An API still needs a process around it
Many agencies have spent years building API programs to open up legacy systems and share data between them. MuleSoft Anypoint Platform is a common choice for that work: it is where APIs are designed, secured, governed and published.
An API on its own doesn’t help the employee who needs a laptop or the resident applying for a permit. Someone still has to ask for something, someone has to approve it, and the right APIs have to be called in the right order with a record of who did what. That is the work Kinetic does. Kinetic is a workflow platform used by government and defense organizations for more than 20 years, and it is deployed in DoD IL5 environments such as Army INSCOM.
Used together, the split is simple. MuleSoft connects and governs the APIs. Kinetic provides the forms, portals, approvals and workflows that people (and AI assistants) use, and it calls MuleSoft APIs to get the work done in the systems of record.
Kinetic also ships an MCP server, so AI assistants can work with it directly. Within the signed-in user’s permissions, an assistant can find a service, fill in a form and start a workflow. The workflow itself then runs the same way it would for a person, with the same approvals and audit trail.
What agencies run into
Systems that don’t talk to each other
HR, IT, facilities, finance and security each have their own tools and data. Any request that crosses departments turns into email and manual hand-offs.
APIs that nobody calls
Integration teams publish APIs, but there’s no user-facing application that puts them to work. Mission teams need workflows, and APIs alone don’t give them one.
Customer experience goals without a way to deliver them
Federal guidance asks agencies to make services simpler for the public and for employees. Doing that takes self-service front ends and back-end workflow, which many agencies don’t yet have.
Zero trust needs process as well as policy
Access requests, onboarding actions and provisioning steps each need to be authenticated, authorized and logged. Network segmentation covers only part of that.
Slow procurement
Buying and integrating several products through separate contract vehicles can add months of delay and integration risk to a project that was already approved.
Shared services that aren’t shared
A shared service center needs one front door for employees across departments and connections to many fulfillment systems behind it. Most service management tools are built for one side or the other.
How the two platforms fit together
Each platform keeps its own job. MuleSoft handles integration and API governance. Kinetic handles the work people see: the request, the form, the approvals and the workflow that ties them to back-end systems.
Kinetic: people and AI assistants
Self-service portal, forms, service catalog, MCP server
Kinetic: workflow
Routing, approvals, conditional logic, SLAs, audit trail
MuleSoft: APIs and integration
Anypoint API Manager, API Gateway, Exchange, DataWeave, event-driven flows
Systems of record
Active Directory, ServiceNow, SAP, Salesforce, HR systems, mainframes, cloud services
Where they connect
Forms that read from APIs. A Kinetic form can call a MuleSoft API while someone fills it in. Pick a department and the form loads that department’s assets, people or locations, with Anypoint handling security and caching.
Workflow steps that call APIs. When a step finishes (a manager approves the request, say), Kinetic calls a MuleSoft process API to provision the account, open the ticket or update the ERP.
APIs offered as services. APIs published to Anypoint Exchange can be wired into Kinetic workflows and offered in the service catalog, so a new service can often be built from APIs that already exist.
Security at two levels. MuleSoft enforces API policies such as OAuth, mutual TLS and rate limits. Kinetic enforces process rules such as role-based access, approvals and separation of duties.
Status flowing back. MuleSoft can post status updates back to Kinetic. When an outside system finishes its part, the workflow moves to the next step on its own.
AI assistants through MCP. Kinetic’s MCP server gives AI assistants access to the Kinetic APIs the signed-in user is allowed to use. An assistant can search the catalog, open a form, fill it in and submit it, and the resulting workflow calls the same MuleSoft-governed APIs as any other request.
Eight examples
These are patterns agencies can build with the two platforms. Each lists what Kinetic does and what MuleSoft connects.
All sectors
Employee onboarding and day-one readiness
The hiring manager submits the onboarding request in Kinetic. After approvals, the workflow calls MuleSoft APIs to create the AD account, assign equipment, issue a badge and enroll the new hire in training before their first day.
Kinetic: portal, forms, workflow. MuleSoft: AD, HR system and asset APIs.
DoD
Access requests across security domains
A service member requests access to a classified system. Kinetic routes the request through the supervisor, the ISSM and the authorizing official. MuleSoft APIs carry out provisioning across identity stores, PKI and access control lists, and every step is logged for RMF review.
Kinetic: multi-level approvals. MuleSoft: identity, PKI and SIEM APIs.
Federal
Public service request portal
Members of the public submit requests through Kinetic forms. MuleSoft pulls case data from Salesforce, checks eligibility against mainframe APIs and posts status updates back to the request.
Kinetic: public portal and forms. MuleSoft: CRM and legacy system APIs.
State and local
Shared services across agencies
A state brings IT, HR and facilities requests for many agencies into one Kinetic portal. Each agency keeps its own back-end systems, exposed through standard MuleSoft APIs, and requests route to the right agency automatically.
Kinetic: one portal with per-agency routing. MuleSoft: cross-agency APIs.
DoD
AI-assisted IT service requests
An AI assistant takes a routine request, finds the matching Kinetic service, fills in the form and submits it on the user’s behalf. MuleSoft connects the workflow to the CMDB, monitoring tools and cloud platforms. Requests that need judgment go to a person through the same workflow.
Kinetic: MCP server and workflows. MuleSoft: CMDB and cloud APIs.
Federal
Zero trust workflows
Kinetic runs access reviews, exception requests and device compliance attestations, the process side of OMB memo M-22-09. MuleSoft brings in risk signals from the identity provider, EDR tools and SIEM so reviewers decide with current data.
Kinetic: access reviews and exceptions. MuleSoft: IdP, EDR and SIEM APIs.
State and local
Permits and licenses
Applicants apply through Kinetic forms. MuleSoft APIs check applicant data against state databases, look up zoning in GIS and take payment. Inspectors receive their assignments through Kinetic on a phone or tablet.
Kinetic: applicant portal and inspections. MuleSoft: GIS, state database and payment APIs.
All sectors
Contractor and vendor lifecycle
From onboarding to offboarding, Kinetic handles requests, approvals and lifecycle steps. MuleSoft APIs reach the background check, VMS, facility access, network and timecard systems, so access is removed cleanly when the contract ends.
Kinetic: lifecycle and compliance. MuleSoft: VMS, background check and access APIs.
What agencies get from the pairing
API reuse. One MuleSoft API can serve many Kinetic workflows. Onboarding, offboarding and transfers can all call the same identity API.
AI where it helps. AI can draft workflows at design time and help with steps such as classifying or summarizing a request. Once a workflow is built, it runs without calling a model on every step, which keeps cost down and behavior predictable.
Security at the API and the process. MuleSoft secures the API calls. Kinetic controls who can request, who must approve and who did what. Both keep logs.
One record per request. A request can be traced from submission through each workflow step and API call to the system that fulfilled it.
Deployment that fits the mission. Kinetic runs as a Kinetic-hosted cloud service or as a customer-managed install, including air-gapped networks. It supports CAC/PIV sign-in and SSO over SAML and OIDC, and it is deployed in DoD IL5 environments.
Buying it
Kinetic and MuleSoft are licensed separately. If you’d like to know which contract vehicles are available for your agency, ask us and we’ll tell you what applies.
Where to start
Most agencies start with one request type that already has APIs behind it but still runs on email: onboarding, an access request, or a permit. Build that workflow in Kinetic, call the MuleSoft APIs you already have, and measure how long a request takes before and after. The next workflow reuses the same APIs.