The Agent Hype is at Odds with Your API Foundation
Nordic APIs Platform Summit · Stockholm · 14 October 2026
Kin Lane — API Evangelist
API Evangelist
Kin Lane
I have studied the business, politics, and technology of APIs
as the API Evangelist since 2010 — sixteen years of watching
this industry professionalize, wave by wave.
Along the way: Presidential Innovation Fellow at the White
House, Chief Evangelist at Postman, and standing up API governance across
Bloomberg's API estate.
Today I operate APIs.io, where I profile and
score 28,597 API providers on the Kin Score and Agent Readiness — the
two instruments this talk is built on.
You are not choosing whether agents use your APIs
They are already calling them. Through a copilot someone in
your company installed, through a vendor's integration, through a customer
who wired an assistant to your public endpoints.
Whatever governance you have — or do not have — is what
those agents inherited the day they arrived.
Claimed by every API program, measured by almost none
"AI-ready"
MCP servers announced. Agent Skills published. "Agent-ready"
in the press release.
Without a foundation that is designed and governed, that is a house of
cards. And from the stories we are all being bombarded with, it is very hard to
tell which companies actually have a handle on this moment.
Kin Score 0.23.0
The Two Instruments
Kin Score
0–100
composite of governance fundamentals
6 base facets
+ 3 conditional —
regulatory · open source · create-or-update
never blended
Agent Readiness
0–100
standalone — can an agent drive it safely?
19 dimensions
139 raw points
Never blended Computed independently — which is what makes
the relationship between them a finding rather than an assumption.
Where both instruments live
APIs.io
The finding — measured, 2026-10-03
Readiness is a layer. A layer does not rise above its foundation.
r = 0.874composite × agent readiness, 28,597 providers
4.8%score agent readiness ABOVE their composite
Composite band
Providers
Mean agent readiness
Score clears the Agent-Native line
Keep the band after the gate
Exemplar
419
45.9
66.3%
18.1%
Strong
1,198
37.6
37.4%
10.8%
Developing
3,553
29.9
16.6%
4.2%
Thin
4,477
21.3
5.3%
0.6%
Emerging
6,581
5.0
0.4%
0.1%
Minimal
12,369
0.4
0.0%
0.0%
Part one — the foundation
Four Facets That Define Your Platform
Nine facets in the composite. These four are where an agent finds out
what you never wrote down.
Composite facet · the heaviest
Contract Quality
Measures how deep and machine-readable the API contract itself is — OpenAPI, AsyncAPI, JSON Schema, JSON-LD.
0.25 of the composite
15.4mean
0.0median
66.1%score zero
15.7%50 or above
When the consumer is an agent A human reads the docs when the contract is thin; an agent has nothing else to read.
Composite facet · where safety starts
Operational Transparency
Measures whether the provider publishes how the API BEHAVES in production — rate limits, status, change log, deprecation, security disclosure.
0.13 of the composite
12.0mean
2.6median
48.0%score zero
5.6%50 or above
When the consumer is an agent Rate limits, status and deprecation are the signals a human absorbs by noticing; an agent only knows what is published as data.
Composite facet · permission to act
Access Clarity
Measures whether what it costs, what you may do with it, and how you get in are all published — plans, pricing, sign-up, terms, privacy.
0.20 of the composite
23.4mean
21.1median
32.5%score zero
12.8%50 or above
When the consumer is an agent An agent cannot accept terms it cannot read, and cannot sign up for a key through a form.
Composite facet · the weakest
Contract Governance
Measures the artifacts that describe and constrain the contract — rulesets, vocabulary, declared conformance, overlays.
0.12 of the composite
5.6mean
0.0median
66.0%score zero
0.4%50 or above
When the consumer is an agent Rulesets and overlays are how a provider says what its contract PROMISES, which is the only thing an agent can plan against.
Part two — the layer · these are not AI features
The four disciplines
Idempotency
A retry that is not a second charge.
Error semantics an agent can branch on
Not a 200 with "status": "failed" in the body.
Auth and consent clarity
Who is acting, on whose behalf, with what granted.
Rate-limit signalling
A limit the consumer can read and respect, not discover by being cut off.
Agent Readiness · gate rail one
Idempotency
Do mutating operations accept an idempotency key, so a retry is not a second write?
9 of 139 raw points graded
1,088 of 28,886 providers earn it
(3.8%)
verified443 · 1.5%
documented only568 · 2.0%
DERIVED — written by API Evangelist, not the provider77 · 0.3%
not applicable (no write surface)1,007 · 3.5%
absent26,791 · 92.7%
When the consumer is an agent Agents retry. Without an idempotency key a retry is a second charge, a duplicate ticket, a message sent twice.
Agent Readiness · gate rail two
Stable Error Semantics
Are errors a stable, typed envelope an agent can branch on?
