Stories about the technology, business, policies, and people of APIs.
If you run a gym, a coaching practice, a running club, a bike shop or a corporate wellness program, you have probably wished you could see the workouts your people are already logging, without aski...
If you run a business that has to know where things are, you have probably wrestled with this. You have a spreadsheet of customer addresses and you need them on a map. You have a delivery driver’s ...
If you want to put DocuSign signing inside your own product, you’re looking for the developer plans, not the eSignature plans most people see first. Both are priced differently, and the difference ...
I am working through the companies that publish an A2A agent card and looking at them next to their competitors. I laid out the bigger picture in 934 conformant A2A agent cards and who is publishin...
If your business runs on Microsoft 365, a lot of your day goes into the same handful of chores. Adding a new hire and setting up how they sign in. Checking whether a security alert needs attention....
People see the result of a profile: a provider page on APIs.io, a Kin Score, a band, and an Agent Readiness reading. They don’t see what it takes to get there. I get asked about it enough that I wa...
Yesterday I shared the panel on designing for the agentic experience from Nordic APIs Summit in Stockholm. Today it’s my closing talk from later that same day, which I’ve also added to the API Evan...
Yesterday I shared a screenshot on LinkedIn, and it took off. More than 32,000 people have seen it, and the comments are still coming in. The screenshot was of a Bluesky post by Jan Lehnardt, quoti...
For five weeks I have been putting numbers from job postings in front of you. MCP in 102 companies, Claude in 380, Sarbanes-Oxley in 518. Before the Q4 read lands on November 20, I owe you the othe...
Most API governance conversations start with a decision somebody has to defend. “Every list endpoint must paginate.” Fine, but where is that written down, what rule checks it, and what standard doe...
Someone who works at a software vendor told me about an interesting exercise recently. They looked up their own company on APIs.io, then their competitors, then a lot of the software platforms they...
I have wanted a Schema.org for APIs for a long time. I don’t mean another standard written by a committee and handed down. I mean the vocabulary the market already shares, measured from the OpenAPI...
A lot of teams run projects in Smartsheet and then spend part of every day checking it: did someone update that row, did the status change, has the new request come in. Then they copy what changed ...
If your business sells on TikTok, you probably know the routine: building ad campaigns in one screen, checking orders in another, updating products by hand, printing shipping labels one at a time. ...
Maybe you want a store locator that looks like your brand rather than a generic map. Maybe you have a list of delivery zones, service areas, properties or field assets and want them on a map your c...
Most small businesses running QuickBooks have someone re-keying numbers: orders from the store into invoices, supplier bills from email into payables, totals from the books into a weekly report for...
If you’re choosing between GitHub and GitLab, you’re picking where your code lives, where your builds run and how much you pay per developer for both. You’re also picking an API. Both companies let...
If you have ever caught yourself copying search results into a spreadsheet by hand, checking where your business shows up on Google Maps, watching which jobs a competitor is posting, or tracking ho...
For more than a decade I’ve showcased the common building blocks of an API. Documentation, a getting started page, SDKs, authentication, sign-up, pricing, rate limits, terms of service, a privacy p...
One group I talked with recently spent their time looking at companies across banking and accounting rather than at their own. They came away with two observations: the companies they looked at mos...
Agent skills are piling up. A SKILL.md is a Markdown file with a little YAML frontmatter on top, and it tells an agent when to pick up a capability and how to use it. Teams are writing them by the ...
I’ve been building bundles that pair a JSON Schema with OpenLint-format rules, after finding out that the decoder only pours part of the bedrock. Insurance is the awkward one, and that makes it int...
I was back at Nordic APIs in Stockholm this year, my first time since I gave the opening keynote at the very first one in 2015. While there I sat on a panel with Erik Wilde and Daniel Kocot, modera...
Two weeks ago I wrote about what 466 conformant A2A agent cards are actually offering. The A2A section of APIs.io now shows 1,279 providers serving an agent card, 934 of them conformant, advertisin...
You run a clinic, a lab, a pharmacy or a small health software company, and the same patient keeps getting typed into three different systems. The front desk registers them, someone re-keys the lab...
Your team has an API, or a partner just handed you the description of theirs, and now someone has to write the code that talks to it: a library for the Python developers, another for the JavaScript...
Your business runs on other people’s software. Customer records live in Salesforce, documents in Microsoft 365 or Google Workspace, conversations in Slack, code in GitHub, and every one of those ha...
You have a spreadsheet of customer addresses and a van, or a checkout form where people keep mistyping their street, or a store locator that needs to show what is nearby. Each of those jobs starts ...
You want to know what people are saying about a restaurant, a plumber or a salon, maybe your own business, maybe a competitor down the street, maybe the hundred locations you are thinking about par...
I get asked a version of the same question almost every week. Do I need OpenAPI or MCP? Is Arazzo a replacement for something? Where does A2A fit? The honest answer is that these specifications are...
Every SaaS homepage I load right now tells me about AI. Agentic this, copilot that, models, intelligence, automation. I wanted to know whether any of it holds up once you go past the homepage. So I...
When someone asks me whether a specification is “real,” they are usually asking about adoption, and they usually get an answer made of vibes: a logo wall, a star count, a conference keynote. If you...
The business capabilities section of APIs.io is built on Turbo EA Capabilities by Vincent Verdet, an openly licensed enterprise capability model with 333 top-level capabilities and nearly 10,000 no...
This all started with Jev. Last month I went looking at decision models, the wave of APIs that followed TypeSafe’s Jev and its System One API in returning a choice, a score or a yes or no with prob...
One of my favorite moments in a recent conversation was someone discovering that APIs they are responsible for already had a score. They had never heard of the Kin Score. They looked up their compa...
If you ship products to customers, you know the question that fills your inbox: “where is my order?” Somebody on your team copies a tracking number into a website, reads the status, and pastes it b...
If your business runs a subreddit, whether it is a support community for your product, a fan space for your brand, or a place where customers trade tips, you have probably felt the weight of keepin...
Say you run a business and your customers keep asking whether they can invest through you. Maybe you are a budgeting app, a payroll product, or a community platform, and you want people to open an ...
If you sell on Etsy, you probably know the routine. You create a listing, upload photos, set a return policy, wait for an order, copy the tracking number into the order, mark it shipped, and then c...
If you run search ads for your business, you know the routine. Log in, check what each campaign spent yesterday, pause the keywords that are burning money, raise the bids on the ones that convert, ...
Your customers are already on WhatsApp, and they would rather get the order confirmation, the appointment reminder or the delivery update there than in an email they will not open. You might also w...
Your company runs on Workday, and most of what you need from it is a lookup or a request: a worker’s payslips for a mortgage letter, a clock-in from a kiosk that is not Workday, a benefits change a...
Your team keeps the real list in Airtable: the clients, the content calendar, the inventory, the applicants. It works until the list needs to talk to something else. Orders arrive in another system...
You run a shop, a cafe or a salon on Square. The register works, the money shows up in the bank, and then the questions start. Can the web store and the counter share one product list? Can the stoc...
If you are choosing a CRM, the system that holds your customers, deals and support history, the shortlist almost always comes down to HubSpot and Salesforce. Most comparisons stop at features and s...
You have a brand template in Canva and a spreadsheet of names, prices or event dates, and you need a finished graphic for every row: a social post per product, a certificate per attendee, a price c...
Your website sits behind Cloudflare, and most days you never think about it. Then a new service needs a DNS record, a bot starts hammering the login page, a lookalike domain shows up pretending to ...
Your customer records live in Salesforce, and so does a lot of the work that happens around them: the welcome email when someone signs up, the points they earn in your loyalty scheme, the dashboard...
You run a business account on Instagram, and the posting is the easy part. What takes the time is everything else: scheduling posts from the same calendar your other channels use, clearing spam fro...
You want to text a customer when their order ships, call them back when a form is submitted, or put a small support desk behind one phone number without buying a phone system. None of that needs a ...
When people ask me what the OpenAI API costs, they usually want one number. There isn’t one. OpenAI sells its API on metered usage: you pay per million tokens, a token being roughly three quarters ...
You sell on eBay, and the selling part is fine. It is everything around it that eats the week: keying the same listing in for the third time, marking orders shipped one by one, buying labels, and k...
Two good tooling questions came up in a recent conversation about the Kin Score. Should you run it in CI on every change, watching it go up and down like code coverage? And can it run inside a deve...
I regularly get reminded that x- as a practice is not sanctioned by the IETF, so I shouldn’t use it when working with API standards. I get the sentiment, and I get why the argument can be made at t...
There are a lot of changes happening to the economics of APIs that are powering our applications. The free or freemium tier that has been a staple of SaaS and API plans and pricing for over 15 year...
This week I’ve been building bundles that pair a JSON Schema with OpenLint-format rules, after finding out that the decoder only pours part of the bedrock. When I looked at payments and banking, I ...
A lint report is a list. Two hundred and forty-two diagnostics on a three-operation Petstore is accurate and useless to the person who has to decide whether the API is ready. What they want is one ...
Yesterday I wrote that the client stack did not collapse, it went dark. An agent reads the docs, explores, writes a small SDK for the three operations it needs, and wires it into the task, all insi...
The Monday sales dashboard is stale again because nobody pressed refresh. The same report has to be copied into twelve regional workspaces and pointed at twelve regional datasets. A customer wants ...
Your product needs to tell people things: your order shipped, someone commented on your document, your payment failed, your report is ready. Some users want that by email, some want a text, some wa...
Your company has data or a service that partners, customers or your own mobile app need to reach. You want a front door for it: a single address, with a key for each caller, a limit on how much eac...
Your company’s code lives on GitHub, and so does a growing share of the work around it: the bug reports, the review conversations, the automated tests, and the security warnings about libraries you...
Someone on your research or engineering team wants to try a quantum computer. Not buy one, just run a small program on real quantum hardware and see what comes back. The practical questions are the...
When someone asks me how we got here, with agents calling tools over a protocol that didn’t exist two years ago, I don’t have a short answer. I have a long one, and for years it lived in a single p...
I spent the last two days re-profiling every live member of the Microsoft API estate on APIs.io. That is 169 provider profiles, run in ten waves of up to twenty, each one re-checked against Microso...
When I forked Spectral back in July, the first downstream user I pointed at was the Dutch government. The Netherlands’ REST API Design Rules are a mandatory standard, and they are written as Spectr...
On a recent call with Bruno Perez, who built the Manifest LLM gateway and has recently launched Okapi, I went hunting through my own blog for a diagram. Bruno was describing what his team is buildi...
People assume the Kin Score is only for public APIs, because that is what they see on APIs.io. It is one of the more common misunderstandings, and it came up again recently when people asked me how...
Earlier today I wrote about the client stack going dark, prompted by a call with Bruno Perez about what he and Sébastien Conejo have built with Okapi. At the end of that call I told Bruno that what...
You found the right person for the job, and they live in another country. Hiring them properly normally means setting up a company there, learning its employment law, running its payroll and findin...
You sell to other businesses and you need a list: every software company in Germany with fifty to two hundred people, say, or every company that just started hiring for a role your product helps wi...
Your marketing team wants to know which visitors are worth talking to, send them the right message, and test whether a new page actually works better than the old one. If your company already pays ...
You want product shots without a photo shoot, a short video for every listing, or a feature in your own app where customers type a description and get an image back. The AI models that can do this ...
Maybe your team writes software and you want the code, the bug reports and the release history living somewhere you control, not on someone else’s cloud. Maybe you already have that, and what you r...
Someone from a very new startup asked me a great question recently. They could see the ratings across different areas, but how could they use them to say their API is safe to go to production and s...
Earlier this week I wrote that the decoder only pours part of the bedrock, and started building bundles that pair a JSON Schema with OpenLint-format rules so an inference run can carry its whole co...
