In July 2011, Marc Andreessen published his famous essay "Why Software Is Eating the World" in The Wall Street Journal. His argument was that software companies were poised to take over large swathes of the economy, disrupting industries from retail to healthcare to national defense. The essay was prescient. But it missed--or at least understated--a crucial mechanism through which software would exercise its transformative power. Software was not just eating the world directly, as products and services. Software was eating the world through interfaces--through the application programming interfaces, or APIs, that allowed different software systems to talk to each other, share data, and compose new capabilities from existing services.
By the mid-2010s, this mechanism had a name: the API economy. The term described a fundamental shift in how technology companies created and captured value. Rather than building monolithic products that did everything internally, companies were exposing their capabilities as programmable services that other developers and businesses could integrate, combine, and build upon. Stripe offered payments as an API. Twilio offered communications as an API. Google offered maps, translation, and machine learning as APIs. Amazon offered computing infrastructure, storage, and database services as APIs through Amazon Web Services.
The numbers were staggering. By 2023, Stripe was processing over $1 trillion in annual payment volume through its API. Twilio's API handled billions of communications events per quarter. AWS generated over $90 billion in annual revenue, almost entirely through API-mediated services. Salesforce estimated that by 2025, more than 80% of all business data transactions would flow through APIs. The research firm MuleSoft found that the average large enterprise used over 900 individual applications, connected through thousands of API integrations.
These figures represent more than a technical trend. They represent a restructuring of economic relationships around programmatic interfaces. The API economy has changed how businesses create value, how developers build products, how platforms exercise control, and how entire industries organize themselves. Understanding the API economy is essential for anyone seeking to comprehend how modern technology shapes business, labor, and power.
What Is the API Economy?
The Technical Foundation
An API (Application Programming Interface) is a set of rules and protocols that allows one piece of software to communicate with another. When you use a weather app on your phone, the app does not generate weather data itself. It sends a request to a weather data provider's API, which returns the current temperature, forecast, and other information in a structured format that the app can display. The API is the intermediary that makes this exchange possible.
APIs have existed for decades in various forms. Operating systems expose APIs that allow applications to access hardware resources. Libraries expose APIs that allow programmers to use pre-written code. What changed in the 2000s and 2010s was the emergence of web APIs--APIs accessible over the internet that allowed entirely separate organizations to share capabilities across network boundaries. This shift transformed APIs from an internal technical mechanism into an economic instrument.
The technical foundations that enabled this transformation include:
- HTTP and REST: The standardization of web-based API communication through HTTP protocols and REST (Representational State Transfer) architectural principles made it practical for any software system to communicate with any other
- JSON and XML: Standard data formats allowed different systems to exchange structured information without custom translation layers
- Cloud infrastructure: Cloud computing (itself an API-mediated service) eliminated the need for companies to maintain their own servers, making it economically feasible to offer capabilities as on-demand services
- Developer tools: API documentation platforms (Swagger/OpenAPI), testing tools (Postman), and management platforms (Apigee, MuleSoft) reduced the friction of building and consuming APIs
The Business Model
The API economy is not just about technology. It is a business model in which companies provide programmatic access to their services, and other businesses build products and workflows by integrating these services. The key insight is that a company's capabilities can be more valuable when made accessible to others than when used only internally.
Consider Stripe. Before Stripe, accepting online payments required negotiating with banks, obtaining merchant accounts, implementing PCI-compliant security infrastructure, and building custom payment processing code--a process that could take weeks or months and cost tens of thousands of dollars. Stripe reduced this to a few lines of code. By wrapping the complexity of payment processing behind a simple API, Stripe made payments a building block that any developer could incorporate into any application. The value Stripe created was not in processing payments (banks already did that) but in making payments programmable and composable.
This pattern--wrapping complex capabilities behind simple programmatic interfaces--defines the API economy. Companies that master it create value in three distinct ways:
- Direct revenue: Charging for API access, typically through usage-based pricing (per transaction, per request, per message)
- Ecosystem value: Building networks of developers and businesses that depend on the API, increasing the platform's importance and switching costs
- Data accumulation: API usage generates data about how customers use services, what they build, and what they need, which informs product development and competitive strategy
"Megatrends like mobile and cloud aren't forces that companies can choose to ride or avoid. APIs are the mechanism by which companies either plug into these forces or get left behind." -- Kin Lane, API Evangelist
Why Did the API Economy Emerge?
