API Lifecycle Audit (Retention)

API Lifecycle Audit (Retention)

1. 01

   Inventory all client-facing APIs and their current usage

   Compile a list of every endpoint, including those used by internal tools and AI agents. Note the last time each was updated and whether it is still actively called.

2. 02

   Review authentication and rate-limiting policies

   Check that every endpoint requires proper authentication and that rate limits match actual traffic patterns. Look for any endpoints left open or with overly permissive access.

3. 03

   Assess documentation freshness against the live spec

   Compare the published docs with the current OpenAPI specification. Flag any discrepancies that could mislead client developers or AI agents consuming the API.

4. 04

   Evaluate error handling and response consistency

   Test a sample of endpoints for consistent error codes and response formats. Inconsistent errors increase client integration time and support tickets.

5. 05

   Measure latency and uptime against the client's SLA

   Pull recent performance data and compare it to the service-level agreement. Identify any endpoints that are close to breaching thresholds.

6. 06

   Identify underused or redundant endpoints

   Look for endpoints with near-zero traffic or overlapping functionality. These add maintenance overhead without delivering value to the client.

7. 07

   Document findings and propose a remediation plan

   Summarize the audit results in a clear report, prioritizing issues by risk and impact. Present the plan to the client as part of the retainer review.