There is a lot of noise right now about AI regulation. Job postings are a good place to check how much of it has turned into work someone is being hired to do. The Q3 2026 Insights pull read 343,2...
Every team I talk to that is wiring an agent up to its APIs asks some version of the same question once the demo works: what is this thing actually going to see? Not what the agent is supposed to d...
Your store is doing well enough that the busywork is starting to hurt. Someone is copying orders from a marketplace into your shop by hand, someone else is pasting tracking numbers into shipping em...
Maybe you have a thousand product descriptions to rewrite, a backlog of support emails to summarize, or a team that keeps pasting the same instructions into a chat window every morning. Doing that ...
Your product needs people to sign in, and suddenly the list gets long. Customers want a second factor on their accounts. A large prospect wants their employees to log in with the company’s own syst...
Your team wants to summarize customer feedback, transcribe sales calls or sort product photos, and someone has suggested using an open source AI model instead of locking into a single vendor. The q...
Maybe your database passwords live in a configuration file nobody wants to touch, an API key for a payment provider has been the same since the day someone pasted it in, or a teammate left and you ...
The plans section on APIs.io used to be a list. It was a five megabyte A to Z of every provider we had read a pricing page for, and it was about as useful as that sounds. You could find one company...
I just added SLA4OAI to the API Evangelist standards catalog, and writing it up sent me back through my own archive. I have been writing about API service level agreements for twelve years, and mos...
I caught up with Pedro J. Molina this week. Pedro is one of those people I always learn something from, and we tend to go a couple of years between conversations, which we both agreed needs to chan...
Most of the money right now is going to AI. Most of the people I talk to who run API programs know their foundations need work, and they have a hard time getting that heard next to anything with an...
If you sell API tooling, run partnerships, or are trying to figure out which large enterprises are actually ready to integrate with you, you need a list. Not a list of logos. A list ranked by how m...
A new analyst starts on Monday and can’t see the sales tables until someone files a request. A departing contractor still has access nobody remembered to remove. Your data bill climbs because a lar...
Your website slows to a crawl on a busy morning. Customers are complaining, three teams are on a call, and each one is sure the problem is somewhere else. After it is fixed, somebody has to write u...
A big customer asks whether your product can notify their system the moment an order ships. Your engineers say yes, then quote you weeks of work, because sending the message turns out to be the eas...
Your marketing budget lives in a spreadsheet, your campaign emails live in one tool, and customer questions pile up in a shared inbox. Someone spends part of every week copying things between them,...
Every Monday somebody on your team logs into Google Analytics, pulls the same numbers, pastes them into a spreadsheet and sends it around. A sale that closes in your back office never shows up next...
I recently spent a morning listening to a room full of people who run API programs talk about what they would do with the Kin Score. The first use that came up was the one I find most useful: treat...
A while back I wrote about a self-hosted fitness app and the providers it plugs into. Looking at applications that way was useful enough that I kept going, and we now have blueprints for 90 kinds o...
Over the last two weeks I wrote a series of posts about what happens when DeepInfer puts batch-invariant inference, deterministic sampling and schema-constrained output in the open. My line was tha...
This is the third story in my series on what each API Evangelist operation can do. Friday I searched sixteen years of research. Today I’m back to the contract, with a question every API team has be...
Your company has data or services that partners want to plug into. Maybe a customer has asked for a direct connection, or a partner wants to pull your pricing into their own system. Your developers...
Your site went down during a release last week, the person on call found out late, and the postmortem notes are scattered across three chat threads. Then the cloud bill arrived, and it was higher t...
A customer says your system never told theirs about a new order. Your team says it did. Nobody can prove it either way, and the order is sitting in limbo while people trade screenshots. This is wha...
Customer questions are arriving by email, chat and phone, someone on your team is copying details from one system to another, and an unhappy rating sits unread until the customer has already left. ...
A patient is due in tomorrow morning and someone at your front desk is on hold with an insurance company, trying to find out whether the coverage is active and what the co-pay will be. Someone else...
Your website is slow, your checkout just failed for three customers, and no one can say why. Your team is hunting through logs on separate systems, and you learned about the trouble from a customer...
If your business connects to other companies, or lets partners and customers connect to you, you probably depend on APIs, the connections that let one piece of software talk directly to another. Wh...
Maybe you have a stack of meeting recordings nobody will ever listen to, product copy that needs a voiceover, or a growing AI bill nobody can explain. Typing into a chat window does not get you far...
If your business uses LinkedIn to find customers or hire people, you know how much of it is manual. You adjust budgets by hand, download leads from a form and paste them into your sales system, and...
If your business runs on a web application, there is a database underneath it holding your customers, your orders and everything else you cannot afford to lose. You need a new one each time a proje...
I’ve spent the last couple of weeks writing about DeepInfer and the shape of the answer, walking through one industry at a time. Starting Monday I’ll publish a worked example for each of them. Befo...
If you sell to other businesses, you know the job: you have a list of companies you would like to work with, and you need to reach the right person at each one. So you end up guessing at addresses,...
If your business runs its applications on Azure, there is a good chance a monthly bill has made you ask an uncomfortable question: why are we paying for all those servers overnight, when nobody is ...
If your team runs on Jira and Confluence, a good part of your week is probably spent copying. A customer complaint becomes a ticket by hand, a status report gets retyped into a wiki page, and every...
If you sell software, a surprising amount of your time goes to things your customers never pay you for: who can log in, who is an admin, which plan unlocks which feature, and how to try something n...
If your business ships software, you probably know the morning routine. Someone asks whether last night’s build passed, someone else goes hunting for why it failed, and a release sits waiting becau...
I spend a lot of time trying to keep track of who is working on what across the specifications that matter to APIs, and lately most of the motion is in one place: how an AI agent finds a seller, tr...
This is the second story in my series on what each API Evangelist operation can do. Yesterday I linted an OpenAPI. Today I’m going the other way, from checking a contract to finding out what’s alre...
I tried to get a Reddit API key this week. I wanted something small: read-only search across a handful of developer subreddits, to find “is there an API for X?” questions I could answer by hand. Re...
I’ve been sitting in on the MCP Agents Working Group, and this month it stopped being a working group. On October 16 it was converted to an interest group, its Tasks work and the leads behind it mo...
If you run an online store, you already know the email that earns money: the welcome note to a new subscriber, the campaign to people who bought last spring, the reminder to someone who left a cart...
Plenty of businesses need a little bit of code running somewhere: resize the photos customers upload, process an order when it lands in a queue, answer a form on the website. Renting and patching a...
If you manage a software team, you have seen the repository that nobody tidies: hundreds of old branches, release branches someone forgot to protect, and a chat channel that never hears about a pus...
Every Monday somebody on a marketing team opens the analytics tool, picks a date range, applies the same filters as last week, and exports the same report into a spreadsheet. Then somebody else ask...
If you run conferences, trade shows or customer events, most of the work happens between the events: keeping the contact list clean, setting up early-bird and partner discount codes, sending the in...
Today the Skills extension for the Model Context Protocol moved into Beta. Pull request #161 in the ext-skills repository merged today, moving the specification from specification/stable/ to specif...
This is the first in a new series. Every business day I’m going to take one API Evangelist API operation, and the MCP tool that sits on top of it, and show what it does with a real input. No screen...
Google published a good look at how it ships its Agent Skills like products, two months after the first behind-the-scenes post. The Google Agent Skills repository now holds more than 170 skills fro...
Last week I wrote about DeepInfer and the shape of the answer, and how batch-invariant inference, deterministic sampling and schema-constrained outputs make valid JSON table stakes and push the har...
API Evangelist just became a financial contributor to OpenLint on Open Collective, with a €1,000 contribution. I want to explain why, and ask you to do the same if your work depends on API linting....
If your business ships software, every change your team makes has to be built, tested and released, and when something breaks, someone has to find out why and run it again. That loop is called cont...
Some business questions are really questions about connections. Which customers are linked to the same fraudulent card? Which products are bought together? Who knows whom in your network? A spreads...
If you build software for other businesses, sooner or later every customer asks the same question: does it work with our accounting system, our HR system, our CRM? There are dozens of each, and bui...
Getting a contract signed should not mean printing, scanning and chasing people by email. If your business sends the same agreements over and over, whether offer letters, service contracts or renta...
If you run a business, you probably need to do two things with email that feel like they should be simpler than they are: keep a clean list of the people you are talking to, and get the right messa...
Every API standard I’ve watched take shape was decided by somebody, and it was rarely the people who end up living with it. I’ve been thinking about this a lot since forking Spectral into OpenLint,...
For the last three weeks I have been comparing two groups of companies inside the Q3 2026 Insights pull, and every time the comparison has been the most interesting part. So this week it is the who...
One of the sharpest responses to MCP is last-mile plumbing took my own argument to the CFO. If the API is the water main and the MCP server is the flexible supply line under the sink, then teams ar...
When I wrote that MCP is last-mile plumbing, the best response I got wasn’t a comment. It was a repost, with one example that turned my analogy into a test. An email MCP connector will happily draf...
Australian government publishes more than almost anyone, and an agent still cannot find most of it on its own. This is the third in a short series ahead of The API Economy Roundtables at apidays A...
Last week I wrote about DeepInfer and the shape of the answer, and how batch-invariant inference, deterministic sampling and schema-constrained output make valid JSON table stakes and push the real...
Most businesses already use Google every day, for documents, for maps, for finding customers and getting to them. What fewer people realize is that much of that is available as APIs, which let othe...
If you ship parcels from the US, you have probably done this: open four carrier websites, type the same box dimensions into each, and compare prices by hand before buying a label. SMKlog does that ...
If you sell online and your store keeps growing, the questions change. How do I give wholesale customers different prices? How do I make sure tax is calculated right on every order? How do I bring ...
If you are responsible for the servers and cloud systems your business runs on, the work never really stops: spin up an environment for a new project, give a new hire access, run the same maintenan...
If you run an online store on WordPress, a lot of your week probably goes to the same chores: adding products, fixing a price on a variation, creating a coupon for a promotion, looking up a custome...
Every mature API has a style guide. Two pages on how to name a path, shape a response and report an error do more for consistency than a hundred lint rules nobody reads. Almost no MCP server has on...
I get asked why I forked Spectral. The honest answer is that I almost did it the wrong way, by myself, for my own reasons. What came out instead is OpenLint, a community fork with a name, a formal ...
Last week I wrote about DeepInfer and the shape of the answer, and how batch-invariant inference, deterministic sampling, and schema-constrained output make valid JSON table stakes and move the har...
Outside of tech, Australia’s API contracts were written by the regulator. Yesterday I ranked the most programmable sectors in Australia using 227 of the country’s largest companies. Tech came out ...
If you run a website or an app, the worst way to find out it is broken is from a customer. So people search for how to get alerted when their site throws errors, how to know which release introduce...
If your team lives in Jira, you know how much time goes into getting things into it and keeping them current. Bug reports come in from a support form, incidents from a monitoring tool, vulnerabilit...
Most people who end up at Stripe did not set out to use an API. They searched for how to accept credit cards on a website, how to charge customers every month, how to send an invoice that someone c...
Every growing team hits the same wall. Work arrives from email, forms, support tickets and chat, and someone has to copy it into the project tool by hand, assign it, and remind people about it. So ...
If you sell into more than one state, or more than one country, you have probably found yourself searching for how to charge the right sales tax on every order, how to know where you even owe it, a...
Australia is the only country I track that treats data access as a right across the economy, and that one decision explains almost everything that is different about its banks and its telcos. I ha...
As of today’s build, the A2A section of APIs.io has 594 providers serving an agent card. 467 of them are conformant, meaning the card passes every structural check against the A2A AgentCard object....
For twelve weeks I’ve been reading a set of specification repositories every Monday and writing up what actually changed in them — not what was announced, what merged. That work now has a home on t...
Australia is programmable where it is paid to be, or made to be. Everywhere else, it is dark. Ahead of The API Economy Roundtables at apidays Australia this Wednesday, October 28th, I profiled 227...