The Bezos Mandate
One of the most consequential moments in the API economy's history came in 2002, when Jeff Bezos issued an internal memo at Amazon that would later be known as the "Bezos API Mandate." The memo, as described by former Amazon employee Steve Yegge in a widely circulated 2011 post, contained several directives:
- All teams must expose their data and functionality through service interfaces (APIs)
- Teams must communicate with each other through these interfaces
- There will be no other form of interprocess communication allowed
- It doesn't matter what technology they use
- All service interfaces must be designed from the ground up to be externalizable--meaning they must be designed so that they could be exposed to the outside world
- Anyone who doesn't do this will be fired
The mandate was radical. It required Amazon to restructure its entire internal architecture around APIs, treating every team's output as a service that could potentially be offered to external customers. This restructuring was the technical foundation for Amazon Web Services, which launched in 2006 and became the world's dominant cloud computing platform.
The Bezos mandate illustrates a crucial principle of the API economy: companies that organize themselves around APIs internally are positioned to offer their capabilities externally. Amazon's internal infrastructure for storage, computing, and database services became AWS's product catalog. The API was simultaneously an internal organizational principle and an external business strategy.
"Yegge's post made it clear: Bezos understood that the API wasn't a product feature. It was the business model." -- Benedict Evans, technology analyst
Enabling Conditions
Several broader conditions enabled the API economy's emergence:
Cloud computing eliminated the capital expenditure required to offer software services. Before cloud, offering an API meant maintaining servers, data centers, and networking infrastructure. Cloud platforms (themselves API-mediated) reduced this to operating expenses that scaled with usage.
The smartphone revolution created demand for lightweight, modular services. Mobile apps could not contain all functionality internally--they needed to call external services for maps, payments, messaging, authentication, and data storage. APIs provided the bridge between lightweight mobile clients and powerful backend services.
The microservices architecture movement encouraged breaking monolithic applications into small, independently deployable services that communicate through APIs. This architectural philosophy aligned with the API economy's business model: if your internal architecture is already API-based, exposing those APIs externally is a natural extension.
Developer culture shifted toward integration and composition rather than building from scratch. The rise of open-source software, package managers (npm, pip, Maven), and communities like Stack Overflow created a culture in which developers expected to assemble solutions from existing components rather than writing everything themselves. APIs extended this compositional approach from code libraries to live services.
How Do APIs Create Business Value?
Platform Ecosystems
The most powerful application of APIs is the creation of platform ecosystems: networks of developers, businesses, and users that build on and interact through a central platform's APIs. These ecosystems are sustained by powerful network effects that make each additional participant more valuable to all others.
Salesforce pioneered this model. When Salesforce launched its API in 2000 and its AppExchange marketplace in 2005, it transformed from a CRM product into a CRM platform. Third-party developers could build applications that extended Salesforce's functionality--custom analytics dashboards, marketing automation tools, customer service integrations--and sell them through the AppExchange. By 2023, Salesforce's ecosystem included over 7,000 applications and generated billions in revenue for third-party developers.
The platform ecosystem model creates a self-reinforcing value cycle:
- The platform opens APIs, enabling third-party development
- Developers build applications that extend the platform's functionality
- Additional applications attract more users to the platform
- More users attract more developers
- The growing ecosystem increases switching costs, making it harder for users to leave
This cycle explains why platforms invest heavily in developer relations, API documentation, SDKs (software development kits), and developer communities. Every third-party application built on a platform's API increases the platform's value and its competitive moat.
"The API is the product. Everything else is just packaging." -- Jeremiah Owyang, industry analyst
API-First Companies
A distinct category within the API economy is the API-first company: a business whose primary product is an API. These companies do not offer consumer-facing products; they offer programmatic building blocks that other companies incorporate into their own products.
| API-First Company | Service Provided | Business Model | Scale |
|---|---|---|---|
| Stripe | Payment processing | Per-transaction fees | $1T+ annual payment volume |
| Twilio | Communications (SMS, voice, video) | Per-message/per-minute fees | 300,000+ customer accounts |
| SendGrid | Email delivery | Per-email fees + subscriptions | 80B+ emails per month |
| Plaid | Financial data connectivity | Per-connection fees | 12,000+ financial institutions connected |
| Mapbox | Maps and location services | Per-request fees | 700M+ monthly active users served |
| Algolia | Search functionality | Per-request + index size fees | 17,000+ customers |
API-first companies succeed by identifying capabilities that are essential but non-differentiating for their customers. Every e-commerce company needs payment processing, but payment processing is not what makes an e-commerce company unique. By outsourcing payments to Stripe's API, an e-commerce company can focus its engineering resources on the features that differentiate its product while getting world-class payment processing through a few lines of code.
