Endpoint Inventory and Risk Triage (Onboarding)

Endpoint Inventory and Risk Triage (Onboarding)

1. 01

   Map every endpoint the client's stack touches before scoping the retainer

   List internal services, third-party APIs, and any agent-facing routes, then tag each one with an owner and an authentication method. A 40-endpoint map built in week one prevents the scope argument in month three.

2. 02

   Classify each endpoint by blast radius if it fails

   Separate revenue paths (checkout, lead capture, payment webhooks) from convenience paths (analytics pings, internal dashboards). Revenue paths get monitoring and alerting budget; the rest can wait.

3. 03

   Record the current documentation state per endpoint

   Note which routes have live specs and which exist only in a developer's memory. Documentation platforms such as ReadMe can host generated references, but the inventory has to exist first.

4. 04

   Flag any endpoint that an AI agent can read or write

   Agent traffic changes the risk profile because a single misconfigured route can be called thousands of times before anyone notices. Score each agent-accessible route for write access and data sensitivity.

5. 05

   Confirm where rate limits and spend caps currently sit

   Gateways like Zuplo and API7 expose per-key limits and token spend controls, but only if someone configured them. An unset limit is an open door.

6. 06

   Price the governance work as a line item, not a hidden cost

   Quote monitoring, spec maintenance, and incident response as a monthly retainer component. Bundled governance is the difference between a project fee and recurring revenue.

7. 07

   Set the review cadence with the client in writing

   Agree on a monthly endpoint review and a named escalation contact. Undocumented cadences decay into nothing within two quarters.