A lot of companies are asking me some version of the same question right now. We want our operations to be programmable for agents, so do we need MCP, or A2A, or both? It is the wrong first questio...
Last week I wrote about DeepInfer and the shape of the answer, and how batch-invariant inference, deterministic sampling and schema-constrained outputs move the hard problem from “get valid JSON” t...
Salesforce is going to charge Flex Credits when AI agents call into a production org. Every successful call a registered agent makes, over MCP or straight through the API, gets counted as a “Headle...
OpenAI has donated Open Responses, its specification for a common LLM API, to the Agentic AI Foundation, the Linux Foundation home that already holds MCP, A2A and AGENTS.md. The New Stack has the s...
Earlier this week I wrote about DeepInfer and the shape of the answer, and how batch-invariant inference, deterministic sampling and schema-constrained output move the hard problem from “get valid ...
I’m going to ask for money, so I’ll get straight to it. If your business depends on OpenAPI, please become a member of the OpenAPI Initiative. If you were a member and let it lapse, please come bac...
Last month I came out of Josh Twist’s talk on MCP monetization in Stockholm arguing that API monetization is falling flat, and maybe it is the word. AI puts a cost on both sides of every call, so w...
I sat in on Josh Twist’s talk on MCP monetization at the Nordic APIs Summit in Stockholm last week. Zuplo’s framing starts from Marc Benioff’s line about the end of the UI and the birth of “headles...
After my keynote at Tyk’s LEAP ON TOUR in New York yesterday, Buddha put me on a panel with Kelly Rogers, who spent five years building AI infrastructure and running AI enablement for about 17,000 ...
On November 20, 2008, Leonard Richardson stood up at QCon and gave a talk he styled after an episode of This American Life. Three acts and a conclusion. The third act was called “The Maturity Heuri...
Earlier today I wrote that we had the agent protocol in 2008 and left it on the table. Leonard Richardson laid out a heuristic at QCon that topped out at hypermedia, meaning links that tell you whe...
Mike Goerlich at Curity published the third piece in his Security Sovereignty series today, Who Controls Trust? How Do You Regain It?, and I want to respond to it, partly because he was kind enough...
Earlier this week I wrote about DeepInfer and the shape of the answer. Batch-invariant inference, deterministic sampling, and output constrained to a JSON schema or grammar now ship together in the...
Yesterday morning I opened Tyk’s LEAP ON TOUR: The Future of MCP Governance in New York, a room of about thirty people who decide how their companies will govern agents, most of them from finance. ...
I was at a conference in New York yesterday, and someone from the financial industry told me there just aren’t enough useful MCP servers in their sector. I didn’t want to answer from my gut, so whe...
Nine days ago I wrote that the Kin Score was getting a third dimension, the market. I want to show where that work stands, warts and all. We are building this in the open, and I would rather you se...
Mike Amundsen published a short one yesterday, Designing for Autonomy, while he finishes his new book, AI-Driven API Design. It’s two axioms he settled on while building GRAIL, his work on software...
Job postings do not name AI companies. They name AI products. That is the clearest thing in the Q3 2026 Insights pull when you line up the vendors against what they sell. The pull read 343,299 job...
Yesterday I wrote about DeepInfer and the shape of the answer, and how batch-invariant inference, deterministic sampling and schema-constrained output together make valid JSON table stakes and push...
On September 13 the Model Context Protocol made skills official. SEP-2640, the Skills Extension, went Final, and the working group behind it published a docs site with the stable specification. Fiv...
We built an AI agents market for the Kin Score this week, and it is the first market where the strongest evidence is something a provider publishes about itself. What we read The A2A protocol let...
I hear the same thing in almost every enterprise conversation I have. We can’t have a public developer portal. We can’t publish our API documentation. Our customers are big, our deals are negotiate...
One of the markets we built this week isn’t an industry at all. It cuts across the whole catalog: which API providers publish their own official SDKs. How we measured it We started from the SDK l...
DeepSeek open-sourced DeepInfer last week, the inference framework that powers its own large-scale production services. It is Apache 2.0 licensed, it runs DeepSeek-V4.1-Flash on NVIDIA’s newest GPU...
When you build a market layer out of public registers, you quickly find two very different kinds of entry, and the Kin Score has to treat them differently. Two kinds of entry The first kind is a ...
Four days ago I wrote about our agent finding four APIs, proving who it was, and getting all four to trust it. I ended that post with what was still broken, and the biggest thing was money. A perso...
Naresh Jain published Are Harnesses Worth the Cost? on martinfowler.com last week, and it is the most useful thing I have read about coding agents this year. It’s useful because it measures somethi...
Two weeks ago Sierra and Meta announced the Personal Agent Protocol — “Poppy” — and I added it to the API Evangelist standards catalog. It asks a company to publish /.well-known/poppy.json, a docum...
One of the stranger results from building out the Market layer of the Kin Score is how often the biggest names in an industry don’t show up in its structure at all. Consumer goods We built a cons...
I’ve had a bee in my bonnet about Bruno Pedro’s story “API Governance Isn’t Just Rule Automation” for a couple of weeks now, but I just haven’t had the time to gather my thoughts while on the road....
A week ago I said the Kin Score was getting a third dimension, the market. Since then we have taken it from four markets to eighty-six, and the most useful thing I learned along the way is not abou...
I am working with an API provider right now on making their platform ready for agents, including standing up their own MCP server. The most useful thing I have done for them so far isn’t designing ...
A couple of weeks ago I wrote about how Pipedrive put a price on every tool call: an x-token-cost on all 371 operations, in Pipedrive’s own rate-limit currency, sitting right next to the descriptio...
I think the wires are crossed in how we are using agents right now. The thing agents are actually good at, and the thing they actually need, is structured, machine-readable content written for othe...
When I sat down with Zdenek Nemec last month, he made a point I have not been able to shake. Before 2020, direct monetization was only ever a small slice of why companies built APIs. Maybe ten perc...
My first rule for any software I use to run API Evangelist is that it must have an API. Not just because I like APIs, but so that my business can get its data in and out. An API reduces my switchin...
I built four small sites this fall so I would have something real to point agents at. Yawplet takes short messages. Yarnhen takes stories. Hagglebee takes classified ads. Eventwren takes events. Ea...
Some of the most widely implemented API contracts in the world were never ratified by anybody. The S3 interface, the OpenAI API, CKAN’s Action API and Ethereum’s JSON-RPC became standards by being ...
Last week I looked at how few of the companies we track name OpenAPI in their job postings. This week it is the protocol everyone in the API space has been arguing about for the last year: the Mode...
Last week I wrote about Overlay 1.2 and the fourteen jobs we already use Overlays for, and then about why an Overlay is a layer and not a diff. Both posts leaned on a number, that the APIs.io catal...
I was reading through Open Resource Discovery this morning — SAP’s protocol, now under the Linux Foundation Europe’s NeoNephos, for a system to describe the APIs and events it exposes — and noticed...
Vercel Labs has a new coding agent called fx. It is a small native binary, around 6MB, written in Zig, Apache-2.0 licensed, and on GitHub at version 0.0.13 with a banner telling you it is experimen...
Bill Doerrfeld opened the Nordic APIs Summit in Stockholm this morning with How AI Agents Change API Interaction Patterns, and about three minutes in he gave the room his definition of an AI agent:...
Two things happened last week that I keep putting side by side. On October 6, the Model Context Protocol finalized MCP Server Cards, and in doing so it declined to define its own discovery location...
I want to draw a line in the sand with this one, while acknowledging we are just getting started. For the last year the Kin Score has measured two things about an API provider: what they publish, ...
The Nordic APIs Platform Summit opens in Stockholm tomorrow, Tuesday and Wednesday, 13 and 14 October, and I close it on Wednesday at 15:45 with a talk called The Agent Hype is at Odds with Your AP...
There is a new Rules section on APIs.io, and it exists to answer one question I have been asked for years and could never answer with data: who actually publishes the rules their APIs are designed ...
A post came across my LinkedIn feed this week asking whether decision models will last as a category, and whether one schema is winning. TypeSafe’s Jev and its System One API. OpenAI’s Decisions AP...
One thing you see in a lot of the storytelling around APIs over the years is that people easily get trapped within the creative confines of a single API design pattern. Some of these trappings are ...
This is the last of nine posts, one Kin Score facet each business day. Yesterday I covered Open Source Surface. Today is Regulatory Posture, and it asks one question: does your API publish the cons...
Someone asked me this week which types of companies are the most programmable. I have an answer now, because APIs.io scores every one of the 28,834 providers in the catalog and rolls them up into 7...
Earlier this week I wrote that one in ten API providers still publish Swagger, and that OpenAPI 3.2 shows up for five companies out of 2,281. I ended that post saying versions are mostly set by def...
I sat in on the OpenAPI Technical Developer Community call this morning, and somewhere in the middle of a conversation about where the specification goes next, Henry Andrews stopped to explain JOSE...
Every specification I have watched grow up had the same quiet machinery underneath it. Someone proposes a change. A handful of people who maintain real clients, the libraries and applications that ...
Thursdays have become my specification day. Today I sat in on three calls back to back: the OpenAPI Initiative’s weekly community call, the A2A AI Catalog working session, and OpenLint’s office hou...
This is part eight of nine in a series walking through the Kin Score one facet a business day. Yesterday I covered Create-or-Update Ergonomics, the first of the conditional facets. Today is the sec...
I have been talking about capabilities for about two years now as some mystical, far-off destination I was headed toward from the landing of API engineering. A focus on API products was one of the ...
There is a good argument going on in the OpenAPI Overlay repository this week, and I want to take part in it properly rather than with a thumbs-up. Discussion #412, “Overlays: Our purpose is for un...
I spent most of yesterday doing what everyone does with bot traffic right now, which is asking whether any of it comes back. Am I cited in the answer? Do I rank in the AI Overview? Did anybody clic...
Two weeks ago I wrote about splitting the profiling pipeline into an open model, a commercial model and deterministic scripts, and last week I said that work is why I am confident enough to take AP...
This is part seven of nine, one Kin Score facet each business day. Yesterday I covered Operational Transparency. Today is Create-or-Update Ergonomics, and it asks one question: if you accept writes...
Every API provider I score depends on vendors for part of its surface: a documentation platform, a gateway, an SDK generator, a status page, an identity provider. When a score moves, some of that m...
APIMatic has been generating SDKs from OpenAPI for eleven years. Last month they put up a public marketplace of agent context bundles at context.apimatic.io — twenty-four APIs, MIT licensed, instal...
This is part six of nine, one facet of the Kin Score each business day. Yesterday I covered Access Clarity, which asks whether you can figure out how to get in. Today is Operational Transparency, w...
The OpenAPI Initiative released Overlay 1.2.0 on September 22nd. I sat in on the release call, where Lorna Mitchell walked the editors through the steps, one branch and one pull request at a time, ...
Yesterday I walked through everything you can do with the APIs.io API. Today is the other door into the same catalog: the APIs.io MCP server. I asked the live server what it offers rather than trus...
We moved every API Evangelist and APIs.io newsletter onto Commune back in August. I picked it because Fran Méndez built it, and Fran created AsyncAPI and ran engineering at Postman for me, so I tru...
This is part five of nine, one Kin Score facet each business day. On Friday I covered Developer Ergonomics, which is about how easy it is to get started once you are in. Access Clarity asks the que...
Someone asked me a simple question last week. Of the providers who publish an API definition, how many are publishing Swagger and how many are publishing OpenAPI, and which versions? 8,324 of the p...
There is a new name at the top of APIs.io. Of the 29,074 API providers in the catalog, ranked by the Kin Score, Nylas is now first, at 93.2 out of 100. That puts it in the exemplar band, up 16.5 po...