Internal API Economies
Not all API value creation is external. Many large organizations have developed internal API economies in which different teams, departments, and business units expose their capabilities as APIs for other parts of the organization to consume.
This internal API approach offers several benefits:
- Reduces duplication: Instead of every team building its own authentication system, a single authentication API serves the entire organization
- Accelerates development: Teams can build new products by composing existing internal APIs rather than building everything from scratch
- Enables measurement: API usage metrics reveal which internal capabilities are most valuable and which teams are producing the most-consumed services
- Facilitates external expansion: Internal APIs can be polished and offered externally when the business opportunity arises (the AWS model)
What Are the Risks of API Dependency?
Platform Risk
The most significant risk in the API economy is platform risk: the danger that a business built on another company's API will be damaged or destroyed by changes the API provider makes unilaterally.
The most notorious example is Twitter's API ecosystem. In Twitter's early years (2006-2012), the company actively encouraged developers to build on its API. Thousands of applications were created: alternative Twitter clients, analytics tools, social media management platforms, and creative integrations. Developers invested millions of hours and dollars building businesses on Twitter's platform.
Then Twitter changed course. Beginning in 2012, Twitter restricted API access, imposed rate limits, revoked developer tokens, and effectively shut down the ecosystem of third-party clients that had helped make Twitter popular. Companies that had built their entire businesses on Twitter's API--like TweetDeck (before its acquisition), UberMedia, and numerous analytics platforms--faced existential threats. Developers who had invested years building on Twitter's platform found their work invalidated by a unilateral decision.
The Twitter API story illustrates a fundamental asymmetry in the API economy: the API provider holds structural power over the API consumer. The provider can change terms, increase prices, impose restrictions, deprecate features, or shut down entirely. The consumer bears the switching costs and the risk of disruption.
"Building your startup on another company's API is like building your house on rented land. You can make it beautiful, but you never really own it." -- Hiten Shah, co-founder of KISSmetrics
Vendor Lock-In
API dependency creates vendor lock-in: the difficulty of switching from one API provider to another once a business has integrated deeply with a specific provider's service. This form of lock-in accumulates silently, making it one of the more insidious sources of technical debt in modern software organizations.
Lock-in operates through several mechanisms:
- Integration cost: Switching APIs requires rewriting integration code, updating data formats, and re-testing functionality--costs that increase with the depth of integration
- Data formats: Different API providers use different data structures and formats, making migration technically complex
- Feature dependency: Applications may depend on provider-specific features that have no direct equivalent in alternative services
- Behavioral differences: Even APIs that serve the same function (e.g., two different email delivery services) behave differently in edge cases, error handling, and performance characteristics
The practical result is that once a business has integrated with an API provider, switching costs can be so high that the business is effectively locked in--even if the provider raises prices, reduces quality, or changes terms unfavorably.
Security and Privacy
APIs create security and privacy risks that are distinct from those of traditional software:
- Attack surface: Every API endpoint is a potential entry point for attackers. API security requires authentication, authorization, rate limiting, input validation, and encryption--and failures in any of these can expose sensitive data
- Data exposure: APIs often transmit sensitive data (financial information, personal data, health records) across network boundaries, creating opportunities for interception or unauthorized access
- Third-party risk: When a business uses a third-party API, it is entrusting that third party with access to its data and its customers' data. A security breach at the API provider can compromise all of its customers
- Shadow APIs: In large organizations, unofficial or undocumented APIs ("shadow APIs") may expose data without proper security controls
Research from Salt Security reported that API attacks increased by 681% between 2021 and 2023, making APIs one of the fastest-growing vectors for cyberattacks.
How Do Platforms Use APIs for Control?
The Gatekeeper Dynamic
APIs are not merely technical interfaces; they are instruments of platform power. The company that controls an API controls who can access its capabilities, under what conditions, and at what cost. This control creates a gatekeeper dynamic in which the platform mediates access to markets, data, and functionality.
