In January 2025, the OAuth 2.0 Security Best Current Practice became RFC 9700 (RFC 9700 - Best Current Practice for OAuth 2.0 Security). This technical milestone symbolizes a broader transformation. APIs are no longer just developer tools – they're regulated infrastructure powering everything from AI agents to telecom networks.
The numbers tell a compelling story. While 65% of organizations that use APIs are currently generating revenue from them, a significant gap exists between API adoption and AI readiness. 83.2% of respondents have adopted some level of an API-first approach. Yet only 25% operate as fully API-first organizations. Meanwhile, 89% of developers use AI, but only 24% design APIs for AI agents (GenAI in Enterprise Report).
This gap threatens to leave many businesses behind. The ecosystem is evolving rapidly across six major pillars of change:
Understanding these shifts is essential for participation in the digital economy.
APIs have transcended their origins as optional developer conveniences. They've become mandated infrastructure across regulated industries.
Healthcare systems must implement Fast Healthcare Interoperability Resources (FHIR) APIs. The Centers for Medicare & Medicaid Services (CMS) has set deadlines for interoperability requirements. Significant updates are required by January 2026. Full prior authorization enhancements are due January 2027.
Financial institutions navigate Open Finance requirements. Financial Data Exchange (FDX) reports approximately 114 million customer connections happening through APIs aligned to the FDX standard. A "connection" in the FDX context refers to an instance where a consumer has authorized data sharing between their financial institution and a third-party application.
The EU Data Act and Digital Markets Act establish requirements for data portability and interoperability. These laws require certain organizations to provide APIs for data access. This fundamentally reshapes how businesses approach data exchange.
This transformation represents more than compliance checkboxes. Governments now view APIs as essential utilities requiring standardization, security, and universal access.
The API-First Reality Check
83.2% of respondents have adopted some level of an API-first approach. "API-first" means designing APIs as the primary interface before building applications. Only 25% operate as fully API-first organizations. "Fully API-first" refers to organizations following these principles across their entire development lifecycle.
This gap creates several challenges:
The window for catching up is closing rapidly. Regulatory requirements and market expectations continue to evolve.
Beyond REST: The Protocol Proliferation
REST APIs still dominate but no longer monopolize the architectural landscape. GraphQL's September 2025 specification refresh introduced features like OneOf input objects. This marks its maturation for flexible data fetching.
Organizations leverage GraphQL for customer-facing applications. Clients gain precise control over data retrieval. Over-fetching reduces significantly. Mobile performance improves measurably.
gRPC has emerged as the protocol of choice for internal microservices. Its performance advantages are substantial. Financial trading systems rely on its efficiency. Real-time gaming platforms depend on it. Internet of Things (IoT) applications require its low latency.
Event-Driven Architecture Takes Center Stage
CloudEvents graduated from the Cloud Native Computing Foundation (CNCF) in early 2024. It provides a vendor-neutral envelope for event metadata. AsyncAPI's growing adoption signals a shift toward event-driven architectures.
These standards enable reactive systems that respond to state changes in real-time. Benefits include:
Event-driven patterns solve critical scalability challenges. They decouple producers and consumers. Organizations build systems that handle traffic spikes gracefully. Components scale independently.
Transport Layer Revolution
The transport layer itself is evolving. HTTP/3 adoption continues growing. Connection establishment improves. Head-of-line blocking reduces. These advanced transport protocols offer improved performance over traditional HTTP/1.1 and HTTP/2.
Organizations must balance multiple transport considerations:
The Multi-Gateway Reality
Approximately 31% of organizations operate multiple API gateways. This proliferation reflects diverse requirements:
Managing this complexity requires sophisticated governance:
The Kubernetes Gateway API emerges as a critical standard. Version 1.1 reached General Availability in May 2024. It provides service-mesh support and unified configuration across implementations.
OpenAPI Evolution and JSON Schema Alignment
OpenAPI 3.1.1 achieves full JSON Schema alignment. Years of schema discrepancies have been eliminated. Developers can now share schemas across validation, documentation, and code generation tools without compatibility concerns.
This convergence enables sophisticated API tooling. AI models parse specifications more accurately. Automated testing tools generate comprehensive test cases. Development environments provide better autocomplete and validation.
Workflow Orchestration Standards
New standards move beyond individual endpoint definitions. OpenAPI Overlays 1.0 enables teams to apply transformations without modifying base specifications:
Arazzo 1.0.x addresses complex workflow orchestration. It provides a standard for describing multi-step API interactions. Tools can visualize entire business processes. Validation happens across workflow boundaries. Execution becomes declarative and reproducible.
Discovery and Observability Maturation
Backstage dominates internal developer portals. Organizations move beyond static API catalogs. Dynamic portals integrate with CI/CD pipelines. Real-time availability displays clearly. Interactive testing accelerates development.
