DORA is in force. Is your API estate ready to prove it?

The Digital Operational Resilience Act has moved from preparation to supervision. For financial institutions across Europe, and for anyone who serves them, the question supervisors are now asking is no longer whether you have a resilience program. It is whether you can prove it, with evidence, on request.

That distinction matters more than it may appear. Most institutions have resilience intentions: failover plans, incident procedures, third-party risk registers. Far fewer can demonstrate, from production records, that a specific critical service failed over correctly, that the incident timeline matches the report filed, and that every third-party dependency in the transaction path was known and monitored.

From intentions to evidence

The gap between a resilience program that reads well and one that survives supervision is the gap between a document and a record. A document says the failover procedure exists. A record shows that on a particular date, a particular service lost a particular provider, and recovered within a measured window, with the traffic to prove it. Only one of those answers a supervisor's follow-up question.

This is why the institutions that are calm about DORA are not necessarily the ones with the thickest binders. They are the ones whose infrastructure produces evidence as a side effect of running normally, so that the answer to "show me" already exists before the question is asked. Where evidence has to be assembled after the fact, it is always partial, always late, and always contestable.

Your API estate is your dependency map

DORA puts heavy emphasis on ICT third-party risk, and in a modern institution, third parties arrive through APIs: payment processors, data providers, cloud services, and increasingly AI providers. If your organization cannot enumerate which external services each critical function depends on, the register your compliance team maintains is a snapshot, not a map.

This is where the API estate becomes an asset rather than a liability. Every external dependency your business has flows through a gateway somewhere. Governed properly, that gateway is a live, continuously accurate inventory of exactly the relationships DORA asks you to manage. The register stops being a document that ages the moment it is signed and becomes a reflection of what is actually happening in production, reconciled against real traffic rather than against last year's interviews.

Evidence should be a by-product, not a project

The institutions that handle supervision well share one habit: their evidence exists before anyone asks for it. Failover events are recorded as they happen. Incident timelines are generated from traffic, not reconstructed from memory. Access decisions are written to an immutable log the moment they are made.

When a regulator asks how a specific transaction was handled two years ago, the answer should be minutes away, not weeks of investigation.

Waygrid customers in financial services operate this way by default. The platform records every interaction and policy decision with seven-year retention, generates resilience evidence from real production traffic, and maps its controls to DORA alongside ISO 27001, SOC 2, PCI DSS, and GDPR. The difference this makes is felt most sharply during an actual incident, when the timeline that would otherwise take a week of log archaeology is already assembled and already trustworthy.

Three questions to ask your teams this quarter

• Can we produce a complete list of external dependencies for each critical business service, from live traffic rather than documentation?
• If a critical provider failed today, would the failover happen automatically, and would we have the records to prove it did?
• How long would it take us to reconstruct the full handling of a single transaction from two years ago?

If any of those answers are uncomfortable, that discomfort is precisely what DORA was designed to surface. The good news: closing the gap is an infrastructure decision, not a multi-year program. The institutions that treat it as the former tend to be done before the ones that treat it as the latter have finished forming the committee.