- AI agents now call APIs directly, and the article identifies eight trends shaping API programs in 2026.
- Gateways are becoming AI gateways that count tokens, cache by meaning and route between models, per the article.
- Security is shifting to per-agent identity: 50.8% of surveyed developers name unauthorized or excessive agent API calls as their top concern.
- The MCP and A2A protocols now sit in the neutral Linux Foundation Agentic AI Foundation, which has grown to more than 250 members.
The biggest API trends in 2026 come down to one change: AI agents now call your APIs, not just apps. That change shows up in eight places. APIs are being exposed as MCP servers. Gateways are turning into AI gateways. Security is moving to agent identity and runtime checks. Governance is going federated across gateways. AI is working across the API lifecycle. Event-driven APIs are replacing fixed request-response flows. Observability now covers token cost and efficiency. And shared standards like MCP and A2A are settling how agents talk to systems and to each other.
This wasn’t a hunch. In March 2024, Gartner predicted that more than 30% of the increase in demand for APIs would come from AI and tools using large language models by 2026. That’s now the working reality for most enterprise API teams. Postman’s 2025 State of the API report found that one in four developers already designs APIs with AI agents in mind.
A few things worth knowing before you dig in:
- Half of developers (50.8%) now name unauthorized or excessive API calls from AI agents as their top security concern.
- Kong, Google Apigee and Boomi all shipped MCP registries or MCP-aware gateway features in 2026.
- MCP and A2A, the two main agent protocols, now sit in one neutral home: the Linux Foundation’s Agentic AI Foundation.
What Changed This Quarter (October 2026)
This list is refreshed every quarter. Here’s what moved since our last update.
- Sep 30: Apigee API hub made its service type attribute generally available, so teams can tag every entry as Code, Model, Agent or Skill. It also added AI performance and Tool performance dashboards that track token usage, model latency and MCP tool traffic.
- Sep 23: Apigee API hub previewed plugins that discover and sync APIs from AWS API Gateway and Azure API Management on a schedule. One catalog, many gateways.
- Sep 21: Apigee X now returns MCP tools from every approved API product in a single tools/list call, which makes MCP access follow the same product model as API access.
- Aug 17: Google’s Agent2Agent (A2A) protocol moved to the Agentic AI Foundation, joining MCP. The foundation has grown from fewer than 40 members at its December 2025 launch to more than 250.
- Earlier in 2026: Kong put an MCP Registry into tech preview inside Konnect (February) and launched an Agent Gateway for A2A traffic (April). Boomi added its own MCP Registry and wider multi-gateway discovery in its May release.
API Trends 2026 at a Glance
| Trend | What’s changing | What to do now |
|---|---|---|
| APIs exposed as MCP servers | Agents discover and call APIs as tools through the Model Context Protocol | Pick 3 to 5 high-value APIs and publish them as governed MCP tools |
| API gateways become AI gateways | Gateways now meter tokens, cache by meaning and route between models | Add token quotas and prompt security to your existing gateway |
| Security shifts to agent identity | Non-human callers make credential misuse and excessive calls the top risk | Give every agent its own identity, scopes and rate limits |
| Governance goes federated | One control plane spans Apigee, Kong, AWS, Azure and MuleSoft gateways | Build a single API and MCP catalog before you add another gateway |
| AI across the API lifecycle | AI drafts specs, generates tests and flags breaking changes | Automate spec linting and contract tests in CI first |
| Event-driven and autonomous APIs | Long-running, agent-driven workflows outgrow plain request-response | Document async interfaces with AsyncAPI alongside OpenAPI |
| Observability covers cost and efficiency | Teams track tokens, model latency and compute, not just uptime | Put token spend per consumer on the same dashboard as latency |
| Shared standards for the agent economy | MCP, A2A, OpenAPI and AsyncAPI settle how agents and systems connect | Standardize contracts and metadata before you scale agents |
The 8 Biggest API Trends in 2026
1. APIs Exposed as MCP Servers
MCP is fast becoming the default way AI agents find and use enterprise APIs. The Model Context Protocol gives an agent a machine-readable list of tools: what each one does, what inputs it takes and how to read what comes back. Before MCP, teams hand-built plugins for every assistant or let agents guess from documentation. Both broke the moment an API changed.
