API Evangelist Conversation About Nothing Changing in the World of APIs with Jennifer Riggins

Hi, I’m Jennifer Riggins. For the last 15 years, I’ve been a technology journalist. In the developer space, which means always in the API space, last couple years, a ton of platform engineering and developer productivity, and it’s all kind of interlinked, isn’t it?

Yeah, definitely. There was an anatomy of API report that came out. It says 2024, but it seems very relevant to 2025 and just came out. And the idea that, well, we’ve been doing, we’ve been chatting about this skin for like 15 years and it seems kind of. The same, maybe 15 years ago, we weren’t mentioning the word API because we needed to sell the business value, but it’s reached a point where we have such API sprawl. That we need to be educating business or business should know the technical term API and its importance anymore, but there it’s just a lot of the same and we have this, it’s reflected in this platform engineering where we’re trying to condense because of platform engineering, we have too much tools for all well, we have even more API sprawl [00:02:00] and then not shockingly, it’s spreading even more because of the AI of it all and Companies don’t know. What APIs they have, what APIs they’re connecting to externally, what are public or private APIs. They think, I think like 10%, you had said during the trouble webinar about this are actually public APIs, but then they can all be referred, not almost all of them be reverse engineered. So they’re mostly public. And then it’s just getting worse than it’s all about. It feels like it’s always the same thing I’m writing about in a way, for developers want more documentation, they want more discovery, know who owns what, what already exists in a company to, you know, save money and time, they want to be enabled to reduce technical debt, but they don’t want to write, reduce technical debt, nor write documentation, it feels like [00:03:00] it’s just the same thing, we may be calling it platform engineering, but a lot of it’s API management, There’s also the only way developers want to consume platforms is via an API. It’s kind of this rigmarole that keeps going around, but at least the people are good in it. And we want to make developers more productive, yet often we are not listening to developers when they tell us what they need to be more productive. And APIs are at the core of all of that.

Well, there is one thing that’s kind of coalescing, not in the overall platform engineering, but there is this pattern that if you treat a platform as a product and your engineers as customers. So what’s changed in the last 15 years? Tools for all. And API sprawl is more, it’s much more expensive. We’ve moved to the cloud, which is much more expensive. So we’ve got our two biggest costs and then the cost of engineers is more expensive. Yet if we’re investing that much money, we’re not treating them. We’re treating them like a commodity. Not something we can help improve. We’re not asking developers what they want, [00:05:00] or maybe we are asking them because we’ve kind of known things like the documentation for a long time, we’re just not listening and factoring that in. And we see that with AI as well, because Generative AI is not good at coding, and that’s all developers want to do, and we’re trying to take away that 20 to 30 percent of their day they actually get to spend coding. But you know what Gen AI is really good at? It’s explaining complex topics, which would deal with the documentation and really help to tackle technical debt as well, which are constantly developers biggest complaints, that they’re dealing with those things instead of technical debt. So, AI also would be very interesting in discovery and figuring out who owns which APIs or which services and then figuring out how to then reuse them and identify what exists within a company, which would save money as well. But I don’t know why, though, this continues because, and you must be banging your head against the [00:06:00] wall at many organizations you work with, Kim.

We’re not. But there have been wins like with documentation. The, uh, The Dora report did say this year that the biggest win, if you have a 25 percent increase in generative AI, it leads to a 7. 5 percent increase in quality of documentation. That’s a huge productivity win. But then on the other side, 50 percent of AI generated code has bugs, but it’s harder to debug because the developers didn’t write it all. So, it’s just about I think if we adopt this platform as a product mindset where we are you treating, we have a team, whether you call it the DevOps team, the platform engineering team, the API management team, whatever you want to call it, [00:08:00] but that truly understands that their internal developers are customers and you’re trying to improve. That should unlock better API security, better API management, better developer experience across the whole software development lifecycle. But it’s hitting this wall just like with DevOps or using external products where platform engineers, again, are engineers, so they think they know best and they can engineer their way around it. So it kind of all comes back to this same issue in technology with that The famous chasm between technology over here and business over here. Even though technology is the most expensive thing, tech often doesn’t speak business and business does rampant cutting and not taking responsibility for its employees because it doesn’t understand the technology that. Maybe this time we need to, if business is not going to tech up, [00:09:00] tech has to business up, so they need to learn things like user experience design, user experience research, and your users are your internal customers, which is good because they’ll probably tell you more honestly what they think and what they want. You just have to listen.

