deploy); reconcile against gateway routes and traffic to find shadow/zombie APIs; assign owners; classify data sensitivity; deprecate or put behind the gateway; lifecycle states with sunset policy (minimum 12 months for public APIs).

Rubric

Strong answers use traffic data to find unknown APIs and tie the catalog to deployment.

Open in the app to mark lessons complete, take notes and track your progress.