I have been pulling on a thread this week and it went somewhere I did not expect. The question I started with was simple enough: when a company tells me their APIs are private, partner-only, not for public consumption, how much of their industry is actually readable from the outside? Not how many companies have a developer portal — that number is easy to inflate and tells you very little. I wanted to count resources and operations. How many things can you actually call, and who do they belong to?
So I took two sectors where partner-gating is the house style, US travel and US insurance, and counted every operation in every OpenAPI the API Evangelist catalog holds for them. Then, because I have been burned before by contracts that describe hosts nobody can reach, I resolved every server host in every one of those definitions and threw out the ones that do not exist. What was left is the honest public surface of two industries. Every company named below has a profile in APIs.io, scored with the Kin Score, and you can go check my work.
Oracle Hospitality publishes 3,546 operations across 462 distinct resources. Reservations, availability, rate plans, room types, guest profiles, group blocks, memberships, cashiering, invoices, housekeeping task sheets, events, commissions, promotion codes. The entire property management system, described in the open, and more than half of it is write surface — check in a guest, assign a room, post a charge, close a folio.
The six major US airlines, the four major US hotel brands, and every car rental company and passenger railroad in the cohort publish twenty-nine operations between them.
Not twenty-nine each. Twenty-nine total. Eleven of those are United’s. Four are American’s. Thirteen belong to Marriott and I am fairly sure Marriott did not mean to publish them, because they are internal payment and finance APIs sitting on a public SwaggerHub organization, one of which exposes a logging endpoint that has no business being on the internet. Hertz, Avis, Enterprise, and Amtrak publish nothing at all. Delta, Southwest, JetBlue, Alaska, Hyatt, and Choice Hotels publish nothing at all.
The suppliers own the machine-readable layer
Once I sorted every provider into two piles — companies that own the actual inventory or the actual risk, and companies that sell software and data to them — the pattern got very hard to unsee. In travel, 95% of the public operational surface belongs to the suppliers. In insurance it is 96%. Moody’s RMS publishes 780 operations. Socotra publishes 722. Noyo publishes 253. All twenty-eight US insurance carriers in the cohort, combined, publish 114, and seventeen of those twenty-eight publish zero.
This is the part I keep turning over. The machine-readable description of how a hotel works is published by the company that sells hotels their software. The machine-readable description of how a policy is quoted, issued, billed, and claimed is published by the vendors selling policy administration systems to carriers. The brands — the ones with the rooms, the seats, the cars, the risk on the books — are almost entirely absent from the layer where their own business is described.
There is a version of this that is fine. Vendors serve developers; brands serve consumers; the division of labor is old and it works. But that argument stopped working the moment software started choosing which company to call. If the only legible description of your industry is written by your supplier, then your supplier is the one being integrated, and you have quietly become an implementation detail inside somebody else’s contract.
Gated and published are two different settings
The objection I expect, and hear constantly, is that this is a security posture. We cannot publish that, it is commercially sensitive, our partners are under agreement.
I want to be precise about why I do not accept this, because it is not a philosophical disagreement. It is that the two decisions being collapsed here are genuinely separate. One decision is who may call this API — keys, contracts, approval, scopes, rate limits. The other is who may know it exists and what it does. The first is access control. The second is a PDF. Publishing a contract does not issue a credential.
I want to be careful here, because there is a real version of this objection. A published definition absolutely can hurt you — if it leaks an internal host, an undocumented admin path, a debug endpoint, a parameter that was never meant to be reachable. Plenty of people have been embarrassed, and some breached, by a definition that described more than anyone intended. Marriott is in this very study with a public specification exposing a logging endpoint, and that is a genuine problem. But look at what actually went wrong in every one of those cases. The exposure was the endpoint, not the description of it. The definition did not create the hole; it advertised one that was already there and already reachable. If publishing your contract would put you at risk, the contract is telling you something true about your API and the honest response is to fix the API, not to hide the map.