OpenTelemetry expands into API-specific tracing. Organizations trace requests across multiple services. Latency contributors become clear. Bottlenecks are identified through standardized instrumentation.
The RFC 9700 Revolution
RFC 9700 updates and extends the threat model and security advice given in RFCs 6749, 6750, and 6819 to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application of OAuth 2.0.
The RFC recommends avoiding the Resource Owner Password Credentials Grant and the Implicit Grant due to security concerns (OAuth best practices: We read RFC 9700 so you don't have to --- WorkOS). These deprecated flows were once common in mobile and single-page applications. They are now considered fundamentally insecure.
RFC 9700 recommends that developers use the Authorization Code Flow with PKCE (Proof Key for Code Exchange) for public clients, including mobile and single-page web applications. PKCE adds an additional security layer to the authorization code exchange. It mitigates risks associated with the deprecated Implicit Grant.
Advanced Security Patterns
Demonstration of Proof-of-Possession (DPoP) token binding addresses token replay attacks. RFC 9449 defines this approach. Tokens become cryptographically bound to specific clients. Stolen tokens become useless to attackers.
Rich Authorization Requests (RFC 9396) enable fine-grained authorization:
FAPI 2.0 and Financial-Grade Security
FAPI 2.0 (Financial-grade API) reached Final status in 2025. February saw the Security Profile finalization. September brought Message Signing completion. It establishes a new baseline for financial-grade API security.
The specification mandates:
Financial institutions worldwide adopt FAPI 2.0. It serves as both regulatory compliance and competitive differentiator in security-conscious markets.
AI-Specific Security Challenges
Nearly one in four developers (24.3%) are already designing APIs with AI agents in mind. Yet 51% worry about unauthorized or excessive API calls from AI agents. Traditional security models require fundamental rethinking.
AI agents present unique challenges:
Organizations need new security patterns:
Healthcare's Digital Transformation
U.S. healthcare organizations must implement FHIR APIs for CMS interoperability requirements. Deadlines are firm:
This represents one of history's largest mandated digital transformations in healthcare. Organizations must redesign data architectures for real-time API access. Robust consent management systems become essential. Health Insurance Portability and Accountability Act (HIPAA) compliance must scale with API traffic.
Forward-thinking organizations view this as an opportunity. They build competitive advantages through patient engagement and operational efficiency.
European Interoperability Mandates
The EU Data Act and Digital Markets Act establish comprehensive requirements. Organizations processing EU citizen data must provide machine-readable export capabilities through APIs. These regulations apply to specific digital service categories. "Gatekeepers" under the Digital Markets Act face particular scrutiny.
Software-as-a-Service (SaaS) platforms face challenges exposing APIs for customer data portability. Smart organizations turn this into opportunity. They build robust integration ecosystems. Their platforms become more valuable as data hubs.
Open Finance Acceleration
Financial Data Exchange (FDX) reports significant growth. Approximately 114 million customer connections happen through FDX-aligned APIs. This represents a 50% increase from 76 million a year ago. The Consumer Financial Protection Bureau (CFPB) continues developing open banking rules. FDX received recognition as a standard-setting body under the Personal Financial Data Rights rule.
Traditional financial institutions can no longer rely on data opacity. They must compete on service quality and innovation. Fintech startups gain unprecedented financial data access. They enable sophisticated services without direct banking partnerships.
The GSMA Open Gateway Revolution
According to the GSMA Intelligence H1 2025 report (GSMA Open Gateway: State of the Market, H1 2025), the GSMA Open Gateway initiative covers 79% of global mobile market share. In total, 73 operator groups representing 285 networks worldwide have committed to the programme. This signals a fundamental telecom industry shift.
Carriers transform from connectivity providers to platform companies. They offer programmable network capabilities through standardized APIs:
Commercialization and Use Cases
Security and anti-fraud APIs remain dominant. They account for two-thirds of commercial deployments. This decreased from over 80% in 2024. The market is diversifying rapidly. Quality-on-demand APIs gained traction. They now represent 25% of new launches, up from less than 10% in 2024.
"Commercial deployments" refers to APIs actively offered to enterprise customers for revenue generation. This distinguishes them from internal or trial deployments.
Commercialization models evolve quickly:
Real-World Applications
Quality-on-Demand APIs revolutionize streaming media delivery:
Identity and anti-fraud APIs become essential for financial services:
The Paradox of Adoption
The disconnect is striking. 89% of developers use AI, but only 24% design APIs for AI agents. This gap represents both massive opportunity and existential risk.
Traditional APIs assume human interpretation:
AI agents are becoming first-class API consumers. This shift demands fundamental API redesign.