Now the API you already run can be published as an MCP tool behind the same gateway policies you trust. Google Apigee lets teams expose API products as MCP tools, and since September it returns tools from every approved product in a single call. Kong’s MCP Registry links each MCP server to the APIs it depends on, its owner and its inherited policies. Boomi added an MCP Registry to Agentstudio in May. The pattern is the same everywhere: an MCP server is an API product with a new kind of consumer.
Adoption still trails awareness. Postman found that about two-thirds of developers knew about MCP less than a year after launch, but only 10% used it regularly. That gap is where most enterprises sit today. Expect it to close quickly as more teams build agents that need fresh, structured data, including web data APIs designed for LLM apps rather than human dashboards.
What to do: Start with three to five read-only, high-value APIs, such as product lookup or order status. Publish them as MCP tools through your gateway, register them in a catalog and log every tool call with the calling agent’s identity.
2. API Gateways Become AI Gateways
Gateways now govern model traffic the same way they’ve always governed API traffic. The difference is what they measure. A request to an LLM isn’t priced per call; it’s priced per token. So the gateway has to count tokens, cap them per consumer and stop runaway prompts before they hit the bill.
That’s why the leading gateways added AI-specific policies. Apigee ships token-based quotas that now apply at the operation level inside an API product, semantic caching that reuses answers for prompts with the same meaning, and Model Armor to screen prompts and responses. Kong AI Gateway handles multi-model routing, token rate limits and tiered access. We break down the Apigee approach in our Apigee AI Gateway guide.
| Capability | Traditional API gateway | AI gateway |
|---|---|---|
| Rate limiting | Requests per second | Tokens per consumer, per model |
| Caching | Exact URL or payload match | Semantic match on prompt meaning |
| Security | Keys, OAuth, threat protection | Plus prompt injection and data-leak screening |
| Routing | Backend services | Multiple LLMs with fallback and cost rules |
| Analytics | Latency, errors, traffic | Plus token spend and model latency |
What to do: Don’t stand up a separate AI gateway if your current one can extend. Add token quotas per consumer, turn on semantic caching for repetitive prompts and put prompt screening in front of every model endpoint.
3. API Security
The main API security risk in 2026 is an authorized agent doing far more than it should. In Postman’s 2025 survey, 50.8% of developers named unauthorized or excessive API calls from AI agents as their top concern. Another 49% worried about AI systems reaching sensitive data, and 46% feared agents leaking API credentials.
Agents make old weaknesses worse. Broken object-level authorization has topped the OWASP API Security Top 10 for years, and an agent can probe object IDs far faster than a person. Agents also find undocumented endpoints, which turns shadow and zombie APIs from a hygiene issue into an active risk. Even AI features add attack surface: Apigee shipped several fixes in 2026 that harden its AI policies against server-side request forgery.
Runtime protection is catching up. Apigee’s JSON threat protection now rejects payloads with duplicate keys, and Boomi added JSON, XML and regex threat detection policies at the endpoint level. The bigger change, though, is identity. Shared API keys don’t tell you which agent did what.
What to do: Give every agent its own identity and OAuth client, with least-privilege scopes and its own rate limits. Add MCP servers to your API inventory, and alert on agents calling endpoints they’ve never used before.
4. Governance Goes Federated Across Gateways
Large enterprises rarely run a single gateway, and governance tools have finally stopped assuming they do. The goal now is one control plane that sees every API, model and MCP tool, wherever it runs.
The platforms are moving in the same direction. Apigee API hub can now pull APIs from AWS API Gateway and Azure API Management, link specs to live deployments and tag each entry as Code, Model, Agent or Skill. Boomi’s API Control Plane discovers APIs running in Kong Konnect and offers an SDK for adding other gateway types. Kong’s MCP Registry sits inside its existing API catalog.
