Submind YouTube summaries
Thumbnail for The Death of API Management. Welcome to the Funeral | apidays India 2026

The Death of API Management. Welcome to the Funeral | apidays India 2026

Watch on YouTube

Video summary

The talk titled "The Death of API Management" frames the current industry shift as the funeral of traditional practices, arguing that the rise of AI agents is transforming rigid API management into a more fluid discipline known as context management. While the original API mindset was pioneered by figures like Jeff Bezos to create externalizable services and drive company valuations, this era is evolving because autonomous agents now require intent-based planning rather than simple request-response orchestration. In this new landscape, APIs are relegated to handling deterministic execution layers, while AI agents manage probabilistic planning, necessitating a move away from raw endpoint exposure toward capability registries and micro-contexts that provide the right information at the right time. This transition is further driven by the emergence of specialized tools designed specifically for Large Language Models, distinct from classic gateways that struggle with new challenges like prompt injection, hallucinations, and token consumption. Consequently, key performance indicators are shifting from requests per second to metrics such as tokens per second and cost per task, effectively rendering traditional KPIs obsolete. The architectural response involves splitting organizations into separate teams for API and AI gateways or integrating them differently, with agents becoming the primary developer experience. As traditional management dissolves like sugar in tea, its core principles of identity, authorization, and governance persist but are now embedded within this broader framework of context engineering. To navigate this evolving security landscape, the speaker highlights specific solutions that address the limitations of legacy tools against complex LLM-related attacks such as Broken Object Level Authorization and business logic exploits. True Foundry is recommended as a pure-play AI gateway that can coexist with existing infrastructure, while other options like Portkey and Standway are noted for their decoupling efforts and compliance capabilities. The discussion emphasizes that current security measures are insufficient for the new threats posed by generative AI, requiring a complete departure from legacy approaches to adapt to this "new world" or ocean of governance. Ultimately, the industry must adopt completely different strategies to secure these probabilistic systems, ensuring that security evolves alongside the rapid advancements in artificial intelligence rather than relying on tools that have not yet adapted to these new realms.
Read the full video transcript
Uh so it's my honor to welcome uh Medi. Uh he is I'm sure you know about his background. Uh you created a startup uh when you were 27 I believe. >> Yeah. A long time ago. [laughter] >> Uh Oth at >> O at that time. uh and uh of course sold the startup and doing a lot of interesting work now. Uh but what I really like interacting with Medi is he's a deep thinker. So you can pick any topic with him and you can go uh pretty deep philosophical practical uh lots of uh experience. So it's always fun to kind of uh spend time interact with him and uh the topic today he has and I think he gave a little brief in the pre-conference that we had that uh this is going to mix like sugar and disappear but I'd let I'll not steal the show I'll let you kind of continue. So thanks again Mary for joining us >> and thank you Narish. >> Please welcome him. Yeah, [applause] thank you very much Nares because actually as I organize the EPA conferences most of the time I don't speak in these conferences again my role is to put everyone uh under the light right and not be under the light but narish you ask me so thank you very much for for that and that gave me the opportunity to share actually what a lot of things that I'm seeing in the in the in the space so again you know since the uh the chat GPT like three you know over the I almost two years three years sorry uh four years wow that goes fast no but almost four years a lot of things have changed in the API industry space have changed a lot right we've seen many vendors that are actually completely who have been who have feared a lot what was happening a lot of developers architect that are completely you know changing the way they're they're they're uh working their the jobs are changing so yeah I just wanted to share you a little bit what I've what I'm seeing really strongly over the 18 months right and so a little it's a little bit provoking but uh as I I created the API conferences series 14 years for for 14 years ago uh more than 100 conferences I wrote two books on APIs and API management I I did consulting on API management I made a company a startup that I sold so I'm I'm leaving API management over the last 15 years right and today I may I may do the I may do the uh the conclusion that yes uh we may assist to the death of API management and maybe today is the funeral. So, welcome to the funeral of the AP of of API management. So, uh yeah, 20206 26 we will see. Uh actually the 2000 I'm not completely sure you know uh uh I I relate to Nares what he said about Jeff Bezos mandate which is to 2002. Uh but the 2026 I have a feeling that's we're close right we're really close. So for the people who may have a call or may leave the room will management is up here. Yes. Okay. Talk is over. But if you want more details you can stay. You you can stay to know exactly when I'm saying that. So this is me uh you know uh wrote two books on API management. Actually there will be a book signing at 10:30. We have 100 books to to give away. Uh and yes I created APIs conference series. I created the O.io developer tool and startups and also conferences about AI. Right. Also currently I launched a new startup. We raised some money to build a bunny. So Bunny is just a few words but it enables humans and agents to ship full application directly on discord slack or teams right it's fully open source and actually what you do you use the slack you use the the chat as the context layer to uh to uh to mix between humans and agents and also you can stream and remote control a full um a terminal full shell and you can set up a full VM so it's humans and agents controlling a full dev environment. You you SSH connect and then you are able to fully work humans and agent together, right? So you can test bunny and cloud. Uh if you love pens like me, you you'll get it. Okay. So API management from birth to life, right? From birth to life. So actually the birth it's funny because we didn't plan that for me. The birth of the concept of API management was the Jeff Bezos mandate. You know, I just copy and paste here uh what he said. But I love the fact that it doesn't use the term API. He used the term service interfaces. Right? So the term API is has been there. The first time it was coined, it was 1968, right? It was at the mother of all conferences. So that was the first time the the the application to the interface to program application was was mentioned, right? 