We are quickly moving through March and have some great articles for you in this edition. First, a look at how REST became a buzzword, the misunderstandings, and what the dissertation actually said. This is a nice summary of what many of us have been teaching for years. So, read it as review, read it to get the real scoop on REST, and share it with others.
We also look at how API design principles and practices are shifting as a result of the agentic era. I'm seeing this as well and have been sharing resources to help folks prepare for this shift in our day-to-day. Also, we look at Cloudflare's new API vulnerability scanner, how to manage multiple API gateways at scale, and how Stripe's llm.txt is bridging the API and AI worlds.
Finally, be sure to check out the draft of the official RFC for JSON Schema. While the specification has been managed independently, this is the first time it has been registered with the IETF. We also have several articles that look new APIs from vendors, a look at managing your MCP context window, and OWASP's top 10 for agentic applications.
-- Happy Reading!
Featured Articles
How REST Became a Buzzword
Most developers think of REST APIs as resource-oriented URL design with CRUD operations mapped to HTTP methods—something like GET /users/123. In reality, REST is a hypermedia-based style where clients follow links in server responses to transition application state. This is widely misunderstood. by BEAR Blog [koriym.github.io]
API Design Principles for the Agentic Era
For 15 years, developer experience meant optimizing for humans at a terminal. That model is increasingly incomplete. A growing share of API traffic is generated by AI agents that read docs, make decisions, and retry failures autonomously. This is the same discipline as DX applied to a new consumer. by Apideck [apideck.com]
Active defense: introducing a stateful vulnerability scanner for APIs
Cloudflare's new Web and API Vulnerability Scanner helps teams proactively find logic flaws. By using AI to build API call graphs, we identify vulnerabilities that standard defensive tools miss. [blog.cloudflare.com]
Gateway Federation: How to Manage Multiple API Gateways at Scale
Learn how API gateway federation enables centralized governance, security, and visibility across multi-cloud and hybrid API environments. by Adriano Mota [nordicapis.com]
Stripe's llms.txt has an instructions section. That's a bigger deal than it sounds.
When Stripe added /llms.txt to their docs, most write-ups noted it as another company "embracing the AI era." They missed the interesting part. Buried inside is an instructions section no other company has built - Stripe programming what AI tools say about Stripe. Here's why that matters and what it means for your API. by Apideck [apideck.com]
IETF Draft: JSON Schema
JSON Schema defines the media type "application/schema+json", a JSON- based format for describing the structure of JSON data. JSON Schema asserts what a JSON document must look like, ways to extract information from it, and how to interact with it. The "application/ schema-instance+json" media type provides additional feature-rich integration with "application/schema+json" beyond what can be offered for "application/json" documents. [datatracker.ietf.org]
How LLMs Are Changing the Way We Build API Specifications
How LLM-powered AI agents are changing API specification design and why machine-readable no longer means machine-optimized. by Art Anthony [nordicapis.com]
Right-Sizing Your MCP Context Window: What Google, Cloudflare, Mastercard, and Others Get Right
The Model Context Protocol has taken the developer tooling world by storm. But as adoption accelerates, a critical question is being overlooked: what exactly should go inside the context window? Most conversations about MCP center on three things - tool design and scoping, OAuth 2.1 authorization, and transport mechanisms. These are important infrastructure concerns. [naftiko.io]
Lessons from OWASP Top 10 for Agentic Applications
Secure AI agents using the OWASP Top 10 for Agentic Applications. Learn how an identity layer stops goal hijacking and tool misuse in autonomous systems. by View profile [auth0.com]
Business of APIs
New Visa API Tool Updates Payment Infrastructure
The Visa Acceptance Platform now enables acquirers to modernize their payment processing through a single API. The capability comes from the newly by PYMNTS [pymnts.com]
10 Signs Your Internal APIs Are Ready for Monetization
Discover 10 signs your internal APIs are ready for monetization and how to turn them into scalable API products. by J Simpson [nordicapis.com]
(Un)Related
AI Governance Lessons from OpenClaw and Moltbook
Discover what OpenClaw and Moltbook reveal about emerging AI governance needs-and how enterprises can secure APIs, agents, and AI systems at scale. [blog.axway.com]
|
|