This matters because discovery is still a real problem. Postman found that 34% of API teams struggle to find existing APIs, 35% duplicate work and 55% cite documentation gaps. Add agents that can call anything they can find, and an incomplete catalog becomes a security and cost problem, not just an efficiency one. If you’re weighing platforms for this, Apigee vs MuleSoft vs Kong comparison walks through the trade-offs.
What to do: Build one catalog for APIs and MCP tools before you add another gateway. Give every entry an owner, a lifecycle state and policies defined as code, so the same rules apply on every runtime.
5. AI Across the API Lifecycle: Design, Testing and Quality
AI now does real work at every stage of the API lifecycle, not just in a code editor. It drafts OpenAPI specs from plain-language requirements, flags inconsistent naming, generates test cases for edge conditions people tend to miss and compares versions to catch breaking changes before release.
The biggest payoff is in the unglamorous parts. Postman found that 55% of API teams struggle with documentation gaps. AI can generate and update reference docs from the spec itself, so they don’t drift. Quality checks also move earlier. Instead of a test phase at the end, spec linting, contract tests, backward compatibility checks and performance tests run on every commit.
There’s a catch. AI-generated specs and tests are only as good as the standards you give them. Without a style guide and human review, you’ll ship inconsistent APIs faster. If you want to see AI-assisted API testing in practice, NeosProbe, NeosAlpha’s API testing product, is a good place to start.
What to do: Put spec linting and contract tests in CI first. Then let AI generate tests and docs against those rules, with a reviewer signing off on anything that changes a public contract.
6. Event-Driven and Autonomous APIs
Request-response isn’t enough when an agent runs a job that takes minutes or hours. An agent reconciling invoices or rebooking a delayed shipment needs to start work, wait for other systems and react when something changes. Polling an endpoint every few seconds wastes compute and still misses events.
That’s pushing more teams toward event-driven designs: webhooks, streaming over Server-Sent Events and event brokers like Kafka. Gateways are following. Apigee supports Server-Sent Events through EventFlow, and Kong now governs Kafka traffic alongside APIs, LLM calls and agent traffic. AsyncAPI is becoming the standard way to document these interfaces, the way OpenAPI documents REST.
REST isn’t going anywhere, though. It’s still the backbone of most enterprise integration. GraphQL keeps its place where clients, including agents, need to fetch exactly the fields they want in one call. The shift is toward using the right style for each job, with state, retries and idempotency built in from the start.
What to do: Find the workflows where agents or apps poll for status. Replace them with events, and document every async interface with AsyncAPI next to your OpenAPI specs.
7. Observability Covers Cost, Compliance and Efficiency
API observability used to mean uptime, latency and errors. In 2026 it also means tokens, model latency and the behavior of the agents calling you. Apigee API hub added AI performance and Tool performance dashboards in September for exactly this reason: teams need to see token usage and MCP tool latency next to traditional API metrics. Boomi now pipes agent telemetry into its Agent Control Tower through OpenTelemetry.
Compliance is changing too. Periodic audits can’t keep up with agents that change behavior daily. Continuous compliance checks runtime traffic against policy as it happens: who called what, with which scopes, and whether the data that left matched its classification.
Efficiency is the third piece, and it ties directly to sustainability goals. Every unnecessary call burns compute and energy. Semantic caching, smaller payloads, pagination and event-driven designs that replace polling all cut load. Teams with carbon targets can now measure compute per API and per consumer, which turns efficiency from a nice idea into a tracked number.
What to do: Put token spend per consumer on the same dashboard as latency and errors. Trace requests end to end with OpenTelemetry, from the agent through the gateway to the backend.
8. Shared Standards for the Agent Economy
Agents will call APIs across teams, vendors and companies, so shared standards matter more than any single platform choice. Four now do most of the work. OpenAPI describes REST APIs. AsyncAPI describes event-driven ones. MCP connects agents to tools and data. A2A lets independent agents talk to each other.
The agent standards just got a neutral home. In August 2026, A2A moved to the Linux Foundation’s Agentic AI Foundation, where MCP already sits. Backers include Google, Microsoft, Amazon, Anthropic and OpenAI, and membership has passed 250. That makes it much safer to build on these protocols without betting on one vendor.