1966. But it was a technical term, right? Jeff Bezos is not a he understand computer science, but he's not an architect or whatever, at least by job definition. But he used the term service interfaces because it's all about interfaces. And what I really like in this is that of course team must communicate with each other through these interfaces. This is what he claimed. But there are really two sentences I really I really love. It doesn't matter what technology they use, right? So API is not a technology, you know, just an interface to access to a system. It's not rest JSON, it's not soap, XML, it's not gpc, it's not graphql. It's the interface that matter. As long as an interface to program the application, that's fine. you know we will manage it out right of course some protocols and some technologies are enabling to do it faster better cheaper but yeah doesn't matter about the technology the second one I really love is that the other one like all interfaces all service interfaces without exception must be designed from the ground up to be externalizable so he understood first the concept of the exposure of APIs to people you may not know in organization right so that's 15 years later we call API as a product Right? The fact that you will not integrate APIs, which is really a technical term, you will consume APIs. They are so sweet, so nice, so well designed, so well documented. You consume them, you don't integrate them. It's the same thing. But, you know, it's just a mindset here. So, he was pushing that mindset uh directly, right? So, and then there's a governance aspect. So, anyone who doesn't do this will be fired. That's the governance. So, but he understood that since the beginning, right? So for me that's really the start of API the API management mindset because now if every service in organ in an organization has an interface that you can talk to so you can decouple the interface from the service. So you can the service can evolve but not the interface you know vera vogels the CTO of AWS say APIs are forever code can change but APIs are forever right you know so then you can manage all the traffic all the interaction between applications you can manage versions just using the interface so because of that mindset the API management mindset and practice arise right you know managing what's going on from interface to interface right and actually it works So Amazon is a growing really great company AWS is thriving but actually Marshian von Alstein who is a researcher at the Boston University he made a study over 200 companies over $2 billion valuation so not just tiny small businesses uh but at least $2 billion valuation and he compared from industry company who have a strong API initiative and strong API management practice versus company who don't have yet a strong API management practice practice and so he called it how API create growth by inverting the firm because what he claimed is that when you put an API on top of a service you make it discoverable you make it self-service you know if you document it well and everything you know you can it can reach its maximum capacity and output right you know because people will discover self-service integrate or consume and then you know you don't have to promote it uh so it can it has full full reach right internally or externally with partners with developers of of the world, right? So, and in this paper he has this graph that is really interesting. So, he compared these 200 companies, you know, and industry per industry, right? And he has this log function which is the market value versus the quarter relative to API adoption, right? So, this is the API adoption signal here. and you can see a a decoupling for or for the first quarter you don't see a big decoupling but you see a decoupling after right so when I met him because he spoke at one API conferences I asked him like is it because they had good API management practice that they thrived or is it because they were thriving that they had to adopt API management capabilities to sustain right that's that that so he told me this chicken problem is not solved but at least there is a strong correlation you know there is strong correlation not position but strong correlation. [sighs] So what he found after two years company who have a strong API management practice in average have 12% higher valuation $2 billion in minimum that's that's few hundred million of valuation right 38% extra growth over 16 years you know he conducted a study over a long time again so it works right the API management mindset worked Amazon Jeff Bezos started the idea but company who have implemented actually made it work and in the paper He continues and you can see that if you check revenues he claims that company who have a strong API and API management practice have 60 66% more revenue in average. Wow, you know something is right here. Something is right. But yeah, so that's the area of API management and you know in the paper he takes lot of examples of uh industries but he also take the example of many US giants and you can claim that all these companies at some point have a strong API initiatives and even in India all the banks in India all the telos in India you know at some point their success is linked to how they manage their APIs at some point or how they internally or externally right but then over the last 15 years things have changed change a little bit because