API Review Process

Non-Commercial Integrations

Effective 17 August 2026 the API Review process is changing. We are transitioning to a new Self-Assessment model for non-commercial integrations.

Before you go live with your integration you will still be required to make a request for production API Credentials via our Global Support Team, but instead of going through a screenshare session with our team, you will be required to self-assess and self-certify you have followed our Development Guidelines and best practice in building your integration. We will no longer be conducting a screenshare session to review your implementation approach and design decisions.

When your integration is ready to go live please make a request for production API Credentials via our Global Support Team, providing at least 2 weeks notice of your intended go-live date to allow sufficient time for processing your request.

Commercial Integrations

Purpose

The purpose of the API Review is to sanity-check your integration project to ensure that:

1. It makes efficient use of Actionstep resources in delivering your project goals
2. To ensure its implementation will have no detrimental impact on our infrastructure
3. To ensure you are following Actionstep's implementation guidelines and best practice.

Requesting an API Review

To request an API Review please contact our Global Support Team giving us at least 2 weeks notice of your intended go-live date to allow sufficient time to schedule in the Review.

How will the API Review be Conducted?

This is typically conducted via a screenshare using Microsoft Teams. From your side we require at least one person who can demonstrate your integration end-to-end and to explain at a technical level how it was implemented. We are not looking to review source code, we are looking to review and understand your design and implementation approach in using our API.

What We Would Like To See

There are a number of key areas we cover in the API Review.

1. We would like you to demonstrate the full user authentication flow between your integration and Actionstep.
2. Show that your integration functions on a user-centric basis, or if using a centralised approach, you fully understand the implications for your users.
3. Confirm you use the api_endpoint property from the access token as the base URL for all API requests.
4. Apply best practice for building REST based integrations, for example, you implement an appropriate retry strategy (e.g. exponential backoff) for failed requests, and can handle rate limiting.
5. You adhere to best practice regarding data security and protection of Actionstep client data.
6. You have implemented appropriate error handling and logging to ensure you can diagnose and resolve any issues that may arise in production.
7. You have implemented appropriate monitoring and alerting to ensure you are aware of any issues that may arise in production.
8. You have implemented appropriate testing to ensure your integration is robust and reliable.
9. You understand your responsibilities with respect to data sovereignty and privacy, and have implemented appropriate measures to ensure compliance with relevant legislation and regulations.

What is the Outcome from the API Review?

During this session, which typically lasts between 30 mins and 1 hour, we offer any applicable feedback regarding your implementation and offer recommendations for any remedial work to be undertaken if necessary. Once we are satisfied your solution meets our Development Guidelines we will supply you with the API Credentials to go live with your integration.