> Markdown version of [/videos/1574-lessons-learned-from-observing-a-billion-api-requests](https://www.wearedevelopers.com/videos/1574-lessons-learned-from-observing-a-billion-api-requests). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lessons learned from observing a billion API requests

An analysis of a billion API requests reveals a shocking vulnerability: nearly half lack basic authentication. Learn to secure your architecture and prepare your endpoints for AI consumers.

- **Speakers:** [Pratim Bhosale](https://www.wearedevelopers.com/@pratim-bhosale)
- **Event:** World Congress 2025
- **Published:** August 20, 2025
- **Duration:** 23:47
- **URL:** https://www.wearedevelopers.com/videos/1574-lessons-learned-from-observing-a-billion-api-requests

## Summary

In a landscape where enterprise APIs have grown by 800%, an analysis of over a billion requests reveals a startling vulnerability: nearly half lack basic authentication. This issue is particularly prevalent in flexible JavaScript toolkits like Express and Fastify, while opinionated frameworks like Laravel or strictly typed languages like Go enforce structured coding patterns that inherently boost overall API security scores. Developers must transition from designing APIs based upon legacy database schemas to structuring architectures around specific functionality, ultimately reducing endpoint sprawl and relying on version control to extend backend utility securely.

To combat systemic structural flaws, engineering teams should evaluate their applications against an API score based on four pillars: design standardization, performance optimization, embedded security, and AI readiness. Crucially, security must be treated as a core internal product feature rather than an afterthought delegated to cloud gateway providers. Practical methodologies include enforcing strict plural endpoint naming conventions, embedding rate limiting and authorization headers directly into the routing logic, enabling absolute observability across inter-service communications, and permanently masking personally identifiable information (PII) to prevent unintentional scraping leaks.

The most profound modern architectural shift is the emergence of AI agents and large language models (LLMs) as the third major consumer of developer endpoints. Because APIs increasingly serve as direct programmatic training data, achieving true automation readiness requires meticulous attention to the OpenAPI specification. SDK generators and automated conversational agents depend heavily on explicit operation IDs, highly detailed schema examples, and robust error code coverage that extends far beyond a simple 200 HTTP success response. By configuring observability tools to trace exact LLM request journeys and building flawlessly documented, composable architectures, organizations can transform their raw endpoint data into a distinct competitive moat.

**Keywords:** api vulnerability analysis, javascript framework security, openapi specification optimization, ai agent api consumption, llm sdk generation, endpoint naming conventions, api observability tracing, rate limiting implementation, pii data masking, composable architecture design, enterprise endpoint sprawl, operation id definition, use case driven api design, express vs laravel security

## Chapters

1. **The current state of enterprise APIs and security trends** (00:05) — The explosive growth of internal APIs reveals critical vulnerabilities like the lack of basic authentication.
1. **Security comparisons across web frameworks and development languages** (03:21) — Opinionated architectural frameworks provide robust default security environments compared to generic router libraries.
1. **Understanding the four core pillars of API scoring** (05:55) — Evaluating API quality requires measuring design standards, performance characteristics, internal security measures, and AI readiness.
1. **Improving API scores through practical OpenAPI specification audits** (10:32) — Reviewing production OpenAPI documents reveals that explicit HTTP response codes and rich metadata dramatically improve compliance.
1. **Optimising operation IDs and documentation for AI consumers** (14:53) — Defining descriptive operation IDs and extensive examples allows large language models to accurately implement programmatic SDKs.
1. **Implementing application-level security and masking sensitive responses** (16:26) — Embedding rate limit logic directly into services mitigates automated agent scraping while protecting sensitive user data.
1. **Achieving full traceability for API observability and debugging** (18:32) — Tracking granular service communication is essential for debugging unexpected interactions triggered by third-party data consumers.
1. **Designing use-case driven APIs and consolidating broad endpoints** (20:14) — Structuring endpoints around specific business requirements instead of database schemas mitigates sprawl and simplifies version control.
1. **Building composable interfaces and data sources for agents** (21:17) — Exposing structured and predictably versioned endpoints transforms standard APIs into native training sources for autonomous frameworks.

## Related Moments

- [Final code walk-through and audience Q&A session](https://www.wearedevelopers.com/videos/831-creating-a-routing-app-with-google-maps-api-from-scratch) (from "Creating a routing app with Google Maps API from scratch")
- [Summarizing key engineering lessons for platform API development](https://www.wearedevelopers.com/videos/942-insights-from-building-the-canva-developers-platform-to-empower-185-million-designers) (from "Insights from building the Canva Developers Platform to empower 185 million designers")
- [Key architectural takeaways for building secure APIs](https://www.wearedevelopers.com/videos/377-architecting-api-security) (from "Architecting API Security")
- [Designing APIs for security from day one](https://www.wearedevelopers.com/videos/377-architecting-api-security) (from "Architecting API Security")
- [Addressing audience questions on security and microservice architectures](https://www.wearedevelopers.com/videos/362-security-challenges-of-breaking-a-monolith) (from "Security Challenges of Breaking A Monolith")
- [Clarifying API technologies and future scope](https://www.wearedevelopers.com/videos/1683-rest-in-peace-what-does-the-api-protocol-of-the-future-look-like-or-do-we-have-it-already) (from "REST in Peace? What does the API protocol of the future look like? Or do we have it already?")

## Related Articles

- [Exploring AI: Opportunities and Risks for Developers](https://www.wearedevelopers.com/magazine/522-exploring-ai-opportunities-and-risks-for-developers)
- [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere)
- [The Web We Broke (And Why AI Agents Are Paying the Price) - AgentCon Berlin](https://www.wearedevelopers.com/magazine/735-the-web-we-broke-and-why-ai-agents-are-paying-the-price-agentcon-berlin)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)

## Related Jobs

- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Principal Software Engineer, Enterprise AI Platform](https://www.wearedevelopers.com/jobs/ext/1467292-principal-software-engineer-enterprise-ai-platform) at **GitHub**
- [Principal Software Engineer](https://www.wearedevelopers.com/jobs/ext/267591-principal-software-engineer) at **Twilio**
- [Staff Software Engineer, Copilot Experiences](https://www.wearedevelopers.com/jobs/ext/164361-staff-software-engineer-copilot-experiences) at **GitHub**