API Evangelist has spent a long time arguing that the machine-readable contract is the center of gravity for an API. OpenAPI for the request and response, JSON Schema for the shape of the data, Asy...
After APIDays in London, I can now usually tell within the first five minutes when an MCP talk at a conference is going to go nowhere, and was likely just AI-generated. There are clichés to look fo...
Someone asked me this week for a complete list of everything you can do with the APIs.io API. It is a fair question, and the honest way to answer it is to read the contract rather than my memory of...
An AI agent cannot fill in a signup form. I have been saying this for a while now, and the longer I sit with it the more I think the form was never really about authentication. OAuth solved authent...
This is part four of nine, one Kin Score facet every business day. Yesterday I covered Contract Governance, which is about whether your contract holds still long enough to build on. Today is Develo...
A question went around LinkedIn this week that I have been chewing on since: why is upsert not simply required of every CRM API? The person asking had done the arithmetic in the only place that mat...
This is part three of nine, one facet of the Kin Score each business day. Yesterday I covered Contract Quality, which asks how good your contract is. Today is Contract Governance, which asks whethe...
This is the last post in a series about OpenAPI vendor extensions, and I saved it for the end because it is the one that turns an argument about tidiness into an argument about a bug. Ripio, a Lat...
This is part two of nine, one facet of the Kin Score each business day. Yesterday I covered Discoverability, which asks whether your API can be found. Today is Contract Quality, which asks the ques...
Yesterday I showed you Demodesk’s x-mcp, an object with enabled, toolName and title. Here is Eon’s, from the same key, in the same position on an operation: x-mcp: true x-internal: false x-data-ac...
I have spent a lot of my career sitting with teams who are proud of their API, and who have no idea what it looks like from the outside. This is the single most consistent thing I have found across...
Yesterday I published Kin Score 0.23, the London release, and most scores in the catalog moved. Over the next nine business days I am going to walk through the Kin Score one facet at a time: what i...
The OpenAPI Initiative announced OpenAPI 3.2 on September 23rd, 2025. Almost exactly a year later, on September 22nd, the Fastify project shipped fastify-swagger v9.9.0, and its release notes are a...
This is the first of three posts about a single extension key. Three companies in my catalog use x-mcp. None of them knows the other two exist. All three mean something slightly different by it, an...
Ever since we launched APIs.io in 2014, one request has come up more than any other: can I run this inside my company? People did not want a public search engine for other people’s APIs as much as ...
“Agent-ready” has become one of those phrases that means whatever the person saying it needs it to mean. So I want to be specific about what it means in the Kin Score, because there it is not a fee...
On a planning call a few weeks ago I said something out loud that I had been sorting in my head for months: there are four ways a company reacts when I publish a Kin Score about it. It ignores the ...
I have been saying “16% human” out loud for a couple of months. I said it on camera when someone asked me why I don’t have the reach I used to, and I said it again on a planning call. It is a good ...
Pipedrive uses x-tool-description, which by now is a familiar shape in this series — an agent-facing description separate from the developer one: Retrieves paginated active deals with filtering...
Version 0.23.0 of the Kin Score is live. I had pinned it to API Days London on September 30th and froze the rubric on September 13th to hit that date. Then I shipped it five days early, on purpose,...
APIDays London is this Wednesday and Thursday, 30 September and 1 October, at Convene Sancroft next to St. Paul’s. Before I go, I did what I always do with an agenda: I read every session. All 110 ...
One of the blockers keeping me from getting to the next level with APIs.io and my API Evangelist profiling work was me being pedantic about the precision of every OpenAPI and supporting artifact I ...
In my recent conversation with Zdenek Nemec, Z of Apiary and Superface fame, we talked about just how hard it is for agents to onboard with your APIs. I am painfully aware of this in my own work, b...
I have spent two days running our profiling pipeline hard against the backlog — a few hundred companies, each one probed the way an agent would probe it: fetch the front door, look for a documentat...
One of the things Z and I talked about in our recent conversation (that is Zdenek Nemec, of Apiary and Superface) was his engagement with younger engineers and entrepreneurs about how agents will o...
MoEngage uses x-moe-mcp, in their own namespace, and it packs two quite different concerns into one object: x-moe-mcp: expose: external: true internal: true tool_description: | Lis...
Every leadership team I talk to is being sold an agent strategy right now. Most of those roadmaps are organized by model and by vendor: which LLM, which platform, which copilot. That is not how the...
Secureframe uses one key, x-mcp-description, and what they put in it is the clearest example I have found of the thing OpenAPI has never been able to express. Here it is, on the operation that att...
People do not ask their LLMs for POST /v1/refunds. They ask “can I give a partial refund instead of refunding the whole charge?” And when they hand the work to an agent they do not say PostRefunds,...
Now that API Evangelist is itself an MCP server, a question I used to think about abstractly has become very concrete and slightly personal: how do you nudge an LLM? For twenty years the discovery ...
Back in June I wrote that Kong Konnect has two front doors and neither one is the one I want. There was the platform admin API behind a personal access token, and there was the Dev Portal that actu...
On Monday I wrote that Amazon wants agents to ask permission, but there is no form to fill in. Two days later Amazon stood on stage at its Accelerate conference in Seattle and opened its seller too...
Every agent extension I have written about in this series marks something that already exists in the document. Wistia names an operation for agents. Windmill flags one. Zoho groups paths. Zuplo doe...
I have spent a week writing about what is being added to Arazzo — SOAP, actor in the loop, RPC, GraphQL, and the functions proposal. Today is about the thing that decides whether any of it matters....
Yesterday I published The Gateway Is a Tired Concept, Because Gateways Are About Power, and I will own that the headline was link baity. It did its job, the thread on LinkedIn filled up, and the be...
I have been around API gateways long enough to have watched them get sold as the answer to every problem in the space, over and over, for more than a decade. And I have come to a somewhat unpopular...
The Model Context Protocol has a Skills extension now. SEP-2640 was marked Final when its pull request merged on September 13th, and the work lives in modelcontextprotocol/ext-skills. The extension...
I went to the JSON Schema office hours today, and the second half of the call turned into an idea I have not been able to stop thinking about since. It began with a small aside. One participant, St...
Constant Contact has two keys in their own namespace — x-ctctmcp-allow and x-ctctmcp-tool-desc. The first is a boolean marking an operation as agent-exposed, which by now is a familiar pattern in t...
The four pull requests I have written about this week share a trait: each one points a workflow step at something that already has a description. An OpenAPI. An AsyncAPI. A WSDL. A .proto. A GraphQ...
Every provider in the API Evangelist and catalog gets profiled by a pipeline. It reads the company’s site and documentation, finds and verifies the contracts they publish, and writes the artifacts ...
Of the four pull requests queued for Arazzo 1.2, this is the one with the lowest bar to being useful. PR #567 from Naresh Jain adds GraphQL operation support. It was opened on September 2, it is 76...
Amazon does not want you shopping its website with an agent. It had a public scrap with Perplexity over exactly that, and now it is squaring off with Meta, whose newly launched Muse agent does the ...
Last week I wrote about Windmill’s use of x-mcp-tool and mentioned that four providers in my catalog use that key with two incompatible value types. Algolia is one of the four, and their documents ...
Earlier today I described how 427 agent cards talk and what they do, and this afternoon I knocked on the x402 doors among them. Both of those pieces start from the population of cards. Someone aske...
Earlier today I laid out how 427 agent cards talk and what they do, and one line in it deserved more than a row in a table. Nearly a quarter of those providers say they accept x402 payments, and I ...
In July I wrote that most published agent cards are not actually A2A. At the time that meant 65 providers out of 22,341 hosts, ten of them conformant, and I called it a starting line rather than an...
It costs me an average of $2.00 to profile each provider listed in APIs.io. I have 50+ skills that I will run on each domain identified in the API Evangelist and APIs.io catalog. The catalog has ~2...
I am working to understand what I consider “Frontier Storytelling” in today’s market, which is the stories that get told and retold on the frontier of the AI market. They aren’t the fabulist “Front...
This is the second half of the big city storytelling breakdown I started with Arazzo — the storytelling that works on large, regulated, established organizations rather than on the frontier. Same a...
I said in my frontier storytelling post that the moving parts I was cataloging there were not the ones enterprises need to hear. This is the other post. I am calling it big city storytelling becaus...
One key, 342 occurrences, 37 OpenAPI documents. x-mcp-group in Zoho Inventory’s contracts is the highest-volume agent-facing extension deployment I found anywhere in the catalog, and it is doing so...
The third pull request in the Arazzo 1.2 queue is the one I want people to read as a story about review, not just as a feature. PR #556 from Naresh Jain adds Protocol Buffer RPC support to Arazzo. ...
I have been working on my APIs.json specification since 2014. The specification hasn’t been a smashing success like OpenAPI, JSON Schema, AsyncAPI, or MCP. That is fine. Honestly, I don’t think mos...
I’m returning to a healthy vantage point when it comes to API specifications. Like API Evangelist, I have burnt out on the specifications front at various stages. When I get all bitchy and ranty ab...
Yesterday I wrote about Wistia’s nine-key agent vocabulary, which is careful, coherent, and used by exactly one company. Today, Windmill — six keys, also coherent, and the first place in this serie...
For most of the last six years, if you opened a JSON Schema 2020-12 document in VS Code, the editor quietly fell back to draft-07 behavior and hoped for the best. Completion worked at the root and ...
I get asked some version of the same question every week. How does Arazzo relate to OpenAPI? Do I need AsyncAPI if I have MCP? Where does Spectral fit? Is A2A competing with MCP? I usually answer w...
I have spent a good part of this series arguing for federation — as the thing MCP needs, as the right posture for governance, as the alternative to centralization in almost every place the two comp...
Every workflow language eventually runs into the step that is not an API call. Somebody has to approve the deployment. The customer has to agree to finance four of the five things in their basket. ...
For the last two weeks I have been writing about the SDK generators and documentation platforms whose OpenAPI extensions have spread into other companies’ contracts. Today I start the second half o...
I was talking with a young Sales Development Representative (SDR) at a startup this week about companies I have knowledge about. I love the eagerness of sales, but I very much enjoy the enthusiasm ...
I sat in on the Arazzo bi-weekly call this morning, and the first thing on the agenda was a pull request that has been open since July and is, by the maintainer’s own account, ready to merge. PR #5...
Here is how you install BoltMCP. You clone github.com/boltmcp/boltmcp. You move your access key into the keys/ directory. You open Claude Code in that directory and type /install-boltmcp. That is ...
I hear a version of this question constantly now, and it is usually asked with a little smirk: if I can just tell Claude “make me an API” and it does, why do I still need OpenAPI? Why do I need Asy...
Nineteen keys in the x-fern- namespace, thirteen providers. Square, Webflow, AssemblyAI, Pipedream, SignalWire, HelloSign, Method Financial, Vital, Instabase, NewsCatcher, Eon, Fyno. The two that ...
There is a new file companies are starting to put on their domain, and almost nobody has noticed it yet. It is called an AI Catalog manifest, it lives at a well-known URL, and it does one job: it t...
After a week of writing about vocabularies with nineteen and thirty-six keys, Mintlify is a relief. There is essentially one: x-mint. It appears in twenty-eight providers, 881 times across 92 OpenA...
I have written twice recently about the two excuses I hear most often when I walk a company through their public API presence. The first is that they have partner APIs, not public APIs. The second ...
Nineteen keys in the x-stainless- namespace, across twenty-five providers. That is a smaller footprint than Speakeasy’s and a much smaller one than Microsoft’s. But look at whose documents they are...
A friend of mine, Mike from Curity, gave a talk at apidays Munich this year with a title I have not been able to put down: When AI Agents Start Acting, APIs Become Execution Contracts. His argument...