8 of 139 raw points graded
6,027 of 28,886 providers earn it
(20.9%)
verified2,557 · 8.9%
documented only1,972 · 6.8%
DERIVED — written by API Evangelist, not the provider1,498 · 5.2%
absent22,859 · 79.1%
When the consumer is an agent Agents branch on errors; free text sends them into blind retries.
Agent Readiness · who is acting
Machine-Readable Auth
Can an agent authenticate with a credential bound to it, or only bear a static secret?
10 of 139 raw points graded
10,586 of 28,886 providers earn it
(36.6%)
served at the provider's own host2,440 · 8.4%
bound credential18 · 0.1%
negotiable OAuth637 · 2.2%
static bearer secret7,491 · 25.9%
absent18,300 · 63.4%
When the consumer is an agent An agent either holds a credential bound to it, or it bears a secret that names nobody.
Agent Readiness · where the agent is
Rate-Limit Signaling
Is rate-limit state published as machine-readable data, ideally in response headers?
7 of 139 raw points graded
9,786 of 28,886 providers earn it
(33.9%)
verified441 · 1.5%
documented only8,935 · 30.9%
DERIVED — written by API Evangelist, not the provider410 · 1.4%
absent19,100 · 66.1%
When the consumer is an agent Documented limits tell an agent the ceiling; response headers tell it where it currently is.
Part three — the press release
What Gets Announced
The two dimensions that make the headlines — MCP servers and Agent Skills —
and what the catalog says about who actually shipped them.
Agent Readiness · the most claimed dimension
MCP Server
Is there a Model Context Protocol server an agent can actually connect to?
12 of 139 raw points gradedprovenance-graded
3,363 of 28,886 providers earn it
(11.6%)
verified — manifest probed1,620 · 5.6%
documented only1,079 · 3.7%
a platform's server, not their own611 · 2.1%
templated53 · 0.2%
absent25,523 · 88.4%
When the consumer is an agent The most direct expression of agent-first design, and the easiest to claim without shipping.
Agent Readiness · who wrote it?
Agent Skills
Are there packaged operating instructions for an agent using the API?
5 of 139 raw points provenance-graded
4,615 of 28,886 providers earn it
(16.0%)
published by the provider715 · 2.5%
DERIVED — written by API Evangelist, not the provider3,734 · 12.9%
unknown provenance166 · 0.6%
absent24,271 · 84.0%
When the consumer is an agent Packaged operating instructions, rather than leaving usage to be inferred from the spec.
The negative finding — measured, 2026-10-03
An MCP server gets you the points. The foundation decides whether you keep them.
3,347providers with an MCP server
1,266score high enough for Agent-Native
997lose the band — no idempotency or typed errors underneath
Where the MCP server sits
MCP servers
Reach Agent-Ready or better
Reach Agent-Native
Minimal + Emerging foundation
870
59 · 6.8%
4
Minimal foundation alone
205
3 · 1.5%
0
Catalog snapshot 2026-10-03 · rubric 0.23.0 · an MCP server = verified, documented, platform-hosted or templated on the MCP dimension
A capability path, not a call
Agents do not consume endpoints
The shape — open the account. File the claim. Move the
shipment. Settle the payment. Each one is a chain of contracts, not a call.
The consequence — the agent fails at whichever contract in
that chain is ungoverned. The weakest governed link sets the ceiling for the whole
capability.
For a European room
The regulator gets exactly the artifact it names, and nothing adjacent
Name writes and you get idempotency. Name reads and you get reads.
Name a posture and you get a policy document.
PSD3, the Data Act, the AI Act and the EUDI wallet are coming. They will
produce whatever artifact they name. If you want agent-ready capabilities out of them,
argue for the contract, not the posture.
The band gate
This is not the future I would have chosen, but it is the one we have.
The market responded the way it did to LLMs and agentic automation.
It may not be the ideal approach to take, but it is the market we have, no matter
how irrational.
Lean In I've chosen to lean into the market rather than
fight it, making my approach an offensive and defensive approach to governing how
agents engage with my business.
Governance was offense. Now it is defense.
Before the next agent announcement
Map the capability, not the endpoint — pick one business
capability and list every contract in its path.
Score the contracts, not the intention — the weakest governed
link is your ceiling.
Lay the two rails — idempotency and a typed error envelope, in
the contract, before anything agent-branded.
Then ship the MCP server, and watch the band move, not just
the score.
APIs.io
Explore, Learn, Understand — or Influence the Market
Explore and Learn — free. Search the
catalog and read any one of the 28,597 providers in full: profile, artifacts,
capabilities, and both of its scores.
Understanding — everything that synthesises across
the catalog. Influence — claim your own listing, see exactly what you
fail, and what a set of fixes would score.
Where do you stand with your API?
Look yourself up before you leave the room:
apis.io
If the catalog is wrong about you, tell me — corrections are
free, and I will rescore you.