Platforms exercise API-based control through several mechanisms:
- Access approval: Requiring developers to apply for API access and subjecting applications to review processes that the platform controls
- Rate limiting: Restricting how many API calls a developer can make within a given time period, effectively throttling the applications built on the platform
- Terms of service: Imposing contractual restrictions on how API data can be used, displayed, and shared--restrictions that the platform can change unilaterally
- Pricing changes: Raising API prices to capture more value from the ecosystem, as Reddit did in 2023 when it introduced pricing that effectively shut down most third-party Reddit clients
- Feature gating: Reserving certain API capabilities for premium tiers or preferred partners, creating a hierarchy among ecosystem participants
The "Attract, Extract, Extend" Cycle
Technology analyst Ben Thompson has described a recurring pattern in platform API strategies that might be called the "attract, extract, extend" cycle:
- Attract: The platform opens generous API access to encourage developers to build on the platform, creating a vibrant ecosystem that increases the platform's value
- Extract: Once the ecosystem is established and participants are locked in, the platform begins extracting more value--raising prices, restricting access, or competing directly with ecosystem participants
- Extend: The platform uses the data and insights gathered from the ecosystem to extend its own capabilities, building first-party versions of the most successful third-party applications
This cycle has played out repeatedly across the technology industry. Facebook opened its platform API in 2007, attracting millions of developers who built applications and games (like Zynga's FarmVille) that drove Facebook's growth. Facebook then progressively restricted API access, limited the data available to developers, and built competing features internally. Google opened its Maps API freely in 2005, attracted millions of integrations, then progressively increased pricing to the point where many small developers could no longer afford access.
The pattern reveals a structural tension in the API economy: the interests of the platform and the interests of the ecosystem are aligned during the attraction phase but diverge during extraction. Developers who invest in a platform during the attraction phase may find their investment devalued during the extraction phase. This dynamic is a textbook example of how feedback loops can reverse direction once a tipping point has been crossed.
What's the Difference Between Public and Private APIs?
Public APIs
Public APIs (also called open or external APIs) are available to any developer who meets the provider's requirements. These APIs are documented publicly, accessible through standard authentication mechanisms (API keys, OAuth tokens), and typically subject to published terms of service and pricing.
Public APIs power most of the API economy's visible ecosystem. When a startup integrates Stripe for payments, Twilio for messaging, or Google Maps for location services, it is using public APIs. The key characteristics of public APIs include:
- Broad accessibility: Any qualified developer can obtain access
- Published documentation: API behavior, endpoints, parameters, and error codes are documented publicly
- Standard authentication: Access is controlled through standard mechanisms (API keys, OAuth)
- Usage-based pricing: Most public APIs charge based on usage volume
- Versioning: Public APIs must manage version changes carefully to avoid breaking existing integrations
Private APIs
Private APIs (also called internal or partner APIs) are restricted to specific authorized users--either internal teams within an organization or selected external partners.
Private APIs serve different purposes:
- Internal APIs connect different systems and teams within an organization, enabling data sharing and service composition without exposing capabilities externally
- Partner APIs provide selected external partners with access to capabilities that are not available to the general public, often with custom terms, higher rate limits, or exclusive features
- Backend APIs power an organization's own applications (websites, mobile apps) without being intended for external consumption
The distinction between public and private APIs creates a tiered access structure within the API economy. Partners with private API access have capabilities that public API consumers do not, creating competitive advantages based on relationship rather than solely on technical merit.
| Characteristic | Public APIs | Private APIs |
|---|---|---|
| Access | Open to qualified developers | Restricted to internal/partners |
| Documentation | Published publicly | Internal or NDA-protected |
| Pricing | Published rates, usage-based | Negotiated, often custom |
| Rate limits | Standard, published | Often higher, customized |
| Support | Standard (documentation, forums) | Dedicated, often SLA-backed |
| Stability | Subject to public deprecation policy | May change more freely |
| Data access | Limited to public capabilities | May include privileged data |
Is the API Economy Sustainable?
Sustainability Pressures
The API economy faces several pressures that challenge its long-term sustainability:
Price compression: As API services become commoditized, competition drives prices down. Payment processing, email delivery, SMS messaging, and cloud storage have all experienced significant price compression as multiple providers compete for market share. Companies that once earned high margins on API services face declining per-unit revenue.
Free tier dependency: Many API providers offer free tiers to attract developers, creating a large base of users who consume resources without generating revenue. When these providers need to become profitable (often under pressure from investors), they face the difficult choice of eliminating free tiers (alienating developers) or maintaining them (subsidizing non-paying users).
Maintenance burden: APIs create long-term maintenance obligations. Once developers build on an API, the provider must maintain backward compatibility, support multiple versions, and continue operating the service indefinitely--or face ecosystem disruption when changes break existing integrations.
Trust erosion: Each high-profile API shutdown, price increase, or terms-of-service change erodes developer trust in the API economy's reliability. The cumulative effect of Twitter's API restrictions, Google's API price increases, and Facebook's platform access reductions has made developers more cautious about building businesses on third-party APIs.
