Data governance stops at the database. Your data leaves through APIs.
Catalogs govern tables. Gateways manage traffic. Goava brings APIs into the catalog: it catalogs endpoints from your OpenAPI specifications, lets you link each one to the tables and columns behind it, tags endpoints with the same classifications as your data, and flags the ones tagged public, personal or financial — so the APIs serving your most sensitive data are governed, not invisible.
The Blind Spot
Catalogs govern tables. Gateways manage traffic. Nobody connects them.
A public endpoint serving personal data from a classified table is invisible to both sides: the data catalog doesn't know the API exists, and the API gateway doesn't know what data sits behind it. In Saudi Arabia, that gap is no longer just technical — it is regulatory.
- Your catalog knows the table is classified — but not that an API exposes it to the outside world.
- Your gateway sees every request — but not the sensitivity of the data behind the endpoint.
- The NDMO framework expects data sharing to be governed wherever it happens, including its Data Sharing and Interoperability domains — and APIs are exactly where sharing happens.
- PDPL, fully enforced since September 2024 with SDAIA actively enforcing it, makes ungoverned exposure of personal data a regulatory risk, not just an engineering oversight.
Gateway connectors in preview for the gateways you already run
- Kong
- Amazon API Gateway
- Azure API Management
- Google Cloud API Gateway
- NGINX
API-to-Data Lineage
Link each endpoint to the tables behind it, down to the column
Goava extends column-level lineage past the warehouse and into the API layer. Endpoints are cataloged from your OpenAPI specifications, and you link each one to the data assets behind it in the lineage editor or through the API — so 'what does this API actually expose?' has a recorded answer, not a guess.
- API endpoints cataloged from your OpenAPI specifications, alongside your tables, dashboards, and pipelines.
- Column-level lineage from source systems to tables, continued to the endpoints you link.
- A visual lineage editor, or the API, to record and correct each connection.
- Impact analysis: before changing a column, see every linked endpoint that depends on it.
Endpoint Classification
Classify endpoints with the same tags you use for your data.
Data and APIs should speak one classification language. In Goava, you tag API endpoints with the same classifications and tags as your datasets and columns — so the sensitivity of an endpoint is recorded in the catalog, next to the data it serves.
- Classifications and tags on datasets, columns, and API endpoints, from one approved scheme.
- Glossary terms carry their linked tags: apply a term such as 'National ID' to an endpoint and its personal-data tag comes with it.
- Ownership applies to APIs the same way it applies to tables, dashboards, and pipelines.
- Endpoint classifications you can show a reviewer — supporting the classification controls of the NDMO framework.
API Exposure View
See which endpoints are tagged public, personal or financial
An API exposure view that flags endpoints tagged public, personal or financial. When the question is 'which of our public APIs serve personal data?', you start from the tags in your catalog, not from a spreadsheet hunt.
- Built on the classifications and tags you already apply to endpoints.
- Search and filter endpoints in the catalog by domain, tag, or owner to focus reviews where they matter.
- From each endpoint's page, follow its lineage to the tables and columns you linked behind it.
- Audit-friendly evidence supporting PDPL accountability and the NDMO framework's data sharing controls.
Frequently asked questions
Put your APIs next to your data in the catalog
Catalog your endpoints from their OpenAPI specifications, link them to the tables behind them, and walk into your next review knowing which endpoints are tagged public, personal or financial.