How do we deal with lack of service level agreements for APIs from external sources? What are the workarounds?

No workarounds are required.  A good mashup platform can also provide 'mashup enabling' capabilities, and doing it in a governed way (i.e. connected to the authentication/authorization/governance tools you might already have).