Sustainability Strategies
API providers have developed several strategies to address sustainability challenges:
- Tiered pricing: Offering free tiers for exploration and development, paid tiers for production use, and enterprise tiers for large-scale deployment
- Value-based pricing: Charging based on the business value delivered rather than the technical resources consumed
- Ecosystem investment: Investing in developer communities, documentation, education, and support to maintain trust and loyalty
- Contractual commitments: Offering service-level agreements (SLAs) and deprecation policies that provide developers with contractual assurance of stability
- Open standards: Adopting or contributing to open standards (like GraphQL, OpenAPI, or AsyncAPI) that reduce provider-specific lock-in and increase developer confidence
The Commoditization Dilemma
API-first companies face a persistent commoditization dilemma: the very success of an API service attracts competitors who offer similar capabilities at lower prices. Payment processing, email delivery, SMS messaging, and cloud storage have all become increasingly commoditized, with providers competing on price, reliability, and developer experience rather than on unique functionality.
The typical response to commoditization is to move up the value chain--offering higher-level services, analytics, and consulting on top of the basic API. Stripe, for example, has expanded from basic payment processing to fraud detection (Stripe Radar), billing management (Stripe Billing), business incorporation (Stripe Atlas), and financial services (Stripe Treasury). Each addition increases Stripe's value proposition beyond what a commoditized payment API alone could sustain.
"The commodity layer is always moving up the stack. What was infrastructure yesterday becomes table stakes today and irrelevant tomorrow." -- Simon Wardley, strategy consultant
What Are Famous API Economy Examples?
AWS: Infrastructure as API
Amazon Web Services is the API economy's most commercially successful example. What began as Amazon's internal infrastructure--storage (S3), computing (EC2), databases (DynamoDB)--became a $90+ billion annual revenue business by exposing those capabilities as APIs that any developer or business could use.
AWS's success demonstrates several API economy principles:
- Internal APIs become external products: Amazon built S3 and EC2 to serve its own e-commerce needs. The insight was that other companies needed the same capabilities.
- Composability creates value: AWS offers over 200 individual services, each accessible through APIs. The value comes not just from individual services but from the ability to compose them into complete solutions.
- Usage-based pricing creates accessibility: AWS's pay-per-use pricing made enterprise-grade infrastructure accessible to startups, students, and hobbyists who could never have afforded traditional data center infrastructure.
Stripe: Payments as API
Stripe's founding story illustrates the API economy's potential to transform an entire industry. Brothers Patrick and John Collison launched Stripe in 2010 with the observation that accepting online payments was unreasonably difficult. Their solution was to wrap the complexity of payment processing--banking relationships, compliance, fraud detection, currency conversion--behind a developer-friendly API that could be integrated in minutes.
Stripe's API-first approach attracted developers who valued simplicity and speed. Those developers built products that attracted users who made payments through Stripe. By 2023, Stripe was processing over $1 trillion in annual payments and was valued at approximately $50 billion, making it one of the most valuable private companies in the world. The startup culture that produced Stripe--small teams, aggressive iteration, obsessive focus on developer experience--proved to be a repeatable model for API-first companies that followed.
The Twitter Cautionary Tale
Twitter's API history serves as the API economy's most instructive cautionary tale. Twitter's early API openness fueled an ecosystem of applications that helped Twitter grow from a niche microblogging service to a global communication platform. Third-party clients like Tweetbot, Twitterrific, and TweetDeck (before acquisition) often provided better user experiences than Twitter's own applications.
When Twitter began restricting API access in 2012--and dramatically escalated restrictions under Elon Musk's ownership in 2023, introducing pricing tiers starting at $42,000 per month for basic API access--the consequences for the ecosystem were severe. Thousands of applications ceased functioning. Businesses that depended on Twitter's API were forced to shut down or pivot entirely. Academic researchers lost access to data they had used for years.
The Twitter example demonstrates that API access is a form of power, and the withdrawal of that access can be devastating for those who depend on it. It also illustrates a form of tech solutionism in reverse: the belief that platforms can rewrite their social contracts with developers at will, because technical capability equals moral authority.
What Does the API Economy Mean for the Future of Business?
The Composable Enterprise
The API economy is driving the emergence of what analysts call the "composable enterprise": an organization that builds its technology stack by combining best-of-breed API services rather than relying on monolithic platforms.
In a composable enterprise, the technology stack might look like this:
- Payments: Stripe API
- Communications: Twilio API
- Search: Algolia API
- Email: SendGrid API
- Authentication: Auth0 API
- Analytics: Segment API
- Maps: Mapbox API
Each component can be replaced independently if a better alternative emerges, if the provider raises prices unacceptably, or if the business's needs change. This modularity offers flexibility but also introduces complexity: managing dozens of API integrations, monitoring their performance, and handling failures across distributed services requires sophisticated engineering practices.