Model Context Protocol: The Universal Connector
The March 2025 MCP specification update formally recommends OAuth 2.1 as the primary authorization mechanism. This allows MCP Clients to securely obtain scoped access to MCP Servers.
MCP provides a "universal, standardized connection method" for AI applications. It's an open protocol enabling seamless integration between Large Language Model (LLM) applications and external data sources.
MCP addresses fundamental AI-API integration challenges:
Security and Governance Challenges
AI agents create unprecedented security implications. Traditional models assume rational actors. They expect actors won't intentionally trigger infinite loops or explore undocumented endpoints randomly.
AI agents lack human judgment. They may create problems inadvertently:
Organizations need new governance frameworks:
Revenue and Business Model Evolution
65% of organizations that use APIs are currently generating revenue from them. However, few have adapted business models for AI consumption. Traditional pricing models face challenges:
At Stripe Sessions 2025, Stripe announced the Order Intents API. It allows creation of a commerce agent designed for autonomous purchasing. This API enables AI agents to navigate complex checkout flows programmatically.
Forward-thinking companies experiment with new models:
The API landscape of 2025 has fundamentally reconstructed itself. RFC 9700 updates and extends the threat model and security advice given in RFCs 6749, 6750, and 6819, moving security from guidelines to requirements. Regulations set firm deadlines. Standards converge around machine-readable contracts. AI agents emerge as first-class consumers.
Organizations face a clear choice: evolve API strategies now or become incompatible with tomorrow's digital infrastructure.
The six major shifts aren't isolated trends. They're interconnected forces reshaping digital service delivery:
These demand a unified response.
The gap between organizations claiming API-first adoption and those truly implementing it comprehensively represents both risk and opportunity. APIs aren't optional anymore---they're essential infrastructure.
The question isn't whether to invest in comprehensive API strategies. It's how quickly organizations can transform. Those who act decisively shape standards, capture opportunities, and build the platforms defining the next digital era.
Remember: In 2026, APIs aren't just endpoints. They're regulated, monetized, and increasingly consumed by machines. Treat them like the products and legal obligations they've become.
What are the major trends shaping the API ecosystem in 2025?
The API landscape in 2025 is defined by architectural evolution beyond REST, regulatory mandates, security requirements like RFC 9700, standards convergence, network API commercialization, and the growing integration of AI agents.
How has API security changed with the introduction of RFC 9700?
RFC 9700 makes OAuth 2.0 security best practices mandatory, deprecating insecure flows and recommending Authorization Code Flow with PKCE. Security is now a binding requirement, not just a guideline.
Why is API-first adoption critical for organizations in 2025?
API-first adoption ensures compliance, reduces technical debt, and supports rapid innovation. With regulations and AI integration accelerating, organizations not fully API-first risk falling behind competitors.
How are APIs being monetized and regulated across industries?
APIs are now regulated infrastructure in sectors like healthcare and finance, with mandates such as FHIR and FAPI 2.0. Monetization models are evolving to accommodate AI-driven usage and network API commercialization.
What challenges do AI agents introduce to API design and security?
AI agents generate high-volume, adaptive API calls, requiring new security patterns like dynamic rate limiting and behavioral analysis. APIs must be redesigned for machine consumption and robust governance.
Meet Emily. She’s an API product manager at ACME, Inc., an ecommerce company that runs on dozens of APIs. One morning, her team lead asks a simple question: “Who’s our top API consumer, and which of your APIs are causing the most issues right now?”
Ever feel like you're fighting an uphill battle with your API strategy? You're building APIs faster than ever, but somehow everything feels harder. Wasn’t API-first supposed to make all this easier? Well, you're not alone. And now industry analys
Kong-quer the Agentic AI Hackathon 🚀 Calling all builders, tinkerers, and API innovators. The Kong Hackathon is back for API Summit 2025 ! This year, we’re challenging developers worldwide to create projects that don’t just react, they think , a
In the last two parts of this series, we discussed How to Strengthen a ReAct AI Agent with Kong AI Gateway and How to Build a Single-LLM AI Agent with Kong AI Gateway and LangGraph . In this third and final part, we're going to evolve the AI Agen
In my previous post, we discussed how we can implement a basic AI Agent with Kong AI Gateway. In part two of this series, we're going to review LangGraph fundamentals, rewrite the AI Agent and explore how Kong AI Gateway can be used to protect an LLM
This is part one of a series exploring how Kong AI Gateway can be used in an AI Agent development with LangGraph. The series comprises three parts: Basic ReAct AI Agent with Kong AI Gateway Single LLM ReAct AI Agent with Kong AI Gateway and LangGr
What Is RAG, and Why Should You Use It? RAG (Retrieval-Augmented Generation) is not a new concept in AI, and unsurprisingly, when talking to companies, everyone seems to have their own interpretation of how to implement it. So, let’s start with a r