Standards also make APIs reusable products. Postman found that 83.2% of respondents have adopted some level of API-first development, and 64.5% earn revenue from their APIs. Consistent contracts, identity models and metadata are what let a partner or an agent use an API without a meeting first.
What to do: Standardize on OpenAPI 3.x and AsyncAPI, decide where MCP and A2A fit in your architecture, and require the same metadata (owner, data classification, lifecycle state) on every catalog entry.
How Apigee, Kong and Boomi Are Responding
All three platforms are converging on the same idea: one control layer for APIs, models, MCP tools and agents. They get there from different starting points.
Google Apigee
Apigee is extending its API product model to AI traffic. The same products, quotas and analytics teams already use now cover models and MCP tools.
- Token-based quotas: LLM token quotas can now be set per operation inside an API product, so each consumer gets its own AI budget.
- Semantic caching and Model Armor: Responses are reused for prompts with the same meaning, and prompts and responses are screened before they reach a model or a user.
- APIs as MCP tools: Approved API products can be exposed as MCP tools, and a single tools/list call now returns tools across all of them.
- API hub as the catalog: API hub tags entries as Code, Model, Agent or Skill, discovers APIs in AWS API Gateway and Azure API Management (preview) and tracks AI and MCP tool performance.
We’ve delivered Apigee programs for global enterprises, including Visa’s cross-border payment APIs.
2. Kong
Kong is betting on a single gateway that handles every kind of AI traffic: LLM calls, MCP connections, agent-to-agent messages and Kafka events.
- AI Gateway: Routes traffic across multiple models with token-based rate limits and tiered access.
- MCP Registry: In tech preview since February 2026, it registers MCP servers in the Konnect catalog and links each one to its APIs, owner and policies.
- Agent Gateway: Launched in April 2026 to govern A2A traffic between agents.
- Insomnia MCP testing and Konnect Metering & Billing: Developers can test MCP servers directly, and platform teams get cost governance controls.
3. Boomi
Boomi is coming at the problem from integration and agent management, with API management as the connective layer.
- Agentstudio and Agent Control Tower: Design, deploy and monitor agents in one place. Through Boomi Agentstudio, agents can use governed access to 1,000+ enterprise tools via Boomi Connect.
- MCP Registry: Added in May 2026 so agents can discover approved MCP servers from a central catalog.
- Federated API Control Plane: Discovers and governs APIs on other gateways, now including Kong Konnect, with an SDK for adding custom gateway types.
- Runtime protection: New JSON, XML and regex threat detection policies, plus outbound OAuth 2.0 support in the API gateway.
The takeaway: you don’t need to replace your current platform to follow these trends. You need to switch on the AI, MCP and federation features most teams haven’t turned on yet.
Ready to Future-Proof Your API Strategy?
Emerging trends such as AI-powered APIs, event-driven architectures, and API security are reshaping how organizations build and scale digital ecosystems. Ensure your API strategy is prepared for what's next.
Talk to Our API ExpertsWhere to Start in 2027
You don’t need to act on all eight trends at once. Most teams get the fastest return by fixing visibility and identity first, then opening up to agents. Here’s a sequence that works:
- Inventory everything agents could call. List every API, MCP server and gateway, with an owner for each. You can’t govern what you can’t see.
- Give agents their own identities. Replace shared keys with per-agent OAuth clients, scopes and rate limits.
- Turn on AI controls in the gateway you already run. Token quotas, semantic caching and prompt screening are often a configuration change, not a new product.
- Publish a small set of MCP tools. Pick a few read-only, high-value APIs, expose them through the gateway and watch how agents use them.
- Measure cost and behavior from day one. Track token spend, tool latency and unusual call patterns per agent, next to your usual API metrics.
APIs are no longer just plumbing between applications. They’re the control point for how AI agents reach your data and systems, and the teams that treat them that way will scale AI with fewer surprises.
NeosAlpha helps enterprises put these controls in place on Apigee, Kong and Boomi, from AI gateway setup to agentic AI governance. Talk to our API experts to map out where your API program should go next.
