Software Engineering and DevOps Assessment

API and Integration Lifecycle Maturity Assessment

Evaluates API and integration maturity across governance and operating model, inventory and posture, design and contracts, event-driven and enterprise integration, verification, runtime security, AI agent and MCP consumers, developer experience and products, and reliability, lifecycle and value.

Register to take this assessment See what we assess

Already have an account? Log in to start

Who it is for

  • Process Owner/Full Model Assessor
  • Architecture and API Governance
  • API and Integration Platform
  • API Provider and Product Teams
  • Integration and Event Engineering
  • API Security

Head of API and integration platform, enterprise architects, CTO. Secondary: API product owners, integration engineers, API security engineers and platform teams.

What you will gain

Shows where APIs and integrations are unknown, inconsistent, exposed or costly, and where AI agents reach systems without the right controls. Gives each gap a concrete next step and a measurable target.

About this assessment

APIs and integrations now connect almost every system, partner and AI agent. When they are unknown, inconsistent or weakly protected, they become the easiest path to data loss, outages and wasted spend.

This assessment follows the order in which a dependable API and integration capability is built: a strategy and policy, an operating model, design authority and enabled teams; one inventory checked against runtime traffic, with posture and third-party risk; a design standard, specifications, schemas, contracts and versioning; governed events, reliable delivery, webhooks and integration platforms; tests and pipeline gates; gateways, authentication, authorization, limits, validation and abuse detection; safe use of APIs by AI agents and MCP servers; products, portal, onboarding and partner terms; and resilience, objectives, deprecation, migration and program value.

Questions marked (Bridge) check the link to the model that owns a neighboring practice: Enterprise Architecture, Configuration Management, DevOps Engineering, DevSecOps, Non-Human Identity and Secrets Management, Security Operations, AI Governance, Service Level Agreements and Performance, and SRE, DevOps and ITSM Convergence. Each question is scored on whether the practice is documented, implemented and effective.

What we assess: 9 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 7 questions

1 API and Integration Governance and Operating Model

Strategy and policy, platform team and operating model, design authority, exceptions, alignment with enterprise architecture standards, provider enablement and the program roadmap

02 · 6 questions

2 Inventory, Discovery and Posture

One inventory of APIs, runtime discovery of shadow and zombie APIs, integration flow inventory, security posture and data sensitivity, CMDB links and third-party API risk

03 · 7 questions

3 Design, Contracts and Standards

The design standard, design-first specifications, schema registry, data contracts for integrations, versioning and compatibility, non-REST styles and machine-readable workflows

04 · 7 questions

4 Event-Driven and Enterprise Integration

Broker and topic governance, event envelopes and descriptions, reliable delivery and dead-letter recovery, consumer lag, webhooks, integration platforms and citizen integrators, and legacy integration retirement

05 · 5 questions

5 Verification and Release Safety

Sandboxes and mocks, specification conformance, consumer-driven contract tests, breaking-change detection and pipeline gates

06 · 7 questions

6 Runtime Security and Traffic Control

Gateway coverage, consumer authentication and sender-constrained tokens, workload identity, object and function authorization, rate limits and business flow protection, input validation and abuse detection

07 · 6 questions

7 AI Agent and MCP Consumers

Agent-ready API descriptions, MCP server inventory and approval, delegated agent authorization, agent traffic controls and write guardrails, tool poisoning and response injection defense, and agent traffic attribution

08 · 6 questions

8 Developer Experience, Products and Monetization

API products, the developer portal, time to first call, generated SDKs and changelogs, plans, partner onboarding and metering, and consumer support

09 · 5 questions

9 Reliability, Lifecycle and Value

Resilience patterns, reliability objectives and observability, deprecation and sunset, migration support, and program measures and value

KPIs to track

Measures that show whether the improvements hold.

KPI
Inventory Match to Runtime - Share of APIs observed at runtime that match an inventory record. Target: 95% or higher.
Unplanned Breaking Changes - Breaking changes reaching consumers without a new major version per quarter. Target: 0.
Endpoints Behind a Gateway - Share of external and partner endpoints served through a managed gateway. Target: 100%.
Scoped Agent Credentials - Share of MCP servers and agent clients using scoped, delegated credentials. Target: 100%.
Sunsets on Date - Share of deprecated versions switched off by the published sunset date. Target: 90% or higher.

Framework alignment

Questions are written in plain language and mapped to:

  • OpenAPI Specification v3.2.1
  • Arazzo Specification v1.1.0
  • AsyncAPI Specification 3.1.0
  • CloudEvents Specification v1.0.2
  • RFC 9700
  • RFC 9449
  • RFC 9396
  • RFC 8705
  • RFC 9457
  • RFC 9745
  • RFC 8594
  • FAPI 2.0 Security Profile
  • NIST SP 800-228
  • NIST SP 800-204A
  • OWASP API Security Top 10 2023
  • OWASP Non-Human Identities Top 10 2025
  • OWASP Top 10 for LLM Applications 2025
  • OWASP Top 10 for Agentic Applications 2026
  • Model Context Protocol Specification 2026-07-28
  • MITRE ATLAS
  • MITRE ATT&CK
  • ISO/IEC 27001:2022
  • ISO/IEC 20000-1:2018
  • ISO/IEC/IEEE 29119-1:2022
  • ISO/IEC/IEEE 32675:2022
  • CBUAE Open Finance Regulation 2025
  • SAMA Open Banking Framework
  • DAMA-DMBOK2 Revised
  • Team Topologies 2nd Edition
  • CNCF Platform Engineering Maturity Model
  • DORA Capabilities
  • Google SRE Book
  • Google SRE Workbook
  • FinOps Framework 2026
  • ITIL 4
  • COBIT 2019

Works best with

Practices this assessment relies on. Assessing them too gives a fuller picture.

Enterprise Architecture (v7.9.6): enterprise standards (bridge 1.5); uses this model's API Design Standards Guide.
Configuration Management (v9.9.6): CMDB links (bridge 2.5).
DevOps Engineering (v1.9.6) and DevSecOps (v6.9.6): pipeline gates and security testing (bridge 5.5).
Non-Human Identity and Secrets Management (v4.9.6): workload and partner client identity (bridge 6.3); Security Operations (v8.9.6): detections (bridge 6.7).
AI Governance (v11.9.6): agent governance (bridge 7.3); Service Level Agreements and Performance (v5.9.6): consumer support (bridge 8.6).
SRE, DevOps and ITSM Convergence (v4.9.6): objectives and tracing (bridge 9.2); IT FinOps (v5.9.6): cost allocation (9.5).

What you get

Maturity scores

An overall score and a score for each of the 9 domains.

Gap analysis

A clear view of where current practice falls short, and why it matters.

Improvement recommendations

Prioritized next steps to move each area to the next level.

Detailed report

Results you can share with leadership and track over time.

See where you stand on API and Integration Lifecycle Maturity Assessment

Register, take the assessment, and get your maturity score with a clear improvement roadmap.

Register to take this assessment

Start Measuring Your Maturity Today

Get Started Free

Contact us

© 2026 ITSGovernance, part of SMCE. All rights reserved. Cookie settings