I gave Agents Inherit Your Governance — Whether You Meant Them To or Not at APIdays Toronto this week, the first live outing of an argument I have been assembling in the APIs.io catalog all year. T...
x-stoplight appears 7,708 times in my catalog, across 162 OpenAPI documents belonging to thirty-seven providers. FactSet, Autodesk, Saviynt, Finix, Narmi, Deluxe, AfterShip, Qovery, Vendasta, REA G...
I sat for a fireside chat this week on the architecture and strategy behind the Kin Score — what it is, how the agent orchestration that produces it works, what the early findings look like, and ho...
Agent skills are the newest thing I am watching closely, and they are the clearest case yet of a technology that brings real, obvious value and a fresh set of problems in the exact same package. A ...
I found x-readme in eighty providers’ OpenAPI documents, 1,076 times across 320 files. Asana, 8x8, AppsFlyer, Fireblocks, Brandwatch, Ironclad, Demandbase, Bazaarvoice, Feedly, Frontegg, Dotdigital...
Updated 2026-09-09: first published with the opening wave of 22 providers; now covers the full panel of 65. Every figure below is the larger sample. The original numbers held — grounded accuracy mo...
Almost all of the noise about MCP has been about tools. Everybody ships tools, everybody argues about tools, everybody counts how many tools their server exposes as if that were the score. But the ...
There is a category of standard that nobody sets out to create. It happens when a thing gets large enough that its internal conventions become everybody’s conventions, not by agreement but by gravi...
An Italian company called Plumma reached out to me last week about the state of operator APIs in Latin America, we had a short call, and then I did what I always do afterward — I went and profiled ...
I keep coming back to the same wall. Everyone is all in on AI, every roadmap has an agent on it, and yet the first thing most platforms ask my agent to do is open a browser, click through a wizard,...
I spent the summer studying the impact AI is having on higher education with my intern Emily Barton. We each dug into how AI is being used on the campuses of universities relevant to our own worlds...
This essay is by Emily Barton, who spent the summer of 2026 researching how universities are actually adopting AI, alongside Kin Lane, for API Evangelist. After starting in California, her August r...
Of all the extension vocabularies I pulled out of the APIs.io catalog, the x-ms- family is the one where the gap makes the least sense. Not because Microsoft did something careless. Because Microso...
There are a number of contradictions that grind my gears in today’s market. I recently wrote about enterprises pushing teams to reduce their cloud spend while simultaneously tokenmaxxing when it co...
I am speaking at APIdays Toronto this week — Thursday at 11:00 AM in Markham. The talk is called Agents Inherit Your Governance — Whether You Meant Them To or Not, and it is the first live outing o...
I keep coming back to the same wall. A company tells me, loudly, that it is all in on AI, that agents are the future, that everything is autonomous now, and then it asks me to log into a dashboard,...
When I sat down with Emma Kriskinans of Tyk for a conversation about the middle ground on AI, she described a working habit that I found interesting. Every time she figures out how to do something,...
I keep coming back to the same wall. Every company in this industry is telling me they are all in on AI, that agents are the future, that software will soon provision and operate itself. And then t...
Yesterday I wrote about Redocly, who registered one of their four OpenAPI extensions and is therefore doing better than almost everybody. Today I want to talk about the largest coherent unregistere...
The part of the MCP story that keeps me up at night is not the tools, the prompts, or the discovery. It is authentication and authorization, because that is the part where the gap between how it sh...
Every API I have ever catalogued eventually grows a search endpoint, and every one of them has had to lie to get it. You cannot put a real filter in a URL — you hit length limits, you leak your par...
I have been pulling apart every OpenAPI vendor extension in the APIs.io catalog, and I want to spend the next few weeks writing about the companies whose vocabulary I keep finding in other people’s...
There are a lot of middlemen in the software integration realm. After leaving Naftiko, I spent the month of June assessing what is needed to standardize integration across many different platforms....
My post arguing that agents should write code to integrate, not infer it at runtime got a lot of agreement, which is pleasant and not very useful. Two of the responses were useful, and both came fr...
I keep coming back to the same wall. Every company is “all in on AI,” every keynote has an agent in it, and yet when I actually try to get a piece of software to authenticate itself against their p...
For a few months now I have been walking through the front doors of the companies that call themselves the infrastructure of the modern internet, and writing down what I found. Stripe makes you cli...
I want to say something out loud that everyone in this industry already knows and mostly pretends not to: specifications are economic land grabs. Not always cynical ones, not always bad ones, but l...
In preparation for this week’s office hours I needed to summarize what matters most when it comes to forking Spectral. It helps me to go back through all of the conversations, issues, and roadmap i...
I have been going back and forth for months on how to charge for APIs.io. Not the number — the shape. What is the thing someone is actually buying when they pay for access to a catalog of 27,500 AP...
You might have noticed the shift in my focus over the summer, but I want to be explicit about my departure from Naftiko for anyone who was away doing summer things, or who missed the signal in all ...
Here is the strongest opinion I hold about agents and APIs right now, and I know it cuts against the mood of the moment: for most real integrations, you do not want the agent inferring what an API ...
There is a post making the rounds right now from a team that pulled their API gateway out of their architecture on a Thursday afternoon, half expecting to roll it back within the week, and then wat...
I keep coming back to the same wall. Every company is “all in on AI” right now, every roadmap has an agent on it, every keynote promises autonomous software that goes off and does the work for you....
Mintlify shipped mint signup, a CLI command that creates a Mintlify account from the terminal so a coding agent never has to open a browser to get started. Their reasoning is hard to argue with: th...
In June I wrote about how SoundCloud shows what programmatic API onboarding should look like, pointing at the sc-api-auth.mjs script they dropped into their GitHub repo so an agent could get itself...
The API Evangelist Rating System gives every provider two scores, and the second one is the one I care about most right now: agent readiness. It is a standalone number from zero to one hundred, and...
I keep coming back to the same wall. Every company on earth is telling me they are all in on AI, that agents are the future, that their platform is ready for an autonomous, machine-speed world. And...
Almost every conversation I have right now about agentic programmability starts in the wrong place. There is budget, there is a mandate from somewhere above, and there is a shopping list — an MCP s...
I want to zoom out from the banks for a minute, because the reason I score any sector at all is not to rank companies — it’s that the reader is changing species. For twenty years the audience for a...
I find the AI discussion online right now fascinating, and full of technology, business, and political lessons at every turn. This wasn’t always the case. When I left Bloomberg I was overwhelmed by...
I am working hard to make sense of the programmability of the companies, organizations, institutions, and government agencies I profile at scale, and that work gets expressed through my APIs.io sea...
I wrote earlier today about the self-hosted seed as a business model — a domain-shaped application you plant on your own hardware and evolve with an LLM. That post was about the application layer, ...
This one is not my idea. It came out of my conversation with Sebastian Loch, who runs business development at fatsecret (apis.io). I asked him what part of the vibe-coding shift he thought was unde...
When a provider ships you an MCP server, they are not handing you a neutral window onto their capabilities. They are handing you a set of tools that someone at that company chose, named, described,...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that software should be self-driving now. And then I go to get a credential so a piece...
Every so often I read a post from a company that quietly reframes something I thought I already understood, and I have to go tell everyone about it. This time it is Medusa, the open-source headless...
I have been going in circles on a question for months and I would rather work through it in public than keep pretending I have it figured out. What is commercial open source, actually? Not the mark...
I have been using the MCP server for APIs.io, familiarizing myself with the nuance of each of the API operations I have extended as last mile MCP tools. I have been putting myself in the heads of m...
When I scored all fifty Australian banks in my catalog for the State of Australian Banking APIs sector report, two numbers came back that seem to contradict each other, and the contradiction turns ...
I turned on access logging across APIs.io and the rest of my network on August 13th, because I had gotten tired of talking about agent traffic without being able to point at any of it. Google Analy...
The MCP story so far has been a story of proliferation. Every vendor ships a server. Every product team ships a server. My own network is full of them — I have written about every provider in my ca...
I keep coming back to the same wall, and HubSpot is where I hit it again. Every CRM, every gateway, every platform that has spent the last two years telling me it is “all in on AI” still makes me o...
The command line interface, or simply CLI has been the workhorse of compute since the 1960s. In the era of the web API, the simplicity of the web API groomed a new generation of developers who were...
I have been asking data providers the same question for two years now — where do you draw the line on what AI is allowed to touch? — and I mostly get mush back. Everybody has a policy. Almost nobod...
The MCP roadmap was updated on August 22nd, and I read it the way I read every roadmap that comes out of a fast-moving protocol: looking for the moment where the new thing stops being new and start...
I keep coming back to the same wall. Onboarding to an API does not scale. We have built a generation of tools that are supposed to act on our behalf, that are supposed to wire themselves up to the ...
I spent a decade skeptical of governments dictating APIs. My position was simple and, I thought, principled: companies should do APIs because they make sense, not because a regulator forces them to...
I ran two queries against the catalog this week for someone working on signed receipts for agent actions. He wanted a targeting list rather than an abstract adoption problem, and two cohorts looked...
I keep coming back to the same wall. Every company in commerce wants to talk about agents right now. Autonomous shopping, AI merchandising, bots that reconcile inventory while you sleep. And then y...
Last week I published an inventory of everything that actually executes an Arazzo document, as opposed to everything that lints, renders, or generates one. I counted four. Somebody read it and sent...
In addition to iterating upon the latest version of the Kin Score, I am spending a significant chunk of my day responding to providers who encounter the Kin Score for their company. I learn a lot f...
I spent three days this week on version 0.12 of the Kin Score. Alongside it I have been processing three to five vendor submissions a day and adding roughly five hundred new providers out of ventur...
Every integration I have ever built eventually runs into the same wall: the OpenAPI I am consuming is wrong, and I cannot fix it at the source. The price is documented as a string when the server s...
There is a layer underneath every API I profile that I have never been able to point at as a whole. HTTP and OpenAPI describe how you move data. FHIR, ISO 20022, IEC CIM, NIEM, and a few hundred ot...
Here is a question I get asked more than any other right now, usually by an engineer who is a little annoyed and entirely correct to be asking it: if the agent can already read my OpenAPI and just ...
I closed the DPoP post in my Germany series with a line I still stand behind: Zero Trust is not a product you buy, it is a set of properties you can point at, and “a stolen token is useless” is one...
I profiled two APIs this morning that are doing something I have now seen enough times to call it a pattern. Both are good APIs. Both are built by people who care. And both are refusing, at the doo...
I recorded a twenty-three minute walkthrough of where I am at with the fork of Spectral, two days ahead of Friday’s open office hours. It was partly for the working group and partly for my own bene...
I have spent a lot of this year watching everyone ship Model Context Protocol servers and almost no one describe them. We went straight from “MCP is interesting” to “here is our MCP server” without...
Almost nobody hand-writes an MCP server. They generate one from an OpenAPI document. Speakeasy and Stainless will emit you a TypeScript server from your spec. Kong and Apigee will project your exis...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that the machines are coming to do the work. And then the moment I want to wire up an ...
There is a specific way that important infrastructure disappears, and it does not look like a project getting archived. It looks like success. The format goes into more and more products. Vendors ...
I keep running into a new kind of company, and I want to name the pattern before it becomes the default. It is a company that ships an MCP server and a couple of SDKs, and calls that its API strate...
Every provider in the API Evangelist Rating System carries a composite quality score from zero to one hundred, but the number by itself is not the useful part. A 61 and a 68 are both “pretty good,”...
I scored 26,568 API providers against the Agent Readiness layer of the Kin Score, and one of the fourteen dimensions came back at a number I had to go and check twice. Seventy-one providers publish...
I am a systems thinker. I see things at a macro level. I shape things best at that level, and I struggle with the day-to-day micro level. API Evangelist has long been successful at convincing peopl...
Joyce Stack has published a set of Claude Code skills that do information-architecture analysis on a Markdown documentation corpus, and it is the most directly useful enterprise work I have seen co...
