--- schema_version: "1" id: 788a0711097e02f8448792792f144d649ad21e9e0985d47b87214b1e911c2ca7 title: Anypoint API Governance Overview collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/api-governance/index.md canonical_url: https://docs.mulesoft.com/api-governance/ source_site: docs.mulesoft.com content_type: documentation content_hash: 940571872067d6c72ce813c6c0fb4f81ae626b2b565858190310cee859773717 description: MuleSoft Documentation Site latest: true --- --- product: API Governance --- # Anypoint API Governance Overview > For the full documentation index, see: https://docs.mulesoft.com/llms.txt > [!NOTE] We updated the terminology in the API Governance UI to reflect a broader range of asset > types. Where Governance previously used "APIs," it now uses "Services." There are no changes to > functionality. During this transition, this documentation includes a mix of the new and previous > terms. Anypoint API Governance is a component of Anypoint Platform that lets you apply governance rules to your services, including APIs, agents, MCP servers, and gateways, as part of the service lifecycle. With Anypoint API Governance: - Improve your organization’s service quality: Identify conformance issues in governed services and add governance strategies to resolve them and enforce standards. - Customize governance rules using [**Controls**](https://docs.mulesoft.com/general/exp-governance-work-with-strategies) strategies, available only in the enhanced MuleSoft experience: To access the full ruleset library with conditions configuration, rule-level selection, and severity customization, create **Controls** directly in the enhanced MuleSoft experience. - Apply consistent governance from design time to deployment: Use governance strategies to apply centralized governance across your services from API specifications at design time to gateway-enforced policies at deployment, targeting **Omni Gateways**, **Mule Gateways**, or all runtimes. - Apply consistent governance across multiple gateway runtimes, available only in the enhanced MuleSoft experience: Create governance strategies that target **Omni Gateways**, **Mule Gateways**, or all runtimes simultaneously to ensure uniform governance posture across your entire service infrastructure. See [Working with Governance Strategies](https://docs.mulesoft.com/general/exp-governance-work-with-strategies). - Enforce governance within your DevOps organization: Automate service governance in your CI/CD pipeline with CLI commands or through the experience API. Use **Controls** strategies to optionally block non-compliant actions and enforce standards at the gateway level. ## Governance Dashboard The API Governance Dashboard offers an organization-wide view of your service landscape. Review the overall status of your services, identify areas that require attention, and take steps to improve your governance posture. From the API Governance Dashboard: - View metrics such as **Governance Coverage**, the number of services governed by **Controls**, services governed by **Automated Policies**, and overall compliance posture across your service portfolio. - Understand the distribution of your services by type, including REST API, AsyncAPI, HTTP API, agent, MCP server, LLM proxies, and gateways. - Understand your governance posture, including conformance status and nonconformance severity for governed services. - Take action from the Dashboard based on the presented metrics, such as creating new governance strategies to govern unprotected services and viewing lists of services for further review. See [Governance Dashboard Overview](https://docs.mulesoft.com/api-governance/dashboard-overview) for details. ## Governance Strategies > [!NOTE] **Governance Strategies** is available only in the enhanced MuleSoft experience. For the > complete workflow, see > [Working with Governance Strategies](https://docs.mulesoft.com/general/exp-governance-work-with-strategies). In the **Governance Strategies** page, governance administrators can: - Create **governance strategies** of two types, **Controls** or **Automated Policies**, to apply governance rules to a targeted set of services. - Monitor compliance posture, notify developers, and optionally enforce blocking rules to prevent non-compliant actions across targeted services. ### Governance Strategy Types **Controls** Validate targeted services against selected control rules and optionally block non-compliant actions, while automatically publishing your live compliance posture. Controls created in Anypoint API Governance have limited ruleset selection. For advanced features such as conditions configuration, rule-level selection, and severity customization, create controls directly in the enhanced MuleSoft experience. **Automated Policies** Enforce consistent policy requirements across targeted services to ensure uniform governance and automated security. See [Governance Console Overview](https://docs.mulesoft.com/api-governance/api-governance-console) for details. ## Governance Across Anypoint Platform In addition to viewing conformance information in the **Governance Strategies** page, these personas can view governance information and take action across Anypoint Platform: - Governance Leads and Security Architects: Create and manage cross-gateway governance strategies, review coverage metrics, and