API Governance

What is API Governance?

API Governance is a commercial API governance platform developed by PerfAI, Inc.; it is used to automatically identify issues related to the design and implementation of APIs. The product is based on a set of API Governance Top-10 rules, with AI being employed to assist in the review process.

It is aimed at developers, technical leaders, and API integration teams, with the goal of ensuring consistent standards are applied throughout the development and delivery processes. The official website states that its AI is trained using more than 10,000 public APIs.

Why is API governance needed?

When multiple teams design APIs separately, inconsistencies can easily arise in terms of naming, error formats, pagination, versions, security, and documentation. The later such issues are detected, the higher the costs associated with rework and integration will usually be.

API governance transforms organizational agreements into reproducible checks, enabling design reviews to extend beyond one-time manual meetings and become part of the development pipeline. Tools can help ensure consistency, but the rules ultimately still need to be established by the organization’s leaders.

Main functions of API Governance

AI automated review

The platform automatically analyzes the design and implementation of APIs, identifying any aspects that deviate from best practices or industry standards. The reports provide insights into potential risks and areas for improvement; production interfaces should not be modified automatically without first conducting an assessment.

API Governance Top-10

The authorities describe the Top-10 as a collection of well-organized API design principles, standardized practices, and best practices related to compliance. Teams can use this as a foundational framework, to which they can add their own requirements regarding naming, security, and the software lifecycle.

Run unlimited times

All three options available on the official website specify that there is no limit on the number of executions; the main differences in capacity lie in the number of endpoints and the enterprise-level features offered. The scope of a single execution and the associated quotas must be confirmed within the account.

Governance reports and badges

The scan results can be used to generate governance reports and badges, which facilitate the presentation of the current status to development teams or managers. It is advisable to include in these reports the version of the rules, the time of scanning, and the version of the interfaces, in order to ensure that different batches can be compared properly.

CI/CD integration

The Growth solution enables the integration of governance checks into continuous integration and continuous delivery processes. Teams can run these checks before merging or releasing code, and decide whether to issue warnings, block the action, or require manual approval based on the level of risk.

GitHub Actions

The official pricing page lists the GitHub Actions integration, which allows for running checks as part of code repository workflows. Credentials should be stored in repository secrets, and not included in workflow files or logs.

API gateway integration

The Growth and Enterprise plans offer API gateway integrations that enable the connection of governance signals to existing API infrastructure. The supported gateway brands, deployment methods, and scope of permissions need to be confirmed during a trial or demonstration.

Jira and GitHub Issues

The issues identified can be integrated with Jira or GitHub Issues workflows, facilitating assignment, tracking, and closure. Rules for eliminating duplicates should be set in place before automatic ticket creation, to prevent duplicate tasks from being generated each time a scan is performed.

Team standardization

The technical lead can use unified reports to compare the API quality of different products and teams. Governance objectives should focus on maintainability, security, and the integration experience, rather than merely pursuing a single score.

API Governance Usage Tutorial

1. Identify the APIs that need to be managed, along with the responsible persons, callers, and deployment environments.
2. Prepare the latest API specifications or descriptions of the interfaces supported by the platform.
3. Create a project and use a non-production API to conduct the initial review.
4. View the rule, severity, and impact scope associated with each discovery.
5. Distinguish between real defects, organizational exceptions, and rules that do not apply.
6. The person in charge of the API will confirm the solution for fixing the issue, and then update the interface specifications or the implementation.
7. Run the review again to verify that the issue has been resolved and no new regressions have occurred.
8. Integrate the stability rules into CI/CD and first observe them in prompt mode.
9. After confirming the false positive rate, enable release blocking for high-risk issues.
10. Export reports regularly to track governance trends across teams and versions.

Methods for establishing effective governance rules

• First, define the minimum set of rules that the organization must follow, in order to avoid introducing too many checks at once.
• Record the reason, example, responsible person, and approval procedure for exceptions for each rule.
• Distinguish between rules for the design phase, rules for the implementation phase, and runtime strategies.
• High-risk security issues can be blocked, and style recommendations are usually provided as a hint first.
• Rule changes must be versioned, and all API providers and users must be notified.
• Regularly clean up expired exceptions to prevent exemptions from becoming permanent.