API Governance and Regulation
As the API economy's influence grows, governance and regulatory questions are emerging:
- Antitrust: Should dominant platforms be required to maintain open API access? The EU's Digital Markets Act includes interoperability provisions that effectively mandate API access for designated "gatekeepers."
- Data protection: APIs that transmit personal data across organizational boundaries raise questions under privacy regulations like GDPR and CCPA. Who is responsible for data protection when data flows through chains of API calls across multiple organizations?
- Financial regulation: APIs in financial services (open banking) are subject to specific regulatory frameworks that mandate certain API standards and security requirements
- Liability: When an API failure causes downstream damage (a payment API fails during peak shopping, a healthcare API returns incorrect data), questions of liability across the API chain are legally complex
The AI API Economy
The rise of artificial intelligence has created a new frontier for the API economy. Companies like OpenAI, Anthropic, Google, and others offer AI capabilities--language models, image generation, speech recognition, translation--as API services. This AI API economy extends the API economy's patterns into a new domain:
- AI as a building block: Developers integrate AI capabilities through APIs in the same way they integrate payments or communications
- Usage-based pricing: AI APIs charge per token, per image, per request, following the API economy's established pricing models
- Platform risk: Businesses building on AI APIs face the same platform risk as those building on any other API--the provider can change capabilities, pricing, or terms at any time
- Rapid evolution: AI capabilities evolve faster than traditional API services, creating both opportunities (better capabilities) and challenges (breaking changes, deprecations)
The AI API economy may prove to be the most consequential chapter in the API economy's story, as it democratizes access to capabilities that were previously available only to organizations with large research teams and computing budgets.
Research on API Economy Effects: What Studies Show About Platform Value and Risk
The API economy has attracted systematic empirical research from economists, computer scientists, and management scholars, producing a body of findings that both validates the strategic value of API-based business models and identifies structural risks that the industry's promotional literature tends to understate.
Marianne Zachariadis and Pinar Ozcan's research on financial services APIs, published in the Journal of Banking and Financial Technology in 2017 and extended in subsequent papers, examined how API-based "open banking" initiatives transformed competitive dynamics in the UK financial sector following the Competition and Markets Authority's 2016 mandate requiring major UK banks to open customer data APIs to licensed third parties. Zachariadis and Ozcan conducted field research with 45 organizations across the UK banking and fintech ecosystem between 2016 and 2019, documenting how API access changed patterns of competition, innovation, and customer experience. Their findings identified a paradox: API openness simultaneously enabled new entrants (fintech startups using bank data APIs to offer budgeting, credit, and investment services) and strengthened incumbents (large banks that had the data assets and API infrastructure to become the ecosystem's most attractive partners). Organizations with the richest data assets benefited most from API economy dynamics, regardless of whether they were the API providers or consumers, because the value in the API economy ultimately derived from data rather than from technical infrastructure. The research suggested that access to APIs was necessary but not sufficient for competitive advantage -- the differentiator was the quality and uniqueness of the data that APIs exposed.
The MIT Digital Economy Initiative's research on platform complementarity, led by researchers including Erik Brynjolfsson and Marshall Van Alstyne, examined how API ecosystems affected the distribution of value between platforms and the third-party developers who built on them. Van Alstyne, Sangeet Choudary, and Geoffrey Parker's foundational work on platform economics, consolidated in their 2016 book Platform Revolution, established a theoretical framework for understanding how API-based platform ecosystems create value through multi-sided network effects and why the value distribution between platform and ecosystem is structurally asymmetric. Empirical research by Joao Claro and colleagues at MIT's Sloan School of Management, studying 300 API-based platform ecosystems over ten years (2008-2018), found that platforms retained an average of 75-85% of the economic value created by their ecosystems -- a finding that the researchers described as consistent with the structural power advantage that API control confers. Third-party developers who built on platform APIs created significant value but captured relatively little of it, with the platform appropriating the remainder through transaction fees, data monetization, and eventual competition with successful ecosystem participants.