enforce standards across all service types. - API Owners: Review policy posture and conformance status for their services in Exchange. - API Admins: Connect **Omni Gateways** and **Mule Gateways** as governance targets and manage runtime-level enforcement. - Developers and Architects: Check specification conformance during the API design phase. - Implementors: Review governance reports for API instances in API Manager. - Exchange - API owners can view conformance status details for published API specifications, discover rulesets, and publish custom rulesets. - Implementors can view rulesets to determine how to fix API instance conformance issues. - Anypoint Code Builder and Design Center: - Developers or architects can check API specification conformance in the API design phase by applying governance rulesets directly to API specifications as dependencies. - API Manager: - Implementors can check API instance conformance by viewing comprehensive governance reports. - [Gateway Management](https://docs.mulesoft.com/general/exp-governance-work-with-strategies) (enhanced MuleSoft experience only): - API admins can connect **Omni Gateways** and **Mule Gateways** as governance targets and view per-gateway compliance posture from the **Governance Strategies** scope configuration. - [Open Policies](https://docs.mulesoft.com/general/exp-governance-policy-library-apply) (enhanced MuleSoft experience only): - Governance leads and security architects can browse policies by category and apply them directly to one or more API instances, including instances on third-party providers. ## Anypoint API Governance Concepts These are the key concepts for using Anypoint API Governance. governance profiles A governance profile applies selected governance rulesets to a filtered group of APIs. API Governance then validates the APIs against the rulesets to determine governance conformance. active profiles Use active profiles to share API conformance information with developers and notify them of conformance issues. APIs targeted by active profiles are governed APIs and their conformance information is shown across Anypoint Platform. draft profiles Use draft profiles to test settings before revealing their targeted APIs' conformance information across Anypoint Platform. APIs targeted by draft profiles are governed, but their conformance information isn’t shown outside of the draft profile view unless they’re also targeted by an active profile. governance rulesets Governance rulesets are collections of rules, or guidelines, that can be applied over the metadata extracted from APIs in Anypoint Platform. Examples of things you can use governance rulesets to help enforce are: - Internal and external best practice guidelines, such as naming conventions - Industry-specific government standards, such as encryption for sensitive API data (HTTPS) MuleSoft provides several rulesets in Exchange, such as Anypoint API Best Practices, OpenAPI Best Practices, Authentication Security Best Practices, and Mule API Management Best Practices. Discover rulesets in Exchange by filtering the search by the **Rulesets** type. See [Search for Assets](https://docs.mulesoft.com/exchange/to-find-info). governed APIs APIs are governed if they’re identified by the selection criteria of at least one governance profile. If an API is governed, all versions of that API are considered one governed API. Subscription limits are set based on your organization’s purchased capacity. The UI gives information about usage and shows alerts when you near or exceed your subscription capacity. API The entire API, including all its aspects. In Anypoint Platform, aspects of an API might also be called just API in context with the product that is managing them. For example, in Exchange, API might refer to the API specification, documentation, and catalog. In API Designer, API might refer to the API specification. In API Catalog, API might refer to the API instance, policies, and contracts. API aspects Parts of an API. Examples of API aspects include specifications, instances, catalog information, and documentation. API specification Details the functional and expected behavior of an API, as well as the fundamental design philosophy and supported data types. It contains both documentation and API definitions to create a contract that people and software can read. API implementation A realization of the API specification to make the API functional. API instance An instantiation of the API implementation. An API can have multiple instances across different environments and gateways, which can be used by clients to make API calls. Instances that are configured but not deployed are also captured as part of this aspect. An instance can be either a proxy of an API that serves the upstream or an application endpoint. API documentation Helps consumers understand and use the API, with content such as examples, use cases, and tutorials. API catalog information Properties related to an API’s entry in an API catalog, such as name, version, owner (contact), tags, and categories. In Anypoint Exchange, these properties are associated with APIs in asset portal information. ## See Also - [Getting Started with Anypoint API Governance](https://docs.mulesoft.com/api-governance/get-started) - [Anypoint Platform Glossary](https://docs.mulesoft.com/general/glossary)