API Governance
Governance Fundamentals
API Governance ensures APIs are consistent, secure, and compliant with organizational standards. In Boomi, governance is implemented through policies, API plans, and approval workflows. Candidates must understand the difference between design-time governance (e.g., enforcing naming conventions, OpenAPI validation) and runtime governance (e.g., rate limiting, SLA enforcement).
Policies and Compliance
Boomi allows defining governance policies that can be applied across APIs. These include security policies (e.g., OAuth 2.0, API key), traffic policies (e.g., spike arrest, rate limiting), and compliance policies (e.g., data masking). A common trap is assuming governance policies are automatically applied to all APIs; they must be explicitly attached to API plans or environments.
Approval Workflows
API changes may require approval before deployment to production. Boomi supports approval workflows where designated approvers review and approve API changes. Candidates should know that approval workflows are configured per environment and can be bypassed only by users with specific permissions.
Worked Example
A company requires all APIs to use OAuth 2.0 and have a rate limit of 1000 requests/hour. You create a governance policy that enforces OAuth 2.0 and a rate limit policy. Attach these policies to the default API plan. Then, set up an approval workflow for the Production environment so that any API deployment requires approval from the API governance team.
Rule of Thumb
Apply governance policies at the API plan level to ensure consistent enforcement across all APIs subscribed to that plan.