Fourteen of the API Evangelist trend reports now carry a written standards layer. Each one covers a different market and asks the same two questions: which specifications apply here, and how many c...
The same fourteen trend reports that carry a standards layer also carry a regulatory one. Each records which regimes apply to that market, how many companies in the cohort name them, and what the r...
Somewhere in every regulated company there is a document, or a wiki page, or a Slack message pinned to a channel, that says something like “before we publish the EU version of the API, remember to ...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that they want machines talking to their platform around the clock. And then they hand...
Nathan Booker asked me a good question on LinkedIn a couple of weeks back, and it has been sitting in my notebook since. He wondered whether changes to MCP APIs are really breaking changes at all —...
Nobody wants to talk about APIs at a dinner party, and they never will. APIs are plumbing, and plumbing is invisible right up until the moment it fails. I have made peace with this after a long tim...
I have spent this whole series banging my head against the same wall. Company after company tells me they are all in on AI, all in on agents, all in on automation, and then they hand me an onboardi...
The oldest fight in the enterprise is the one between business and IT, and it never really got settled–it just changed costumes. It was business versus IT, then it was product versus engineering, t...
As I continue to profile the portfolio companies of venture capital firms, as well as the services and tooling those companies use, I am left thinking about the reasons why more of these companies ...
I have spent a good chunk of this year authoring Arazzo across my network — more than 5,000 workflow files spanning 543 API providers, plus another 255 that deliberately cross provider boundaries, ...
Deprecation is where most API programs quietly fall apart. Not because teams don’t know how to sunset an operation, but because they do it by hand, one operation at a time, across a dozen specs, on...
I wrote yesterday about how people tell me they have partner APIs instead of public APIs, and continuing on this same theme of excuses I hear from API producers, I wanted to explore the reasons why...
I have spent enough years watching people love GraphQL for the wrong reasons and hate it for the wrong reasons that I want to step around both of those piles entirely and talk about the one place w...
Ten days ago I spent an afternoon with curl figuring out how Time serves ads to AI agents, because the trade press covered the business arrangement and openly said they could not tell you how it wo...
I keep coming back to the same wall. We are all supposedly “all in on AI,” wiring up agents that are meant to go off and do real work on our behalf, and yet the very first step of almost every inte...
Editorial note: this is how the API Evangelist papers and reports are produced. I have published it as a permanent page at About API Evangelist Papers, alongside About API Evangelist, About Kin Lan...
This is the ninth and final post in my series on Germany’s federal API authorization blueprint. I have spent eight posts pulling the architecture apart layer by layer and, last time, mapping it ont...
When I walk a company through their Kin Score and the listing of their public API presence and agent readiness, I get a variety of responses depending on what the score is, but also on where they a...
Everything I am doing with the Spectral ruleset format right now is a move I have watched work before, and I want to write down how it worked, because the people arguing with me about it are making...
The API security problems we have now are not new. Broken object-level authorization–the flaw where your API happily hands over record 1002 to someone who was only ever supposed to see record 1001,...
Everybody is agent-ready now. The MCP server is announced, the Agent Skills are published, the phrase is in the press release and on the pricing page, and the keynote slide has a diagram with an ag...
When most people in the API space hear the word governance, they picture a Spectral ruleset. They picture a linter in a CI/CD pipeline rejecting a pull request because someone used a request body o...
I keep coming back to the same wall. Every company wants me to believe they are all in on AI, that agents are the future, that machines will be doing the integration work soon. And then I go to act...
This is the eighth post in my series on Germany’s federal API authorization blueprint, and it is the one I have been building toward: what would it actually take for US federal and state agencies t...
Every week I read the API industry’s blogs and distill them into a newsletter. That covers what vendors and practitioners wrote. It does not cover what actually changed inside the specifications ev...
Published on a blog in March 2004, given away, vaguely specified, and declared obsolete about once a year since, markdown is now the format your AI stack runs on. Your agent reads its standing inst...
Somewhere in your CRM right now, there’s probably a deal marked closed-lost, with a reason such as budget, or timing, or no decision. Somewhere in the back of your mind, you’re not entirely sure th...
I keep coming back to the same wall. Every company on earth is telling me they are all in on AI, that agents are the future, that software will provision and operate itself. And then I go to actual...
I have watched too many teams maintain three sets of documentation for one API because they sell it three ways. There is the Free tier docs that pretend the premium endpoints do not exist, the Pro ...
I was talking with my wife about the work I am doing with my intern this summer around the usage and adoption of artificial intelligence on campus. My wife is an expert in education technology, and...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that software is going to provision and call software without a human in the loop. The...
This is the seventh post in my series on Germany’s federal API authorization blueprint. The last six posts walked the technology. This one is about the thing I think will outlast every specific tec...
I can almost set my watch by it now. A startup launches with an open API, generous free tier, real documentation, an SDK in every language, and a developer relations person who genuinely wants you ...
I have spent a lot of years being ambivalent about GraphQL. I have watched it get oversold as a REST-killer and I have watched people pile onto it for reasons that had more to do with resume-buildi...
When I say the ruleset format matters more than the linter that runs it, that is a claim, and a claim is worth almost nothing without a list behind it. So I built the list. Every engine that execut...
I keep coming back to the same contradiction. Every company tells me they are all in on AI, that agents are the future, that software is about to start talking to software at a scale we have never ...
There is a particular kind of company I have been curious about for a while now: the one whose shares trade on the private secondary markets. Forge Global, Hiive, EquityZen, Nasdaq Private Market, ...
I keep finding these forgotten corners of my use cases for OpenAPI Overlays roundup that nobody talks about, and environment promotion is the one I get the most quietly frustrated about. Because th...
This is the sixth post in my series on Germany’s federal API authorization blueprint. We have a verified client, a sender-constrained token, and a policy-based decision about what it may do. Now co...
Yesterday I pulled apart how Time serves ads to AI agents, and I said at the end that I wanted to find out how many other publishers were doing the same thing. So I built the measurement, pointed i...
I have been trying to find the cleanest way to say something about Model Context Protocol for months, and it finally boiled down to a single sentence I cannot stop repeating to people: MCP is the o...
There is a fantasy loose in the industry right now that AI has dissolved the hard parts of working with APIs. Point an agent at your systems, the story goes, and it will figure out the rest–discove...
I keep coming back to the same wall. Every company out there is telling me they are all in on AI, that agents are the future, that machines will be first-class consumers of their APIs. And then to ...
I ended my profile of UC Irvine’s ZotGPT with a line I have not stopped thinking about since I wrote it: strip out the university and this is a template. I want to spend a whole post on that senten...
Editorial note: this is my current stance on how I use AI across API Evangelist and APIs.io. I have published it as a permanent page at About API Evangelist’s Use of Artificial Intelligence, alongs...
Time started selling ads aimed at AI agents, and the trade press covered the business arrangement without covering the mechanism. Digiday and Media Copilot both wrote it up, and both explicitly sai...
This is one of the use cases I flagged as underexplored in my Many Use Cases for OpenAPI Overlays post, and it is quietly my favorite one. Most of the time when we talk about API governance, we mea...
I keep coming back to the same frustration, and I am going to keep writing about it until it stops being true. Onboarding to an API does not scale. Every vendor on earth is telling me they are all ...
I went looking at universities this summer to refresh my understanding of where higher education stood with APIs in 2026, but also with AI. I’ve long tuned into, engaged with, and reported upon the...
This is the seventh and final post in my July series on API sprawl. I have covered what it is, its organizational and technical roots, the shadow, rogue, and zombie APIs that hide in the gaps, why ...
This essay is by Emily Barton, who spent the summer of 2026 researching how universities are actually adopting AI, alongside Kin Lane, for API Evangelist. It is published as the companion to Kin’s ...
For most of my career, if you wanted to understand where the power sat inside an organization, you followed the data down to the database. The DBA held the keys. Schemas were guarded like state sec...
This is the fifth post in my series on Germany’s federal API authorization blueprint. The last four posts got a verified, sender-constrained client all the way up to the door of an API. Today is ab...
Almost every internal API leak I have ever seen came down to the same thing: a human being was supposed to remember to remove something before hitting publish, and that human being was tired, or in...
Earlier this week I profiled ZotGPT, UC Irvine’s campus-owned generative AI platform, into the API Evangelist network. It came to me through my intern, whose research on how universities are actual...
Yesterday I announced that I am forking Spectral. Copying a repository took an afternoon. Today I sat down to work out how anybody actually switches to it, and that is a much harder problem than th...
I came home from APIDays Munich with knowledge graphs stuck in my head after MC’ing a talk from Adorsys on the subject. They are doing some interesting and compelling work building knowledge graphs...
I keep coming back to the same wall. Every company tells me they are all in on AI, that the future is autonomous agents calling APIs on our behalf, and then they hand me an onboarding process that ...
I said this out loud in a recent conversation with Nordic APIs and I keep coming back to it, because it is the most honest description of how enterprise budgets actually move in 2026: the best way ...
The first five posts in this series diagnosed the problem: what sprawl is, where it comes from, and why it costs you. This sixth post is about the cure, or at least the half of it I care most about...
APIs.io now has a section for A2A Agent Cards, and I want to talk about what building it taught us, because the interesting part is not the section — it is what we found when we went looking. The A...
On July 14th someone filed an issue on the Spectral repository titled “SUPPLY CHAIN ATTACK — @stoplight/spectral pulls in compromised dependencies.” Ten days later, one other person commented on it...
I would not have found this one on my own. I have been working with my intern on a research project to better understand how universities are actually adopting AI — not what they announce, but what...
It is always interesting to talk with folks within the enterprise right now and get their off the record feedback on what it is like to work within their companies today. One of the reasons I’ve be...
This is the fourth post in my series on Germany’s federal API authorization blueprint. So far I have covered the posture behind the whole thing, the standards foundation they profiled rather than i...
I keep coming back to the same frustration, and I am going to keep writing about it until enough people are annoyed with me to do something. Onboarding to an API does not scale. You can have the cl...
I’ve been sitting and simmering on my thoughts in response to this post from my friend Dave Shanley for some time now—you can also hear him think out loud in our conversation. I love leaving these ...
I’m up to 25,439 providers and 106,926 APIs in APIs.io and API Evangelist now. I’m making good progress working my way through top industries, the portfolios of top venture capital, and even the se...
Most of the overlay conversation I hear is about surgical edits. Patch this one summary, fix that one description, override a server URL for staging. That is the easy sell, and it is real work wort...
For the last couple of months I have been trying to fix API onboarding by building the fix myself. It started when SoundCloud showed me what programmatic onboarding should look like — one file, no ...
So far this series has covered what sprawl is, where it comes from organizationally and technically, and the shadow, rogue, and zombie APIs that hide in the gaps. In this fifth post I want to answe...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that machines will be first-class consumers of their software. And then to get a set o...
For the last eighteen days I have introduced one API Commons tool each morning, and this is the map of the whole run. I did it as a drip on purpose, because looking at the tools one at a time makes...
Every venture capital firm has the same positioning right now. Agentic is the priority. It is where the next fund goes, it is the memo they send their limited partners, and it is the advice they ha...
I keep coming back to overlays in this series unpacking the many use cases because they solve a problem I have watched play out on every team I have ever worked with: the people who most need to fi...
My friend Daniel Kocot over at Adorsys has another thought-provoking and specification-evolving post over at Architectural Bytes this week. I sure do love having other deep-thinking API writers in ...
I keep coming back to the same wall. Every company is telling me they are all in on AI, that agents are the future, that software will soon provision and operate itself. And then I go to actually g...
For a couple of weeks now I have been walking through the governance tools I have been building under API Commons, one per day, and this is the last one in that run. I saved it for the end on purpo...
The organizational and technical roots of sprawl I have covered so far create gaps–seams in the estate where interfaces exist but oversight does not. In this fourth post of the series I want to nam...
