AI-Assisted API Design; When Teams Design Systems: Conway's Law in the Age of Microservices - API Developer Weekly

API Developer Weekly Nov 13, 2025 - Issue #564 We're back with a new batch of articles for you to read. This week, I'm sharing a recent webinar where I discuss AI-Assisted API design using ADDR (you can sign up to be notified about my upcoming report). We also look at Conway's Law in the age of microservices - a good read for anyone not already familiar with Conway's Law. We also look at how to develop robust REST APIs, how RPC actually works, and how Arazzo might be one way to help MCP servers consume APIs. In addition, we look at type-driven HTTP by exploring tRPC, OpenAPI, and classic RPC. Finally, OWASP has released a guide for securing third-party MCP servers, Steven Willmott looks at how AI systems are talking today, and we look at a walk through of using Kiota to generate API clients from OpenAPI. -- Happy Reading! Featured Articles AI-Assisted API Design - FusionAuth Webinar Explore how to leverage AI to enhance your API design and documentation efforts. Learn to effectively use AI to accelerate your API delivery lifecycle, creating APIs that are ready for both human and machine consumption. [fusionauth.io] When Teams Design Systems: Conway's Law in the Age of Microservices "Organizations design systems that mirror their communication structures." - - Melvin Conway, 1968 by Meherban Singh [medium.com] Building Robust REST APIs: Best Practices Building Robust REST APIs: Best Practices Introduction Designing a RESTful API for a high‑stakes domain such as finance or commodity trading isn't just about getting data from point A to point B ... by Jeferson Moura [medium.com] How RPC Actually Works 96: What Is RPC? Understanding Remote Procedure Calls for Microservices. by Neo Kim [newsletter.systemdesign.one] 4 Popular APIs With Great Naming Conventions Discover four APIs with excellent naming conventions and learn how consistent structure improves developer and agent experience. by Janet Wagner [nordicapis.com] How APIs extend data access and automation in Google Ads and Meta Ads Go beyond dashboards. Use platform APIs to access deeper data, connect insights, and automate workflows that reveal new opportunities. by Anu Adegbola, Danny Goodwin [searchengineland.com] How Arazzo Could Help MCP Servers Orchestrate APIs for AI Consumers Arazzo could benefit MCP servers by providing a more deterministic approach to defining sequences of API calls underlying MCP tools. by Janet Wagner [nordicapis.com] Better Auth API keys Vulnerability Let Attackers Create Privileged Credentials For Arbitrary Users A severe vulnerability in the popular better-auth library's API keys plugin enables attackers to generate privileged credentials for any user without authentication. [cybersecuritynews.com] (Un)Related Type-Driven HTTP: tRPC vs OpenAPI vs RPC Type-Driven HTTP: tRPC vs OpenAPI vs RPC How three API styles shape developer velocity, safety, and long-term maintainability - and when to pick which. Compare tRPC, OpenAPI, and classic RPC for ... by Codastra [medium.com] Top MCP tools for software architects Top MCP tools for software architects Introduction Software architects work in complex ecosystems every day, switching between AWS consoles, GitHub repos, Grafana dashboards, Kanban boards ... by IcePanel [icepanel.medium.com] CheatSheet - A Practical Guide for Securely Using Third-Party MCP Servers 1.0 The Practical Guide for Securely Using Third-Party MCP Servers from the OWASP GenAI Security Project provides a detailed framework for safely deploying and managing external Model Context Protocol (MCP) servers. It outlines the unique security risks introduced by connecting AI models to third-party tools and data sources, including tool poisoning, prompt injection, memory poisoning, and [...] by OWASPGenAIProject Editor [genai.owasp.org] How AI Systems Will Talk: APIs, MCP, and A2A meet Agent Languages AI-to-AI communication is harder to achieve than it looks. This post looks at the intersection of Web APIs, MCP, A2A, and previous generations of Agent Communication. Drawing practical lessons for today's system communications. [steampunkai.com] Write strongly typed Web API integration tests using Kiota and OpenAPI Recently, I discovered Kiota, a tool that generates API clients from OpenAPI specifications, and it has significantly simplified my testing process. In this blog post, I'll share how I use Kiota to create type-safe HTTP clients that are consumed within the integration tests for my ASP.NET Web API endpoints. by Tim Deschryver [timdeschryver.dev] Upcoming Events apidays Paris API governance, monetization, and future trends December 9–11, 2025 Paris, France Details and registration API Economy Summit / Paris "Powering the API Economy" Headliners TBA December 10, 10am-4pm Details and registration (Contact Bertrand Masson) Have something to share? As always, if you want to chat, share a link, or make a suggestion, feel free to drop us a quick note or tagging us on Twitter (@launchany and @caseysoftware) or by emailing us at: james@launchany.com. Want to change how you receive these emails? You can update your preferences or unsubscribe from this list.