The Agent Hype is at Odds with Your API Foundation
Nordic APIs Platform Summit · Stockholm · 12–14 October 2026
Kin Lane — API Evangelist
The Agent Hype is at Odds with Your API Foundation
Everyone in this room is being asked to evolve something. The question nobody is asking out loud is what they are evolving from.
Two independent scores across 27,582 providers, and one finding that decides whether any of the agentic work announced this year holds.
The Instrument, Not the Anecdote
API Evangelist has profiled every provider it could find into APIs.io — 27,582 of them, scored on a published rubric.
That profiling is what makes this a measurement rather than an opinion.
Everyone Is Already “AI-Ready”
MCP servers announced. Agent Skills published. “Agent-ready” in the press release.
That is the problem the rest of this talk solves — not by arguing, by scoring.
Two Instruments
- Kin Score
- 0–100 composite of governance fundamentals over six base facets — contracts, documentation, security, support, operations, discoverability.
- Two conditional facets
- Regulatory, applied only where the provider's tags match a regime. Open source, applied only where we hold a live repository read.
- Agent Readiness
- A separate 0–100 across 19 dimensions (139 raw points) — can an autonomous consumer drive this API without a human filling in the gaps?
Two Scores That Never Touch
The design — computed independently. No shared inputs, no rollup, no weighted average between them.
Why it matters — a blended score can only ever confirm its own assumption. Keeping them apart is what turns the relationship between them into a finding instead of a design decision.
Readiness Is a Layer.
A Layer Does Not Rise Above Its Foundation.
| Composite band | Providers | Mean agent readiness | Reaching Agent-Native |
|---|---|---|---|
| Exemplar | 255 | 41.9 | 58.4% |
| Strong | 1,101 | 35.0 | 28.2% |
| Developing | 3,930 | 27.8 | 9.8% |
| Thin | 4,471 | 19.6 | 1.8% |
| Emerging | 6,555 | 4.2 | 0.2% |
| Minimal | 11,270 | 0.2 | 0.0% |
The Four Disciplines
- Idempotency
- A retry that is not a second charge.
- Error semantics an agent can branch on
- Not a 200 with
"status": "failed"in the body. - Auth and consent clarity
- Who is acting, on whose behalf, with what granted.
- Rate-limit signalling
- A limit the consumer can read and respect, not discover by being cut off.
Agents Do Not Consume Endpoints
The shape — open the account. File the claim. Move the shipment. Settle the payment. Each one is a chain of contracts, not a call.
The consequence — the agent fails at whichever contract in that chain is ungoverned. The weakest governed link sets the ceiling for the whole capability.
What Changes When the Reader Is a Machine
- Contracts — 64.4% score zero
- A spec that exists is the floor. A spec that is current, complete and describes what the API actually does is the thing. An agent cannot tell the difference between a stale spec and a lie.
- Documentation
- Prose written to persuade a human evaluator does nothing for a consumer that cannot be persuaded. Examples, tags and error catalogs are the part that survives the transition.
The Facets Nobody Put in the Press Release
- Security
- An agent acting on a user's behalf makes scope granularity, consent and identity the
whole ballgame.
securitySchemessays how you authenticate; it does not say what a caller is permitted to do. - Support
- The escalation path a human takes when something is ambiguous does not exist for an agent. Whatever is not in the contract is not available.
- Operations — 45.6% score zero
- Status, change communication, deprecation with a date. An agent will keep calling a sunset endpoint until something tells it not to.
The Regulator Gets Exactly the Artifact It Names, and Nothing Adjacent
The natural experiment — three mandated markets profiled end to end: UK Open Banking, the Australian CDR, US digital health.
The pattern — name writes and you get idempotency. Name reads and you get reads. Name a posture and you get a policy document.
Sector comparison (UK vs AU idempotency, digital-health consent) still needs the cohort pass — do not put a number on it until it is run.
An MCP Server on an Ungoverned API Does Not Move the Number
What was expected — ship the MCP server, the readiness score goes up.
What the catalog says — it does not move. Inside an otherwise governed portfolio it makes things worse: a confident interface over an unreliable contract, which is harder to detect than no interface at all.
A Spec, an Auth Scheme, a Rate-Limit Header
A very large cluster of providers sits at a near-identical artifact set and a near-identical score. Same three things, nothing else.
Which Companies Actually Have a Handle on This
The problem — the story you can read is a press release. The story you can measure is a score.
What a public, repeatable instrument buys — you can rank, you can compare, you can watch it move, and you can be wrong in public and correct it.
Governance Was Offense. Now It Is Defense.
- Map the capability, not the endpoint — pick one business capability and list every contract in its path.
- Score the contracts, not the intention — find the weakest governed link, because it is your ceiling.
- Fix the foundation before the interface — idempotency, error semantics, consent, rate-limit signalling.
- Then ship the MCP server, and watch the number actually move.