Tyk Governance

​

What Tyk Governance Does

Tyk Governance is an API and service governance capability built directly into Tyk Dashboard. It enables organizations to establish, enforce, and monitor governance standards across their services. Too often, governance is applied late in the service lifecycle. Services are designed, built, and deployed before anyone confirms they meet organizational standards for security, design consistency, or documentation. The result is reactive review cycles, inconsistent quality across teams, and security or compliance gaps that surface only after deployment. Tyk Governance addresses this by giving teams a continuous, automated way to define standards, evaluate services against them, and surface compliance issues with specific remediation guidance, early enough that issues can be fixed before services are published. New to Tyk Governance? Start with the Quick Start to create your first ruleset and read your first compliance result.

​

Availability and Licensing

Tyk Governance is delivered as a license claim toggle on Tyk Dashboard. It is disabled by default and enabled per organization on request. It is not self-service. Contact your Tyk account manager or support team to turn it on for your environment, or use the contact form. Without the governance scope on your license, every governance endpoint returns 403 Forbidden, regardless of the permissions held by the calling user.

​

Who Should Use Tyk Governance

Tyk Governance turns service governance from a fragmented, post-deployment concern into a proactive, continuous, and scalable process across your service ecosystem. It is designed for two roles working together, and the documentation is organized the same way.

​

Platform Teams and Governance Leaders

Platform teams define and enforce the standards that an organization’s services must meet. They use Tyk Governance to author rulesets, attach them to the services they should govern, and configure how strictly those rules are enforced, without becoming the manual review bottleneck themselves. They value:

• Spectral-compatible ruleset authoring, including security-focused templates such as OWASP API Security and design-focused templates aligned to OpenAPI best practices.
• Role-appropriate access through a dedicated ruleset governance permission group, separating who can manage standards from who can view them.
• A path to introduce new standards gradually. Rules can start at Warn or Info severity so teams can address them without compliance impact, then be promoted to Error severity once adoption is in place.
• The option of deploy-time warnings that flag non-compliance before a service goes live, without blocking.

Example: A platform engineer authors rulesets that codify the company’s design standards and an OWASP-aligned security baseline. Linking each ruleset to the relevant API Categories means every API in scope is evaluated continuously, giving the platform team confidence that the APIs they care about consistently meet the standards, with non-compliant ones surfaced for follow-up. Start here: Rulesets, Ruleset Templates, and Scoping Rulesets to Services.

​

API Developers

API developers rely on Tyk Governance to build APIs that meet standards from day one, without waiting for review cycles. They appreciate:

• Inline feedback on compliance directly in the API configuration view.
• Specific remediation guidance, not just what failed, but how to fix it.
• Severity-aware prioritization so the most important issues are clear at a glance.

Example: An API developer configures a new payment API and immediately sees that the API is missing a required authentication scheme. The remediation guidance points to the exact location in the API configuration and explains how to add it. The fix is applied before the API is published. Start here: Service Compliance, Remediate Issues, and CI/CD Governance Checks.

​

Teams Managing APIs as Kubernetes Manifests

Teams who manage both their APIs and their governance configuration as Kubernetes manifests can define rulesets and enforce compliance through Tyk Operator instead of Tyk Dashboard, as part of a GitOps workflow with Argo CD, Flux, or plain kubectl apply. Start here: Governance via Tyk Operator.

​

Key Benefits

• Shift-Left Quality Gates: Surface compliance issues during service design and configuration, not after deployment, so issues are caught before they reach production.
• Spectral-Compatible Rulesets: Tyk Governance is built on Vacuum, a high-performance Go-based ruleset engine that is fully compatible with the Spectral format. Within Tyk Dashboard you can create new rulesets tailored to your organization’s standards, start from Tyk-curated templates such as OWASP API Security and OpenAPI design best practices, or import existing Spectral rulesets your teams already maintain. For more information, see Spectral Compatibility.
• Configurable Enforcement: Choose between visibility-only governance, where rules evaluate and report compliance without interrupting deployment, or soft warnings at the moment of publishing your service to Tyk Gateway.
• Severity-Based Compliance: Each rule carries a severity of Error, Warn, or Info. A service is non-compliant when at least one Error-severity rule fails. Warnings and informational findings are advisory and do not affect compliance status, allowing teams to evolve standards without raising false alarms. For more information, see Severity and Compliance.
• Measurable Service Compliance: Track service quality with quantifiable metrics surfaced inline against each service. Compliance status and issue counts by severity are visible directly in the API configuration view, giving API owners a clear picture of where they stand and what is left to fix.

​

FAQ