The guide
Capabilities
The skills that hold an API platform up, in three levels. Serves as an assessment grid for an expert and as a diagnostic tool for a team.
The trade is better described in skills, which last, than in products, which change. The
grid below serves both to assess a candidate and to spot what is missing in a team
already in place. Someone trained on a product knows how to configure. Running a
platform in production demands the blocks that follow, and the third is the one most
often missing.
| Skill | What is expected at the autonomous level |
|---|
| API design and contracts | Write a complete OpenAPI contract, model errors and pagination, apply contract-first |
| Versioning and compatibility | Tell a compatible change from a breaking change, carry a deprecation through to removal |
| Gateway policies | Rate limiting, quotas, cache, transformation, circuit breaker, and knowing what not to put in there |
| API products and monetisation | Structure offers, plans and consumption contracts |
| Developer portal and experience | Generate the documentation from the contract, open a usable sandbox |
| Governance and lifecycle | Make the rules executable rather than just documented |
| Asynchronous APIs | AsyncAPI, events, webhooks, and how their contract differs from the synchronous one |
| Skill | What is expected at the autonomous level |
|---|
| OAuth2 and OIDC | Pick the right flow, know why implicit is ruled out, tell an access token from an identity token |
| Token validation | Audience, issuer, allowed algorithms, key rotation, clock skew tolerance |
| Token exchange and propagation | Propagate a user identity between services without forwarding the original token |
| mTLS | Issuance, distribution, renewal, and TLS termination upstream |
| OWASP API Top 10 | Recognise the categories, and know which ones the gateway cannot handle |
| Secrets management | No secret in the repository, resolution at runtime, rotation |
This is the most decisive block, and the one most often absent from "product
expert" profiles.
| Skill | What is expected at the autonomous level |
|---|
| Kubernetes and traffic ingress | Deploy and operate a data plane, understand Gateway API |
| APIOps and GitOps | Declarative configuration in a repository, automated application, drift detection |
| CI/CD | The full chain from contract to production, with validation and testing |
| Infrastructure as code | Rebuild an environment with no manual step |
| Multi-environment strategy | Representative environments, promotion, progressive rollouts |
| Observability | Distributed traces, per-consumer metrics, logging without leaks |
| Capacity and scaling | Size it, load test it, know what saturates first |
| Incident response | Diagnose under pressure, distinguish gateway, backend, identity and network |
| Skill | What is expected at the autonomous level |
|---|
| Internal and external topologies | Choose between a single, separate or hybrid gateway, and own the consequences |
| Gateway and service mesh | Place the boundary, and know when the mesh is not worth its cost |
| Migration patterns | ESB to APIM, gateway to gateway, progressive cutover |
| Multi-cloud and multi-gateway | A single control plane, distributed data planes |
| Event-driven and streaming | Where APIs sit in an architecture driven by events |
| AI gateways | Control access to models, quotas per token, keep cost in check |
| Skill | What is expected at the autonomous level |
|---|
| Contract testing | Check that an implementation honours its contract, on both sides |
| Virtualisation and mocks | Let a consumer build before the service exists |
| Load testing | Realistic scenario, measurement at high percentiles, identifying the saturation point |
| Security testing | Check authorisation, not just authentication |
Updated August 2026.