Yesterday I inventoried the MCP techniques I run across API Evangelist. Agent Skills deserve the same honest treatment, because I do not use them as a novelty—they are wired into how I package know...
I have spent the last stretch scoring banks the way an agent would read them — not the marketing site, the machine-readable evidence: the OpenAPI, the scopes, the security posture, the discovery su...
This is the third post in my series on Germany’s federal API authorization blueprint. I have spent a lot of the last year poking at how API providers handle onboarding — the walk from “I have a dev...
I have been walking through the API Commons tools one at a time this month, and today I want to talk about the one that scratches an itch I have had ever since MCP servers started showing up everyw...
I write about Model Context Protocol a lot, but I also run it. Across apis.io, apievangelist.com, and API Commons, MCP is not a thing I comment on from the sidelines—it is wired into how I publish,...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that machines will be first-class consumers of their APIs. Then they hand me an onboar...
I have been walking through the governance tools I keep building under API Commons, one a day, and today’s is the one that finally admits something I have been circling for a while: a lot of the AP...
The organizational roots of sprawl set the stage, but modern architecture is what turns a trickle of new APIs into a flood. In this third post of the series I want to look at the technical drivers–...
This is the second post in my series breaking down Germany’s federal API authorization blueprint for other governments to follow. The first post made the case that the whole thing rests on a single...
Continuing my walk through the many use cases for OpenAPI overlays, I want to sit with one that hits close to how most teams actually ship docs. You have a single OpenAPI definition, but you need i...
There is a small industry forming around scoring whether an API is ready for AI agents, and I am glad it exists, because it means the question is finally being taken seriously. But most of the agen...
This is the next stop in my daily walk through the governance tools I have been building under API Commons, and it is a close sibling of the browser validator I wrote up earlier in the series. Wher...
I keep coming back to the same wall. Every API company I talk to says they are all in on AI, all in on agents, all in on the future where software talks to software without a human babysitting it. ...
I had a conversation this week with someone who spent years inside Stoplight and was a core contributor to Spectral and Stoplight Studio. I wanted their read on where the linter everyone governs wi...
I have been working my way through the governance tools I am building under API Commons one day at a time, and today’s is the one I keep coming back to when I think about what governance is actuall...
I am working with an intern this summer on a project evaluating how universities are using artificial intelligence. We are each researching schools close to us. She has Loyola Marymount University ...
While I was in Munich for APIDays recently I got to MC a talk from a group working on improving the standardization, adoption, and sharing of OAuth scopes across German government APIs. They had a ...
Bump.sh shipped two features that on the surface read like routine platform housekeeping, and underneath tell you exactly where the agent-facing web is going. They took their MCP servers out of bet...
I am still working my way through the governance tools I have been building under API Commons, one per day, and today I want to show the one that finally made the whole picture click for me: API Go...
In the first post of this series I made the case that API sprawl is mostly a systems problem, not a technology problem. So before I get to microservices and multi-cloud, I want to spend a post on t...
Most of the overlay conversation assumes you are the API producer, sitting on top of a spec you wrote and own. But the majority of the OpenAPI I touch in a given week belongs to somebody else. I am...
I have been walking through the governance tools I build under API Commons one at a time, and today I want to talk about the one that addresses the messiest part of running an actual governance pro...
I keep coming back to the same wall. Every company I talk to is “all in on AI,” every roadmap has an agent on it, and yet when I actually try to get a set of credentials so that something automated...
I have been walking through the governance tools I am building under API Commons one at a time, and today I want to sit with a question that most governance conversations never get around to asking...
I am stepping back and doubling down on the two core competencies of my work as the API Evangelist. I learned a lot about discovery and governance over the last six years–honestly a good bit longer...
I have spent my whole career forming opinions about whether an API is any good. Not whether the company behind it is valuable, and not whether the product is clever, but the narrower and more usefu...
I have found real value in taking an API design-first approach to crafting my APIs over the years, but I always hit a point of diminishing returns with it once the API is actually in production. I ...
A few months back I published an Agent Readiness framework on GitHub–a plain, nine-dimension model for scoring whether an API surface can actually be driven by an autonomous agent, not just read by...
I keep coming back to the same contradiction. Every company I talk to is “all in on AI,” wiring up agents that are supposed to act on their behalf across dozens of services, and yet the front door ...
API sprawl is the uncontrolled, fragmented proliferation of APIs across an organization’s IT environment. That is the clean definition, but the reality is messier, and it is the mess I have spent s...
I just added Postman and Open Collections to APIs.io. I’ve added most of the specifications that matter to APIs.io over the last month. What a spectrum. What a lot of overlap. What a lot of volatil...
I have been walking through the governance tools I keep building under API Commons one at a time, and today’s is the one that turns the lens back on your own plumbing. Most of these tools ask wheth...
Every government I have ever looked at has the same quiet problem hiding under its digital-government ambitions: it has no shared answer for how one public-sector system is allowed to call another ...
Yesterday I walked through every artifact behind the Twilio profile, and I ended it with an admission: profiling Twilio that closely showed me where my own process still falls short. This is the fo...
Every time I run a code generator against a real OpenAPI document, the output tells me something ugly about how the spec was written. I get a method called get_products hanging off a client with no...
I spend a lot of my time arguing that the API economy has a reuse problem. Every team rebuilds the same bounding box parameter, the same pagination scheme, the same error object, the same link rela...
For sixteen years I have given the research away. Every blog post, every guide, every API definition, every scrap of what I have figured out about this space–free, on the open web, no gate. I am no...
A couple of days ago I published two things that were practically begging to be connected. I shipped the Spectral OWASP ruleset — a grounded, owned Spectral mapping of the OWASP API Security Top 10...
This daily walk through the governance tools I have been building under API Commons has stayed close to the desk so far — things you open in a browser tab and reach for in the moment. Today I want ...
Yesterday I walked through every artifact behind the Stripe profile — the OpenAPI stack, the workflows, the schemas, the conformance ledger, the security surface, the agentic layer. That post was a...
I keep coming back to the same wall. Every company I talk to is “all in on AI,” ready for an agentic future where software provisions its own access and gets to work. And then I go to actually get ...
A little while back I stopped arguing about whether “just turning on Spectral” counts as API governance and went and measured it. I pulled a thousand real public GitHub Actions pipelines that run S...
I recently walked through everything that goes into profiling Stripe, and the response told me people find the inventory itself useful — the full list is the argument for why profiling matters. So ...
Daniel Kocot of Adorsys has written an important post titled, “API Governance Needs Memory”. This story doesn’t require, but could be conflated with existing hype and discussions around AI memory–e...
Back in 2019 I spent a stretch at F5 Networks on a task that sounds small until you look at the number: producing JSON Schema for more than 2,500 schema objects that made up the BIG-IP product. It ...
I have been walking through the governance tools I build under API Commons one at a time, and today’s is not a browser app or a website — it is a ruleset. Spectral OWASP Ruleset is a curated, owned...
It is a common tactic in the VC playbook of the startups I’ve worked with over the years: limit the interoperability of the platforms they invest in. You can import OpenAPI, but you can’t export Op...
When I tell people I “profiled” an API provider, they picture me grabbing an OpenAPI file and calling it a day. That is not what profiling means anymore, and Stripe is a good place to show why. A m...
I have been walking through the governance tools I am building under API Commons one a day, and today’s is the one that answers a question the others eventually raise. If governance is just Spectra...
I keep running into the same slow-motion mess. Somebody hands me an OpenAPI definition that is supposed to be the single source of truth, and when I open it up half the operations are wearing three...
I keep coming back to the same wall. Every company on earth is telling me they are all in on AI, that agents are the future, that software will soon be writing software and calling APIs on its own....
I am still working my way through the governance tools I have been building under API Commons, a different one each day, and today I want to talk about the one that goes after the hardest problem i...
I am still working my way through the governance tools I have been building under API Commons, one a day, and today’s is the one that finally makes a Spectral run legible to somebody who did not wr...
An OpenAPI tells a developer what your API can do. An agent needs more than that. It needs to know which operations are worth turning into tools, what each of those tools is honestly allowed to do,...
I have been working my way through the governance and discovery tools I keep building under API Commons, writing one up a day, and today’s is the one that answers a question almost every organizati...
I keep coming back to the same wall, and this week it has Postman’s name on it. I have spent years saying that onboarding is the part of an API that breaks first under load, and now we have agents ...
This is the next stop in my daily walk through the API Commons tools, and it is one I have wanted for a long time: a way to hand somebody a single APIs.json and have it turn into real, readable doc...
Translation is where a lot of teams quietly fork their API contract, and they don’t even notice they’re doing it. Someone in the German office needs the docs in German, so they copy the OpenAPI fil...
Stedi has taken one of the oldest, crustiest corners of healthcare—X12 EDI—and wrapped it in a modern API. That is genuinely useful work, because the X12 transaction sets that govern eligibility, c...
I keep coming back to the same wall. Every time I want to get a piece of software talking to an API, I find out that the part everyone treats as a formality, getting credentials, is the part that d...
For two years I have been saying in print that “just turn on Spectral” is a seduction and a trap — that flipping on a linter’s default ruleset in your pipeline and waiting to wake up governed is no...
Yesterday I kicked off this run through the API Commons tools with a validator you keep open in a tab, and today I want to keep the daily thread going with the tool I reach for one step earlier — b...
I made the case last week that you should govern in the IDE, where the work happens — get the ruleset in front of the engineer while they’re still typing, instead of waiting for a red CI build to t...
For all the attention FHIR gets, an enormous share of healthcare’s actual money and paperwork still moves over X12 EDI. Eligibility checks, claim status, prior authorization—these are the administr...
I keep telling teams that governance should be something you can reach for in the moment, not a service you file a ticket against. So I am spending this stretch walking through the governance tools...
Provider directories are the unglamorous backbone of healthcare. Finding a doctor who has the right specialty, in the right location, who actually accepts a given insurance plan is a deceptively ha...
Here is the problem that eventually finds every team that runs an API for more than one kind of consumer. You have a single OpenAPI definition, but you do not actually have a single audience. The p...
I’ve spent this whole series arguing that governance shouldn’t be a single gate you slam into at the end, but something that shows up at every stage of the lifecycle — in the editor while you’re au...
A couple of weeks ago I wrote about consumer API governance in an agentic world, and I keep making the argument from stage — APIDays New York, Amsterdam, and Munich next month. Arguments only go so...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that software will provision and consume software without a human in the loop. And the...
DrChrono is a full EHR with a sprawling REST API—over three hundred operations covering everything from scheduling to billing. An API that large is exactly where workflows earn their keep, because ...
Everything I’ve written about in this series up to now — landscape mapping, OpenAPI, JSON Schema, policies, Spectral rules, design-first, Git, the IDE, the pipeline, shifting left, reviews and prov...
I have spent this whole series making the case for governance the way we have practiced it for a decade: lint the OpenAPI, enforce a style guide, shift it left, put it in the IDE, and put it where ...
Medplum treats FHIR R4 as a developer backend, exposing the RESTful API as a generic create, read, update, search, and history surface parameterized by resource type. That generality is powerful, b...
A lot of the standards that quietly run our world were written before the API era. They are thorough, hard-won, and often decades deep, but they live as PDFs, XML schemas, and prose test scripts. T...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that machines will soon be doing the integration work humans used to do by hand. And t...
Here is the reframe that finally made governance work for me, after years of getting it wrong. For a long time I thought the job was to make people comply. Get the teams to follow the rules, hit th...
If you publish an MCP server today, the last mile to your users is a mess. You write out install instructions for Claude Desktop, then a different set for Cursor, then a deep link for VS Code, then...
I have been stewing on Daniel Kocot’s newsletter on capabilities for a week or more now. It reflects the journey I have been on since leaving Bloomberg, and honestly it is why I left Postman to go ...
If you pull back and look at the last several fundamentals in this series — design-first versus code-first, Git as your source of truth, the IDE, the CI/CD pipeline — there’s a single principle org...