Which teams are suitable?

• Enterprise development teams that have multiple product lines or microservices.
• Organizations that are in the process of building a unified API platform and a developer portal.
• Technical managers who need to reduce differences in interfaces between teams.
• Companies that provide public, Web, or mobile APIs to external users.
• API integration teams that need to continuously monitor the quality of third-party integrations.
• DevOps teams that wish to incorporate API specification checks into the deployment process.

Product advantages

• It is designed with a focus on the specific scenario of API governance, making it more targeted than general AI review tools.
• The free plan allows unlimited executions and can be used for testing small APIs.
• The Growth solution covers CI/CD, issue tracking, and API gateway integration.
• Reports and badges help to make the outcomes of governance visible across teams.
• Consider the needs of developers, managers, and API integrators at the same time.

Usage restrictions and precautions

• AI-based review may lead to false positives or false negatives, and it cannot replace architectural, security, and business reviews.
• A high governance score does not mean that the API is free from risks related to authentication, authorization, or data leakage.
• Before uploading the internal API specifications, it is necessary to confirm the rules for data processing, retention, use in training, and deletion.
• API documentation may contain internal domain names, example keys, and sensitive fields, which should be anonymized first.
• When integrating with CI/CD, use the non-blocking mode first to prevent false alerts from interrupting normal deployments.
• The gateway, support, and unlimited API quota for Enterprise need to be confirmed through sales.
• Structured data in third-party GitHub repositories or API directories is not equivalent to the platform’s source code.

API Governance pricing

As of August 26, 2026, the official website lists three plans: Startup Essentials, Growth, and Enterprise. The prices in dollars, taxes, the range of features, and contract terms may change; it is necessary to refer to the settlement page or the official quote before making a purchase.

The official website states that it is possible to start using the service for free without a credit card, but the options for trials, account requirements, and specific benefits should be verified on the current page. It is also necessary to ask about how endpoints are counted and whether multiple environments result in duplicate charges before making a purchase.

How to choose a solution

• Small teams or proof of concept: Use the free version first to assess the suitability of the rules.
• Pipeline and issue tracking are required: Select Growth and test all integrations.
• Multiple teams, a large number of APIs, or enterprise gateways: Request an Enterprise demonstration and quote.

Differences from API management platforms

API management platforms are typically responsible for traffic routing, authentication, rate limiting, analysis, and developer portals. API Governance places more emphasis on design standards, automatic review, reporting, and process controls.

The two types of products can be used together, but they cannot completely replace each other. It is still necessary for the team to clarify the boundaries of responsibilities among API gateways, catalogs, monitoring, and governance tools.

Open source and GitHub status

API Governance is a commercial online platform; as of the date of verification, it has not been confirmed that its source code is open source. PerfAI offers relevant actions or integrations within the GitHub ecosystem, but this does not mean that the entire service can be deployed on one’s own.

There are API governance rules, JSON Schema documents, and repository directories prepared by third parties available on the internet; these should be considered separately from PerfAI’s official commercial products. Before using them, it is necessary to check the maintainer, license details, and update status.

Frequently Asked Questions

Can API Governance be used for free?

Yes. The current price for Startup Essentials on the official website is $0 per month; it allows unlimited number of executions and up to 50 endpoints. The specific registration requirements can be found on the page as it stands at that time.

What can it check?

The platform automatically identifies issues related to API design and implementation based on rules such as API Governance Top-10, and generates reports accordingly. The list of specific rules can be found in the account details or the white paper.

Is CI/CD supported?

Supported. The Growth option includes integrations with CI/CD and GitHub Actions, which enable the execution of governance checks during merging or publishing processes.

Can it be connected to Jira and GitHub Issues?

Yes, the Growth solution lists integrations with Jira and GitHub Issues, making it suitable for converting identified issues into trackable tasks.

What is the difference between Growth and Enterprise?

The Growth plan costs $199 per month and allows up to 100 endpoints; the Enterprise plan comes with a customized price, intended for those who need an unlimited number of APIs as well as more advanced enterprise gateway and support services.

Is API Governance an open-source tool?

As of August 26, 2026, it has not been confirmed that this commercial platform is open source; the relevant integrations on GitHub or third-party materials cannot be considered as the complete source code of the product.