A 311 assistant must retrieve parcel and case data by calling city APIs through the municipal API gateway. What integration approach should the program require?

Integrating the AI tool with municipal enterprise APIs through the city’s governed API gateway is the correct approach when a 311 assistant must retrieve parcel and case data. Gateways provide authentication, authorization, rate limiting, logging, and consistent policy enforcement so AI tools do not become ad-hoc backdoors into civic systems. Calling approved APIs through the gateway keeps data access auditable and aligned with enterprise integration standards while still giving the assistant the live context it needs. The practice works because municipal data access should be mediated and governed, not improvised.

Letting the chatbot scrape internal websites with stored staff passwords fails by concept: scraping with stored credentials bypasses API controls, creates brittle brittle sessions, and is a serious credential-security anti-pattern. Emailing spreadsheet dumps to the vendor nightly instead of using APIs fails by concept—batch dumps are stale, hard to scope, and often export more data than needed outside governed interfaces. Hard-coding direct database credentials into the assistant prompt fails by concept and severity: embedding DB secrets in prompts or configs exposes the system of record and destroys least-privilege and audit boundaries.

Exam caveat: gateway-mediated API integration is the governance pattern; it does not require exposing every internal table—only approved parcel/case APIs with least privilege. Keep 311 / municipal API framing. Operational check: register the assistant as an API consumer on the municipal gateway; use scoped credentials/tokens; log access; prohibit scraping and embedded DB passwords; and verify the assistant retrieves parcel/case data only through approved endpoints.