Start from what the company already runs
Trusted public APIs, private services, and the events worth listening to, all in one catalogue. Anything missing goes in from a spec, a schema, or the provider docs—including the internal service whose only real documentation is the person who wrote it.