Apiome Policy
Policy-as-code governance that blocks non-compliant APIs before they ship.
Apiome Policy is a governance engine that turns your API design rules into code. Author policies in a visual and YAML editor, enforce them as pre-merge CI gates, and hand engineers actionable violation reports with inline remediation. It sits above linting — encoding team-wide governance contracts, breaking-change approvals, and an immutable audit trail.
What ships with Policy
Every Policy surface is wired into the rest of the Apiome platform — no glue code, no separate identity, no bolt-on integrations.
Visual + YAML rule editor
Author policies with a WHEN / THEN / EXCEPTIONS builder and live-preview YAML tested against sample specs.
Pre-merge CI gates
Block non-compliant specs in CI with per-repo webhooks, sub-three-second runs, and full gate run history.
Breaking-change detection
Catch removed paths, removed methods, tightened required params, and narrowed response schemas versus prior versions.
Curated policy library
Enable REST best-practice, OWASP, and naming-convention packs, or compose and version your own.
Approval workflows
Route breaking-change exceptions through multi-level approval chains with auto-approve conditions.
Immutable audit log
Every policy run, exception grant, and approval event recorded on a tamper-evident audit trail.
A look inside Apiome Policy
Live design previews from the Policy mockup pack — 7 surfaces in total.
A curated library of REST best-practice, OWASP, and naming-convention packs ready to enable per tenant.
Pre-merge gate run history with pass rate, per-PR results, and expandable blocking-violation detail.
A per-run violation list with severity, remediation guidance, and an exception request workflow.
Use cases
Policy is designed around the way real teams actually work — not the way a tool wants them to work.
Enforce a no-breaking-changes-without-approval rule across every API repo directly in CI.
Ship org-wide REST and security standards as versioned, testable policy packs.
Prove governance with an immutable audit trail of runs, exceptions, and approvals.
- Multi-level breaking-change approval chains
- Immutable, tamper-evident audit log
- Curated OWASP and REST governance packs (Pro)
- Per-repo CI gate webhooks with exception workflows
- Severity tiers — blocking, warning, and info — with auto-approve rules
- Draft policy YAML from a natural-language rule
- Explain each violation and its blast radius
- Suggest one-click remediations for failing specs
- Recommend policy packs from your API portfolio
AI that writes and explains your governance
Policy's AI drafts rules from plain-English intent, explains why a spec failed a gate, and proposes the exact fix to bring a PR back into compliance.
Every PolicyAI feature is grounded in your tenant's data, runs under your data-residency policy, and respects every role and ACL the platform enforces.
Every surface in Apiome Policy
A look at the 7 screens designed for this suite — covering everything from day-1 onboarding to day-100 operations.
