Tyk Governance Quick Start

Create your first governance ruleset from a template, scope it to an API Category, then read and fix your first compliance issue.

This tutorial takes you end to end through Tyk Governance: you create a ruleset from a shipped template, scope it to an API Category, read the compliance result it produces on a service, and fix one issue.

It covers both governance roles, so work through it once even if only one half is your job. It should take about ten minutes.

Before You Start

You need:

• Tyk Governance enabled on your organization’s license. It is off by default and is not self-service. See Availability and Licensing.
• Write access on the Rulesets Governance permission group, to create a ruleset. See Roles and Access.
• At least one Tyk OAS API in Tyk Dashboard, tagged with an API Category you can use for this walkthrough.

Instructions

Step 1: Open the Rulesets Section

From the left navigation, expand Governance and click Rulesets. If no rulesets exist yet, the empty state guides you to create your first one.

Step 2: Create a New Ruleset

Click + Create new ruleset. The three-step creation wizard opens.

Step 3: Add Basic Information and Scope It

Provide a name and description for your ruleset. Link the ruleset to one or more API Categories so it knows which services to evaluate. Leave the Deployment Warning toggle off for now, which is the default.

This category link is how a ruleset finds its services. Any service tagged with a matching category is evaluated against this ruleset automatically. For the full model, see Scoping Rulesets to Services.

Step 4: Start From a Template

Choose Start from template. This lists the templates available in your environment.

For this tutorial, choose OWASP API Security for a security baseline, then click Continue.

Step 5: Review the Definition and Activate

The selected template’s JSON loads into the editor. You can disable individual rules, adjust severities, or modify rule definitions before continuing.

Click Save. Two options are offered:

• Save as draft: saves without activating. It does not evaluate any services.
• Save and activate: evaluates every service in the linked categories.

Choose Save and activate. You are redirected to the ruleset’s detail page.

Check your work: the ruleset appears in the Rulesets list with status Active, and services tagged with the linked categories begin to be evaluated in the background.

Step 6: Read Your First Compliance Result

Open one of the APIs tagged with the category you linked, then switch to the Governance tab. It is the last tab in the API details page.

Read the status banner at the top. It shows Compliant if the service has no Error-severity issues, or Non-compliant if it has at least one, with counts of errors and warnings aggregated across every ruleset evaluating the service.

Below the banner, the Rulesets card grid shows each ruleset evaluating this service, and the Issues table lists each individual rule failure.

Step 7: Fix One Issue

Click View issue on any row to open the issue details.

Each issue names the rule that failed, the affected area in the service specification, the problem if it is left unfixed, and concrete “How to fix” guidance.

Use the affected-area path to find the setting in the API Designer, apply the fix, and save the service. Saving triggers a re-evaluation, and the Governance tab updates with the new status, usually within a second.

Next Steps

Now that governance is running, follow the track that matches your role:

If you define standards (platform teams and governance leaders):

• Rulesets: create rulesets from your own definitions, configure existing ones, and test before activating.
• Ruleset Templates: what each shipped template enforces.
• Scoping Rulesets to Services: scoping patterns, and why a service is or is not being evaluated.

If you satisfy standards (API developers and service owners):

• Service Compliance: the full anatomy of the Governance tab and the portfolio view.
• Remediate Issues: prioritize by severity, and handle the Deployment Warning.
• CI/CD Governance Checks: run the same checks on a spec in your pipeline, before it is ever imported.