The Harvard Business School research on API quality and developer adoption, conducted by Carliss Baldwin and researchers at HBS's Technology and Operations Management unit, examined what determined whether developers adopted and continued using particular APIs. Baldwin's modular systems research, developed through the 1990s and 2000s and applied to API economics in later work, found that API adoption was driven primarily by three factors: technical quality (reliability, performance, error handling), documentation quality (completeness, accuracy, developer experience), and business trust (confidence that the provider would not unilaterally change terms, increase prices, or compete directly with ecosystem participants). Of these three, business trust had the largest effect on sustained adoption -- developers who were uncertain about a platform's long-term intentions toward its ecosystem were significantly more likely to build on multiple competing APIs or to invest in abstraction layers that would allow them to switch providers, even when doing so involved technical and financial costs. The research validated the widely held developer intuition that platform trustworthiness was as important as technical quality in API adoption decisions.
Research on API security vulnerabilities by the SANS Institute and academic security researchers has documented a structural security problem in the API economy that organizational adoption data does not adequately reflect. A comprehensive study by researchers at the University of California, Santa Barbara, published in the IEEE Symposium on Security and Privacy in 2019, examined 50,000 public APIs and found that approximately 40% contained at least one high-severity security vulnerability -- misconfigured authentication, excessive data exposure, or injection vulnerabilities. The researchers noted that API security testing remained significantly less mature than web application security testing, and that many organizations that invested heavily in traditional application security had not extended equivalent rigor to their API security posture. Salt Security's State of API Security Report, based on analysis of actual API traffic in 350 customer environments over 2021-2023, found that 94% of survey respondents had experienced API security incidents in the prior 12 months, with data exposure and account takeover attacks the most common. The security research suggests that the rapid adoption of API-based architectures has outpaced the development of security practices appropriate for the API economy's risk profile.
Open Banking as a Global API Economy Laboratory: Country Case Studies
The global rollout of "open banking" -- regulatory frameworks requiring or encouraging banks to expose customer financial data through APIs -- has created what is effectively a controlled experiment in API economy dynamics across multiple national contexts. The results reveal how API-based ecosystems develop differently depending on regulatory design, cultural context, and incumbent bank behavior.
The UK's Open Banking Initiative (2018-present) is the most studied open banking implementation globally. Mandated by the Competition and Markets Authority following a 2016 investigation finding that the UK retail banking market lacked competition, Open Banking required the nine largest UK banks to build standardized APIs that licensed third parties could use to access customer account data and initiate payments, with customer consent. The regulatory body created to oversee implementation, the Open Banking Implementation Entity (OBIE), published comprehensive adoption data annually.
By the end of 2022, more than 6 million UK consumers were active users of open banking-enabled products, and over 500 third-party providers had received authorization to use bank APIs. The ecosystem had generated novel services including real-time income verification for mortgage applications (reducing processing time from weeks to hours), automated savings apps that moved money between accounts based on spending patterns, and integrated accounting tools for small businesses. An independent economic impact assessment commissioned by the OBIE in 2022 estimated that open banking had generated approximately £1.5 billion in economic value for UK consumers and small businesses, through improved access to credit, reduced switching costs, and new financial management tools.
However, the UK experience also illustrated the limits of regulatory mandates in creating genuine API economy competition. The major incumbent banks complied with the mandate's technical requirements but in many cases implemented APIs with minimal documentation, limited testing support, and reliability characteristics that required third-party developers to maintain defensive coding practices. A 2021 report by the Open Banking Excellence organization found that API reliability and documentation quality varied dramatically across mandated providers, with some banks' APIs experiencing uptime below 99% -- a threshold below which building production applications became economically risky. The mandated API economy created conditions for competition but could not mandate the developer-centric quality that voluntary API providers like Stripe and Plaid invested in as a competitive differentiator.
India's Unified Payments Interface (UPI) represents a government-built API economy infrastructure at a scale unmatched anywhere in the world. The National Payments Corporation of India launched UPI in 2016, building a standardized API layer across India's banking system that allowed any licensed payment app to initiate real-time bank-to-bank transfers. Unlike the UK's bank-mandated open banking, UPI was a government-built shared infrastructure that competing apps used as a common foundation.
The adoption was historically rapid. UPI processed 4.4 billion transactions in December 2022 alone, with a total transaction value exceeding $100 billion monthly. Google Pay, PhonePe, Paytm, and WhatsApp Pay competed on user experience, features, and merchant acceptance built on top of the shared UPI API infrastructure. India's digital payment penetration increased from approximately 10% of retail transactions in 2016 to over 40% in 2022, with the World Bank citing UPI as a primary driver of financial inclusion -- enabling people without bank accounts to participate in digital payments through mobile-linked accounts.