You know the spec I am talking about. It was generated from code by a framework annotation scanner, and it is technically correct in every dimension and useful to nobody. The GET /products operatio...
Metriport is an open-source take on health data interoperability, and like most of the record-retrieval platforms its API is fundamentally asynchronous. You do not ask for a patient’s documents and...
In almost every enterprise I walk into, the same capability has been built three, four, five times — customer lookup, payment processing, document storage, notification sending — by teams who were ...
A couple of months ago I wrote that we standardized the API but we didn’t standardize the application. Then SoundCloud showed me what the fix looks like from a provider’s side: one file, no depende...
I spend a lot of time telling you to run Spectral, so I owe you the other half of the story. On June 30th a pull request landed in the Spectral repository with the entirely unremarkable title chore...
Lab ordering is one of those healthcare workflows that looks simple from the outside and is anything but. You do not just call an endpoint and get a result back; you place an order, it routes to a ...
The pipeline is where governance becomes non-optional, and more importantly, where it becomes consistent. The same Spectral ruleset that lives in your developers’ editors runs in CI on every pull r...
I keep coming back to the same wall. Every company I talk to is “all in on AI,” wiring up agents that are supposed to go discover an API, register themselves, and get to work. And then I go look at...
I am giving a talk at APIDays Munich about the layer of API governance our industry keeps pretending does not exist. We have spent a decade obsessing over two of the three layers. There is design-t...
If you have done the work of API governance, you have a Spectral ruleset. It lints your OpenAPI, it catches the naming drift, it blocks the request body on a GET, it flags the operation nobody both...
I have spent a lot of years watching companies build the same integration over and over again. Someone at HubSpot builds the Salesforce connector. Someone at Salesforce builds the HubSpot connector...
The earliest place you can govern an API is the editor, and it is also the place with the best return on the effort, because it’s where the engineer is actually working and most open to help. Spect...
The Cerner Millennium platform, now Oracle Health, is one of the EHRs that a huge slice of the country’s clinical data actually lives behind, so its FHIR R4 API is worth understanding as a sequence...
I spent some time this week walking the entire Linux Foundation umbrella to inventory the API specifications it stewards, and the projects underneath it that actually have APIs. I expected a long, ...
I keep coming back to the same wall. Every company tells me they are all in on AI, that agents are the future, that the API economy is about to be run by software talking to software. And then I go...
Here is a hill I will happily die on: treat your governance artifacts as code, and put all of them in Git. Your OpenAPI specs, your JSON Schemas, your policies, your Spectral rules — every one of t...
When an EHR exposes a clean FHIR R4 API, it is tempting to think the integration problem is solved. Canvas Medical has one of the better developer-first FHIR surfaces I have looked at—a write-capab...
A common mistake I see technologists make is that we don’t always take the time to understand the way things are before we plow forward with something new. I regularly suffer from this condition, b...
Most of the healthcare APIs I profile describe themselves one endpoint at a time, but nobody actually integrates one endpoint at a time. The real work is a sequence: authenticate, register a patien...
Every governance program eventually hits this fork in the road, and you have to be honest with yourself about which side of it you’re on, because it determines when governance is even possible. Des...
Now we get to the part everyone thinks is the whole thing. Spectral is the open-source linter that runs rules against your OpenAPI, AsyncAPI, JSON Schema, or honestly any JSON or YAML artifact you ...
Five years ago I wrote a post about evaluating APIs.json property types alongside OpenAPI extensions, and back then I was working with a sample of about fifty extensions from fourteen providers. It...
This is the fundamental that most governance programs skip, and skipping it is exactly why most of them fail. Here is the pattern I have watched play out over and over: a team builds a Spectral rul...
A few days ago I wrote about consumer API governance in an agentic world, and as I keep giving versions of that talk — Munich is next — the most common response I get in the hallway afterward is so...
Extending the OpenAPI specification is a widely used, but seldom talked about superpower of the specification. People who aren’t in the know hit the wall with what the specification can’t do, and t...
After rounding up the open-source and commercial tooling support for OpenAPI Overlays, the next question I keep getting is simpler and more important: what are people actually using overlays for? A...
Underneath your API contract is the data, and the data has a shape, and that shape is described by JSON Schema. This is the layer where the real fights happen. OpenAPI’s schema object is JSON Schem...
The OpenAPI Overlay Specification reached a stable 1.0.0 release, and the tooling has been steadily catching up ever since. Overlays give you a clean, repeatable way to apply a list of actions to a...
If landscape mapping is where governance starts, OpenAPI is where it lives. It is the center of gravity for everything I do when I govern REST APIs, and the reason is simple and worth saying out lo...
I know that many in the tech world believe there is always a universal approach to doing software, and that all business processes scale. For some processes this may hold true, but when it comes to...
When I walked into the most serious governance job I’ve ever held, the first thing I did was not write a single rule. I went and reviewed every published OpenAPI across the entire portfolio. Before...
Yesterday I wrote about localizing the Products API with OpenAPI overlays, treating the whole API description as one document to be translated four ways. Today I want to go down a level, because th...
I am preparing to give the third iteration of my talk on consumer API governance, this time in Munich next month. I’ve given versions of it at APIDays NYC and Amsterdam, and I keep iterating on the...
I’ve been doing API governance work for quite some time now, and I spent a a year on the ground standing a governance program up from scratch. So when people ask me what API governance actually is,...
I keep a small, deliberately boring API around for teaching: a Products API. It does exactly what you’d expect — list products, create a product, fetch one, update it, delete it, cancel it — and no...
When API design first emerged in 2012, and grew in popularity over the next decade, some folks embraced, while others revolted, and the rest just sat with the usual blank stare they have for work e...
I’ve been studying the way API providers publish their public MCP servers, beginning with the big three: Amazon, Microsoft, and Google. Each of these providers have their own approach to delivering...
Google moved the Gemini Interactions API to general availability, and I want to pay attention to it not because it is another model endpoint, but because of what it says about where API design is h...
I keep coming back to the problem of scaling the onboarding, the setting up of applications, and the obtaining of API keys across many different APIs. The differences in how every API provider hand...
I spend a lot of my time on the consuming end of API keys—banging my head against the wall of how every API provider handles the issuing, verifying, and managing of credentials differently. So when...
I am working through research on “MCP governance”—meaning, what others out there are calling MCP governance. As with APIs, there is a wide mix of smoke, mirrors, and concrete practices around what ...
When I started API Evangelist in September 2010, I was writing stories from a one-bedroom apartment in Eugene, Oregon, trying to make sense of what Twitter, Twilio, and Stripe were doing to softwar...
I have been writing about this since March 2017, kept expanding it through 2018 with a diagram that I brought to talks and workshops, and reinforced it again in 2020. Coming back from APIDays Amste...
One story I’ve told many times, but couldn’t find in my own historical archives of API Evangelist, is the origin story of API Evangelist itself. I am learning that the stories I’ve told over the ye...
I have been writing about API monetization since 2011. Not consistently, but in recurring waves — whenever the business reality of APIs forces itself back to the surface. Early on I was fascinated ...
I like GitHub’s recent blog post on transparency around their status page. Status pages are human and machine-readable properties I’ve tracked on for API providers as part of my APIs.json work for ...
I am learning from the AI Insights updates on Cloudflare Radar. I have long been a champion of how we’ll be automating the onboarding of clients, bots, agents, and other non-human users of the web....
There is something that haunts me every time I am doing the market research I need for Naftiko. Every integration provider always has thousands of icons for the integrations they support on their w...
I was publishing the Naftiko Capabilities I had generated from the 36 Palo Alto Networks OpenAPIs. Before I generated these capabilities I generated a standardized set of Spectral rules based upon ...
It is difficult to think like an API consumer when you are an API producer. When I talk to anyone about what I am building at Naftiko, which is extremely API consumer centric, almost everyone I kno...
Questioning how I see the technology, business, and politics of APIs is the foundation of API Evangelist. I’ve changed my opinions on a lot of things over the years, as my awareness expands on diff...
Many engineers I’ve worked with over the years see OpenAPI and AsyncAPI as a configuration for whatever tooling outcome they desire. I see OpenAPI, AsyncAPI, and JSON Schema that defines them as a ...
For years I’ve been writing on API Evangelist about the idea of a personal API footprint — the idea that every individual should have a single, coherent surface representing themselves across the d...
I did not write a single post on API Evangelist in March. I have gone months before without writing a story, but this month is primarily due to artificial intelligence. I am all in on using Claude ...
Starting a new specification is exciting. You have a vision. You flesh out the vision. You distill it down into some documentation, schema, blog post, and a social media post. You don’t have the ba...
I recently purchased the Radiohead record, OK Computer. I’m in a phase where I am investing in my vinyl record collection, and doing the work to get out of my comfort zone. This means challenging a...
I had a fascinating conversation Anna Daugherty on Wednesday, which will be published as a podcast shortly. If you don’t know Anna, she is a super smart and down to earth product marketer who works...
I saw Speakeasy publish their agent skills. It caught my attention, not because I care about agents, but because I care deeply about the knowledge expressed in these agent skills. Honestly, I don’t...
As I work to define Naftiko, and specifically what a capability is, I wanted to explore how a capability comes to life. But let’s start with my current definition of what a capability is. A capabi...
Bruno has been slow rolling their release of their new OpenCollection format to augment the Bruno Collection, and continue grabbing mindshare from Postman Collections, while simultaneously embracin...
I am genuinely trying to understand the essence of the agentic wave of artificial intelligence. I am always frustrated when I don’t understand something. Unfortunately, much of popular life and cap...
I am an expert in programmatic interfaces as they are used in a variety of applications. I don’t build desktop, web, mobile, device, network, or AI applications — I enable them. I have to keep sayi...
I have been gathering signals about what enterprises are invested in as part of my Naftiko Signals work. As I do, I am working out in the open to make sense of the services I am profiling as part o...
The Microcks team is proposing adding an MCP server for the mocking and testing platform, arguing that every tool needs one. I definitely support every API service and tool having an API, so this l...
I had a really energizing webinar with Nordic APIs last week, hosted by Bill Doerrfeld, and with Lorna Jane Mitchell, Kevin Swiber, and myself in attendance. The questions were good, the conversati...
I am creating a series of 3rd-party Notion API sandbox for my team to develop against, and provide safe spaces for Naftiko customers to develop agents against. The foundation of my Notion API sandb...
I love people waking up to the importance of APIs. I have to work hard not diminish people’s excitement for each wave of “application” of the value in which APIs deliver. People get very attached t...
I am always fascinated by how the same people who are TypeScript believers often become advocates against using a schema-driven approach anywhere beyond “the code”. I am a big fan of having a schem...
API governance using Spectral or Vacuum rules changes when you go from governing APIs you are producing to governing 3rd-party APIs you are consuming. It is a simple, but pretty radical shift in ho...
My Naftiko team asked me for more information on what schema tools are available. Well, more specifically they asked schema explorers there were, but I thought it was an opportunity to take a fresh...
I am deep diving into the properties of interface and application specifications to understand the overlaps across the standards in use within both of these domains. I pulled the JSON Schema for fi...
I’ve been down each of these rabbit holes before. I’ve paid really smart people to go down these rabbit holes. But honestly, what I am talking about is actually a “rabbit warren”. I know we all lik...
I enjoy reviewing APIs. I’m good at it. Over 15 years, I’ve developed a rich and proven API discovery and profiling process. Recently, folks at Avalara reached out to me about my API Evangelist Pos...
I’d like to introduce you to my new startup, called Naftiko. You’ve probably heard me talking about it, but as of 2026, we are a real company with funding and a team. It’s real. Naftiko is focused ...
I have to manually roll the blog for my website over each year. The primary link for my blog goes to whatever the most recent year is, which is a static page. I like it this way. It forces me to ma...
