Introduction

Hello! 👋

This week, I'm running a quick poll on LinkedIn asking technology decision-makers like you: How high a priority is managing access to AI models for your organisation?

If you're a decision-maker, please take a minute to share your perspective here. You'll also see the results so far after voting. The poll is only open for two weeks, so please share your thoughts soon!

In this issue, I delve into what I call 'conceptual API toolkits.' To enhance the rigour of my writing, I'm experimenting with including supporting external references as a comma-separated list of links within parentheses, like this: (link1, link2). I've used this format in the ‘Reviewing Conceptual API Toolkits‘ article below – please let me know what you think of it.

I also cover an API exploration tool we recently evaluated, some noteworthy AI gateways, and, as usual, present useful API governance-related links.

Enjoy!

Reviewing Conceptual API Toolkits

In the last issue of this newsletter, I discussed the rationale behind my API governance toolkit (the IGT-API), the problems it aims to solve, its target audience, and its components.

The next thing I want to discuss are the principles and values of my toolkit. But before discussing that, I want to take a step back and survey some other publicly available API governance, management and strategy frameworks, methodologies, and checklists. I will use the term conceptual API toolkits (CAT) to refer to these. 

Why do I want to do this? My clients are technology decision makers who are responsible for an API products’ target operating model. This operating model touches on API governance, management, and strategy. Therefore, surveying the range of helpful tools available is useful for assisting them in their work, and it also helps position my toolkit within this landscape.  

First, I'll explain some key terms I use.

First is the API products’ target operating model (ATOM). Sometimes I have called this an API delivery operating model (ADOM). I am still trying to harmonise my terms for this. I define this as a visualisation of the people, capabilities, value delivery chain, technology, and scorecards required to operationalise and govern the implementation of an enterprise API strategy. Applying the target operating model concept to API products was discussed extensively by Luis Weir. He used the term  API products’ target operating model, so I am tempted to stick to that instead of ADOM. (Besides, the acronym ATOM sounds quite nice). 

Next is API governance. This is principally about defining two things. The first is a set of policies, standards, guidelines, and regulatory constraints guiding the design, development and operation of APIs. Secondly, the roles involved, their decision rights and  responsibilities (Goog1, Brajesh1, DigitalML1).

The next term is API management. API management is the process for the implementation, enforcement, and day-to-day operation of APIs. It includes the processes involved in the the design, development, deployment, monitoring, analytics and lifecycle management of APIs (DigitalML2, Mathijssena1, Brajesh1).  API management can have technology solution components to it but is not just about a technology solution - it also includes the processes and practices for API delivery. (Aside: I think it is important to separate API management technology platforms from the broader concept of API management.)

And finally there is API strategy. API strategy is the high-level plan for using APIs to meet a business challenge (SoftwareAg1, Jacobson1, Amundsen1). This challenge may be commercial goals like revenue and operational efficiency improvements, but also things like driving innovation, improving agility, enabling partner and customer integration, and creating new business models. 

These concepts are all interrelated. API management operationalises the API strategy within the constraints of the API governance standards. At the intersection of where API governance, management, and strategy come together, is the API products’ operating model, as shown in the figure below. 

Now that I have defined the terms I’ll be using, let me go back to survey some publicly available CATs. Interestingly, the first CAT I will look at is not an API-specific framework, but a cybersecurity framework. API security is a subset of cybersecurity so although the framework is aimed at cybersecurity risks, it can still be applied, very helpfully, to APIs. And as I will show you later, many API security vendors use the framework to do just that. 

Unfortunately, I have run out of time for this newsletter issue without getting to the main topic! So I’ll continue the discussion and talk about the framework next week. 

Tools

This week, at Ikenna Consulting we evaluated Karate Xplorer - Karate’s API client for API exploration. The full report and rating score for the tool is available to our clients. But here is an overall summary of what we liked about it. We liked its speed as a local-first explorer, its slick side-by-side UI, interactive JSON grid, support for before & after scripting, environment switching, request chaining, and built-in MCP for AI integration. The ability to export API requests to the Karate DSL is a nice addition.

Speaking of tools we are evaluating, here are some AI gateways we are looking at.

Higress is Alibaba’s open source AI gateway (5.1K GitHub stars) designed for cloud-native environments. It supports a wide range of LLM providers, and an MCP marketplace.

LiteLLM is an open source AI gateway (21.3K GitHub stars), that provides a unified interface mimicking the OpenAI format, and supports many LLM APIs (including Azure, Bedrop, Anthropic, and Cohere). It also supports cost optimisation, switching between models and managing access.

Interesting Content for this Week

API Governance and Delivery

OpenAPI: How to Handle File Management: Lorna Mitchell discusses managing OpenAPI files, components and file structures.

The Flywheel Effect of API Reuse Karl Fankhauser writes about the benefits of API reuse.

On Runtime AI governance

Jentic’s Open Agentic Knowledge Repository (89 GitHub stars): This project aims to “collate all knowledge about all the world's APIs into a communal, detailed, comprehensive, structured documentation catalog designed for use by AI. This allows AI to accurately generate API integration code, and it allows agents to plan and interact with APIs reliably, without intermediaries“. The project manifesto is described here. One to watch.

What Is an AI Gateway: Differences from API Gateway: API7.ai’s Yilia Lin discusses API gateways, AI gateways and MCP. I like the way she classifies AI gateways into purpose-built AI gateways and evolved API gateways. She predicts that standalone AI gateways will decline as they try to compete with evolved API gateways. Interesting read.

AI Gateways and Their Trend in 2025: Srishty provides insights into AI gateways, covering their distinction from API gateways, their importance, and the anticipated trends for 2025.

Breaking down the real cost factors behind generative AI: Portkey’s Drishti Shah discusses the costs inherent in deploying generative AI, and suggests using FinOps for cost optimisation and accountability.

Comparing AI API Gateways: This article by Moesif (the API analytics and monetisation platform) compares leading AI gateways highlighting their functions such as advanced model routing, latency management, and specific observability functionalities designed for AI traffic.

Meet Kagent, Open Source Framework for AI Agents in Kubernetes: Heather Joslyn introduces Solo.io’s Kagent, an open source framework for managing AI agents in Kubernetes. There is also a blog post about contributing Kagent to CNCF here.

API is MCP | Higress launches MCP Marketplace to accelerate legacy APIs into the MCP era: Alibaba’s Higress launches its MCP Marketplace, positioning itself as a "vertical player" focusing on enterprise needs.

Upcoming API Conferences

API Conference London: The Conference for Web APIs, API Design and Management. Date May 14th, 2025. Location: Park Plaza Victoria London, London, United Kingdom. I’ll be speaking on Evolving API Governance in the Age of AI.

Postman's annual user conference: POST/CON 25. Date: June 3rd & 4th 2025, Location: JW Marriott Los Angeles L.A. Live, Los Angeles, CA Register Here

APIdays Helsinki: Theme: “APIs for Innovation, Intelligence, and Impact” Date: June 3rd & 4th 2025. Location: Pikku-Finlandia, Helsinki Register Here. I will be speaking on ‘Beginning Lean API Governance (with some AI help)’.

APIdays Germany: Theme: “Accelerate AI Use Cases with APIs” Date: July 2nd & 3rd, 2025. Location: Smartvillage Bogenhausen, München, Germany. Register Here

APIdays London: Theme: “No AI Without APIs” Conference Date: September 22nd - 24th, Location: Convene 155 Bishopsgate, London EC2M 3YD

API Governance Consulting

I appreciate your feedback. Please help me improve this newsletter by filling out this 1 minute survey. If you find my newsletter useful, please forward and share it with a friend.