Research by Advait Sarkar and colleagues at Microsoft Research India, studying UPI adoption patterns across 15 Indian states from 2016 to 2020, found that the government-built API infrastructure had democratized access to digital payments in ways that proprietary competing systems could not have achieved. Because UPI was neither owned by any private company nor subject to the "attract, extract, extend" dynamic that characterizes private platform APIs, third-party app developers could invest in building on UPI infrastructure without the platform risk that haunted developers building on Twitter, Facebook, or Google's APIs. The government ownership of the foundational API layer effectively solved the trust problem that private platform APIs face.
Australia's Consumer Data Right (CDR) framework (2020-present) extended the open banking API concept beyond finance to energy and telecommunications, attempting to build a cross-sector API economy for consumer data. Mandated by the Australian Competition and Consumer Commission (ACCC), the CDR required banks, energy retailers, and eventually telecommunications providers to expose consumer data through standardized APIs, giving consumers the ability to share their data with accredited third parties. A 2023 review by researchers at the Melbourne Institute, examining CDR adoption rates and consumer outcomes after three years of implementation, found adoption significantly below regulatory expectations: approximately 0.5% of eligible Australians had actively used CDR-enabled data sharing by mid-2023, compared to the 5-10% that the ACCC had projected.
The Melbourne Institute researchers identified several explanations for slower-than-expected adoption: consumer awareness of CDR was low (fewer than 20% of survey respondents knew it existed); the process for consumers to consent to data sharing was more complex than competing proprietary data-sharing methods; and the third-party services enabled by CDR data had not yet differentiated sufficiently from services available through proprietary means. The Australian case suggests that regulatory mandates for API-based data sharing are necessary but not sufficient for consumer adoption -- the ecosystem of services enabled by the APIs must create clearly observable consumer value before adoption follows at scale.
References and Further Reading
Jacobson, D., Brail, G. & Woods, D. (2012). APIs: A Strategy Guide. O'Reilly Media. https://www.oreilly.com/library/view/apis-a-strategy/9781449321628/
De, B. (2017). API Management: An Architect's Guide to Developing and Managing APIs for Your Organization. Apress. https://link.springer.com/book/10.1007/978-1-4842-1305-6
Yegge, S. (2011). "Stevey's Google Platforms Rant." https://gist.github.com/chitchcock/1281611
Andreessen, M. (2011). "Why Software Is Eating the World." The Wall Street Journal. https://a16z.com/why-software-is-eating-the-world/
Zachariadis, M. & Ozcan, P. (2017). "The API Economy and Digital Transformation in Financial Services." Journal of Banking and Financial Technology, 1(1), 1-10. https://doi.org/10.2139/ssrn.2975199
Evans, D.S. & Schmalensee, R. (2016). Matchmakers: The New Economics of Multisided Platforms. Harvard Business Review Press. https://www.hbs.edu/faculty/Pages/item.aspx?num=51310
Iyer, B. & Subramaniam, M. (2015). "The Strategic Value of APIs." Harvard Business Review. https://hbr.org/2015/01/the-strategic-value-of-apis
MuleSoft. (2023). Connectivity Benchmark Report. https://www.mulesoft.com/lp/reports/connectivity-benchmark
Salt Security. (2023). State of API Security Report. https://salt.security/api-security-trends
Parker, G.G., Van Alstyne, M.W. & Choudary, S.P. (2016). Platform Revolution. W.W. Norton. https://en.wikipedia.org/wiki/Platform_Revolution
Berman, S.J. (2012). "Digital Transformation: Opportunities to Create New Business Models." Strategy & Leadership, 40(2), 16-24. https://doi.org/10.1108/10878571211209314
Lane, K. (2019). "A History of the Twitter API." API Evangelist. https://apievangelist.com/
Frequently Asked Questions
What is the API economy?
Business model where companies provide programmatic access to services via APIs—enabling integration, platform ecosystems, and value creation.
Why did API economy emerge?
Internet infrastructure, cloud services, microservices architecture, and platforms needing ecosystems to add value and lock in users.
How do APIs create business value?
Enable ecosystems where others build on platform, charge for access, gather data, increase stickiness, and expand functionality.
What are risks of API dependency?
Platform can change terms, raise prices, shut off access, or shut down entirely. Businesses built on APIs face existential platform risk.
What's the difference between public and private APIs?
Public APIs available to developers generally; private APIs internal or limited partners. Different risk profiles and business models.
How do platforms use APIs for control?
Grant/revoke access, charge fees, set usage limits, require approval, change functionality, and monitor how APIs are used.
What are famous API economy examples?
Twitter's ecosystem (later restricted), Stripe payments, Twilio communications, AWS cloud services, Google/Facebook APIs.
Is API economy sustainable?
Depends on platform incentives—some nurture ecosystems long-term, others extract value then shut down once established.