Securing APIs in the Age of Agentic AI

APIs are a key enabler for modern enterprises, while agentic AI has revolutionized their development and resulted in their explosive growth. Gartner predicts more than 30% of the increase in demand for APIs will come from AI and tools using large language models by 2026.

But the speed with which they can be developed and deployed, and the ease with which different teams within an organisation can do so – can lead to inconsistent governance, increased security risks and high maintenance costs. Executives will need to build the proper infrastructure and guardrails, focusing on security, interoperability, and governance, if they are to scale under control.

In essence, while the APIs may be easy to create and deploy, they may not all be pulling in the same direction. And even worse, they could be exposing the business to increased security threats and compliance issues. This is why having a clear strategy in place first, is essential. 

AI as an enabler of API management

The use of AI in API management has also evolved rapidly, moving from simple, supervised tasks to autonomous agents. This has had a transformative impact on a range of business activities, including: 

• Enabling predictive performance: What was once simply basic, rule-based traffic management has evolved into AI-powered predictive analytics. Agents can now forecast traffic patterns and dynamically allocate resources to prevent bottlenecks and downtime before they even occur.
• From reactive to proactive security: Cyber security has shifted from reactive to proactive, with real-time threat detection powered by behavioural analysis. This enables agents to identify and respond to threats autonomously. 
• From manual to AI-assisted development: Manual coding has been streamlined by AI-assisted design, automated code generation, and documentation creation, accelerating productivity for developers.

Navigating the pitfalls of autonomous agents

But the power and accessibility of agentic AI have introduced new challenges. Without a centralized strategy, multiple teams can create a myriad of disconnected AI agents. This lack of coordination can lead to significant security breaches and enterprise risks. Such as:

• Agent sprawl: A proliferation of uncoordinated agents can lead to operational chaos, conflicting objectives, security breaches and duplication.
• Security vulnerabilities: As agents interact with internal and external systems via APIs, they expand the attack surface. Inadequate access controls or misconfigured permissions can be exploited, leading to data breaches or compromised systems.
• Governance and compliance issues: Autonomous systems need strong governance frameworks to ensure transparency, accountability, and regulatory compliance. Without clear oversight, agent actions can become un-auditable.
• Integration complexity: Many existing enterprise APIs were designed for human developers, not autonomous agents. Integrating agents with siloed or legacy systems requires major effort and can lead to integration failures.

“Organizations really take two approaches,” says Linus Hakansson, Gravitee CPO.

“They either have their strategy figured out – but that is probably not the most common approach we’ve seen – or leadership advocates for their teams to use AI and come up with ideas themselves.”

But he added that this could pose real problems. “If you leave it up to everyone in the organization to go and figure this out, in their own teams, you’re going to end up with a lot of different technologies, solutions, ways of working, and you’re going to have agent sprawl and mass security challenges.”

The need for a strategic vision

To fully harness the power of agentic AI in API management, enterprises must prioritize a clear strategy and use systems which provide oversight, transparency, and the ability to coordinate agents, mitigate risks and ensure compliance.

One such system is Gravitee, which provides centralized discovery, security, and cost control for AI agents and LLMs and has seen numerous successes for companies around the globe – including Tealium and Walmart.

“The concepts of API management, discoverability, security, and observability are going to be incredibly important for this new wave (of AI). And Gravitee is basically the vendor that helps with that,” says Hakansson.  To find out more about Gravitee and to sign-up to its A2A Summit visit: www.a2asummit.ai