I’d hope. I don’t know if that’s true. If, if platform teams can enable reusability, same with if API management teams could have enabled reusability, I think that cuts costs logically and increases speed to market. But it all comes down to the success of measuring APIs or DevOps. Agile, we forgot that keyword in that, in that 15. your historical timeline or platform engineering, you have to be able to prove your value. And that’s about fully understanding the business goals and then tying to it. Uh, OKRs are a little better at this, but I don’t know many companies that really understand OKRs, but the idea that your. Team goals, because individual goals may be [00:11:00] for, you know, self improvement are great and all, but not great for the time of layoffs, but like team goals, meet the divisions goals, meet the department or department division goals and start building up. And that connects to overall company goals. That’s really valuable. But the problem with APIs is we still haven’t fully educated that. And it just all comes back to that chasm, the chasm. Chasm? Chasm, where we’re not talking across those two things, but one of those two things became the most expensive division in the majority of companies. And that hasn’t changed, that dialogue hasn’t opened, which is kind of wild.

as I, I’m not sure who on that, that webinar that I, I Watch on where, but somebody said, I think it was probably you that said as individuals, we touch like APIs a day, which is crazy, which is a good way of teaching like what is an API, but instead enabling using APIs as a way to, you know, actually know which APIs we have. I’m creating discoverability. I think probably security is the most compelling way to talk about APIs [00:14:00] because it is how we expose data and how we connect to outside companies and things. And we don’t know it. And then the. We have all this, it’s kind of, and maybe the environment too, because we have all these open endpoints, like 30 percent are zombie endpoints. And there’s the environmental impact, which is the financial impact. So FinOps and GreenOps are quite similar right now until AWS is more transparent. But just everything’s going to explode with AI. And it just comes down to we don’t have these basic policies in place around security now and on data. And everything’s going through APIs, so I think it’s kind of a. a stick more than a carrot. So we need companies to be legitimately scared that they’re going to be hit by EU or CCPA regulations or fines or they’re going to be their reputation [00:15:00] destroyed because it’s just getting worse with AI. So the report had said, and I thought this was kind of hot, burying the lead of it that in the average API in 2023 had 22 endpoints, and in 2024, I have 42 endpoints, and we’re just going Leaving all these endpoints out there, they could be a zombie endpoints. They’re not being tracked. They’re fragile. Like you said, the companies you talk to think like only 10 percent of their APIs are public, but it’s like way more than more than half often. And I think probably the stick is how you do it by scaring the crap out of companies that they need to care about APIs, because they are probably. In some way, almost every vulnerability is accessed via an API, because that’s how things are accessed and connected.

No. And it’s bizarre. I, I just read the statistics. So two years ago, there was 30 some percentage of companies had AI policies. And by the end of last year, only 42 percent of companies had AI policies. We’re on year three of this. of this big, I know AI has been around for decades, but of this generative AI. That to me is wild that you do not have a policy in place. You do not have ethical reviews. You do not have how you use this. Oh, [00:18:00] even systems now that GPU is not that expensive again, and it’s widely available for now. Just have it on your own computer, not on the internet. Stop training this massive. And this is a great example of how to use, uh, Open source projects that is highly profitable that you’re not getting profit from. Uh, your loss of your licensing, your risk if you’re using a certain open source license, I’m calling you right now from State of Open Cons. Open Source is online. But on the other hand, if your software is proprietary and you’re using it to sync once the Samsung. hit, and we knew that Samsung’s like, we’re not doing generative AI, like, was almost three years ago now, it was May 2022, I believe, and since then, not much has changed. So, your AI, your API policies, your platform, these all interlink that you have to have this thought that you’re [00:19:00] connecting with an outside world. Nothing’s locked down and you don’t know what’s connecting out there because your API sprawl is still there. So you need to know what you have, but you also need to talk to your engineers so you’re enabling them in the best way.