I heard someone at an API security conference here in NYC a couple weeks back mention how most of the API management, security, and governance solutions out there didn’t really meet their needs cause they were a large global company and had very different needs. I’ve heard this many times over from enterprises who aren’t quite listening to the message of what APIs are about and strongly believe in the culture of their companies, despite a significant amount of external and internal evidence pushing them to evolve.
Let’s revisit the acronym. API standards for application programming interface. You are providing an interface for someone to apply programmatically, which according to the Postman State of the API report are 56% Private, 26% Partner, and 18% Public. Over half the time, the people you are interfacing are drinking from the same well you are, so your belief systems are probably aligned. However, the other 50% of the time you have to adapt to another way of thinking, step outside of your world, and understand who you are interfacing with.
More people I talk with think APIs are just an internal thing because that is all they see. You see this perspective reflected in MCP and other standards. The world is messy and full of variety, and being pulled out into this world teaches you to do APIs better, but it also teaches you to do what your business does better. My recommendation for enterprises is to treat 100% of your APIs like their are public, as this raises the bar and forces your teams to think more critically about the technology, business, and politics of doing APIs in the real world, not just the controlled environment of your enterprise.