The proof is sitting in the data. Booking.com’s Demand API is affiliate-gated. Try to call it without credentials and you get a 401, every time. The full contract is public anyway, and it is 100% write surface — create the order, modify it, cancel it. Viator’s Partner API is supplier-gated, and the reference is a public eight-megabyte document. These companies did not open access. They locked access and opened the description, which is the entire move, and it costs them nothing.
Choice Hotels makes the point from the other direction better than I can. Choice publishes zero operations. But choiceEDGE, their central reservation system, pushes rate, inventory, and availability as machine-readable data to Sabre, to Amadeus, to Expedia, to Booking.com, all day, under contract. The data already flows. It is already machine-readable. It is already leaving the building. The only thing that is private is the description of it. That is not a security control. That is a filing decision.
Findable but not callable
The Kin Score splits discoverability from contract quality, and when I looked at where the closed providers land, they all land in the same strange spot. Delta scores 59.3 on discoverability and 0.0 on contract quality. Choice Hotels, 68.5 and 0.0. Guardian Life, 64.8 and 0.0. Nationwide, Hartford, MetLife, Hyatt, Chubb — respectable discoverability, zero contract quality, and agent readiness pinned at the floor.
These companies are findable and not callable. They did the marketing half of having an API and none of the machine half.
Guardian Life is the cleanest example I found. Their developer portal is live and it is good — a real Apigee program cataloguing fifteen named production APIs, including evidence of insurability, benefits enrollment, policy and plan configuration, group rating and quoting, verification of benefits, underwriting data. Their member benefits APIs implement the LIMRA LDEx standard. This is a serious, working, funded API program, and I want to be clear that Guardian built something real.
There is no machine-readable contract for any of it. The reference sits behind partner login. So in a study that counts operations, Guardian Life contributes fifteen APIs and zero operations, which means every number I quoted above understates these industries. The gap between the operations these companies actually run and the operations they publish is the real story, and this first pass can only measure one side of it.
Meanwhile Noyo — a company that exists to move benefits enrollment data between carriers and the platforms that sell their products — publishes 253 operations in the open. Member requests for a new hire, a COBRA qualifying event, an enrollment snapshot. Group enrollments, plan rates, discrepancies, renewal decisions. That is Guardian’s problem space, described publicly, by a company sitting between Guardian and Guardian’s own distribution channel. When you do not publish, someone else builds the public layer over you, and they end up owning the integration relationship you thought you were protecting.
What privacy actually costs you
One more thing I found, and it is the detail I cannot stop thinking about.
Delta’s partner API portal is recorded in our catalog at apiportal.delta.com. It covers flight search, flight offers, order management, customer journey events, operational data. It is a real program.
It does not resolve. The hostname is a CNAME pointing at a decommissioned Apigee host that returns NXDOMAIN from every resolver I tried, while the rest of that Apigee zone answers fine. Delta’s developer portal is gone. I do not know for how long.
Here is the thing: if that contract had been public, this would have been a bug report on day one. Somebody’s monitoring would have caught it. Somebody’s CI would have gone red. Instead the only people who could have noticed were partners who already had a login, and their silence is not evidence that anything is working.
That is the cost nobody puts in the business case for keeping an API private. You do not just lose the developers you never met. You lose your own smoke detector.
And then there is the part everyone is now worrying about, which is agents. An agent resolves what it can read. Ask one to book a room or quote a policy and it enumerates the surfaces it can discover, ranks them, and calls one. There is no partner portal login step in that loop and there is no NDA. So the twenty-nine operations published by the whole legacy travel industry are, functionally, that industry’s entire footprint as far as a machine is concerned. Hertz and Avis and Amtrak are not ranked poorly. They are not in the evaluation.
This is early research and I want to hold it loosely. The next pass is the harder one — going provider by provider and asking whether a given company’s private API actually covers the same ground its supplier’s public one does, which is the question that turns this from an observation into an argument. But the shape is already clear enough to say out loud, and it is not the shape I expected when I started counting.
Your competitors are not out-publishing you. Your vendors are.