a new practice emerged. Uh this is actually a talk from Andre Karpati you know he was the previous open AAI developer now he's previous Tesla AI developer now then open AAI then entropic right now at entropic so he has this idea so so in the same time the API managements were thriving we had this new era of software coming so so he claim he used to call it software 1.0 O is where you classic code programs classic computers right deterministic code like real programming language the same code gives the same results right then you say in 2012 AlexNet you know with deep learning the start of deep learning you know we begin to have new way to program technology you know with weight we were able to program neural lens so it's a different you know because it's a it's a completely another way to program you know what we will call now a AI I today right and he say like in the last few years he called it software 3.0 Oh, is that prompt or natural language is able to program large language models. So actually, so it's not a full programming language per se because the same prompt does not give exactly the same results, right? But at least you know this is a this is uh how how we claim that you know you you kind of program the large model. So this happened in the same time in parallel, right? And then you know you have the explosion of uh of uh the the LLMs and everything. But and Jensen talks about the token economy. He say now tokens actually are the new currency. You know they're the new currency. You can turn tokens into text into pictures into videos into whatever documents. So tokens will be the new currency of the software we know today. Right? I don't know if you've seen but some actually people train are trained to develop full computer that is just an LLM. So actually you just it's just an LLM that you browse and and all the application are generated right doesn't work perfectly but they have this idea right so just to say there is a there is a shift yeah there is a shift that you all know right so and this shift we can turn that into like we're maybe shifting from code to tokens [snorts] as the unit piece of information where maybe shifting from computing to cognition you know it's not just the output now we want the outcome the outcome is cognition is the intelligence, right? We are shifting from syntax like exact syntax to semantics you know with the natural language aspect and in the common line you know exact common line uh to conversations and that change a lot of things into how we build software and we will see that actually that change a lot of things for API management but there's a link on the other side the opportunity of AI is huge you know so you know this company of course but we they claim that a at least tokens will be just a proxy of electricity. So it will be as fundamental as electricity, right? So that changed a lot of things about how we think we will build software tomorrow. So about the GI use cases and everything. So again some researchers have scales you know from just data transformation, natural language interfaces, workload automation, um a copilot assistant or autonomous agents. So Narish talked about the autonomous agents depending on where we are. I think we're approximately here, right? I don't know if people agree. It's an average, right? So the average is misleading. U you may know the joke, right? About an economist who was was not knowing how to swim, you know, sorry, an economist who didn't know how to swim uh died in a river of an average of 1.5 meter, you know. So that's that's the joke about the average. only mathematicians laugh at this one. But so yeah, um I think we're approximately here. And what happened here is that in 1997, Robert Solo, who is a Nobel Prize of economics, he said that we were having thriving software, but we didn't see labor productivity as much as the software impact was was there. Right? So he said we have we see the computer age everywhere except uh in the productivity statistics you know. So my question today with all the agents all the token we spend all the money with organization spend are we seeing the AI revolution everywhere but in the productivity statistics how many organizations did not find their ROI did not find the value in AI and agents we know the opportunities here but we they didn't find it and maybe the solution is that is transitioning from API management to something else and this is what we will explore in the second part this is uh what openai send to machines when they reach 100 billion token. Funny enough, you know, they had this idea of organization will use AI to develop and thrive, right? But finally consulting company are using AI to help customers, right? So finally the adoption of companies didn't work. the adoption of company didn't work and it didn't work so much that actually open AAI had to launch a deployment company with a consulting company you know the the fact that organization will adopt it didn't work and not just open AAI you know entropic launched one Amazon launched one you know it seems that yeah AI is not easy to adopt right you need a you need more tooling and more practice right even Alex Karp the CEO of Palanteer you said about his fellow American company's friends. Yeah, these guys are stealing people. Company engaging in token maxing are wasting massive amount of money on rising token costs without seeing actual productivity gains on return on investment. Businesses burn budget and token consumption that acts like a compulsion rather than solving core problems. Whoa. What's going what's wrong here? The opportunity is huge. We didn't make it work. and but what we've learned in API management can help maybe this is what we'll see so the question today we'll try to understand what killed API management but why what we can learn from API management to actually make AI successful so the act one the act one is the new practice is emerging so for me API management is disappearing because a new practice is emerging so if we go back on definitions so API management is everything about managing the life cycle from the the API from the from the strategy, the design, the the the development, the test, the management, the security, the versioning, you know, the exposure, the the metrics, the monitoring and everything. So that's the API management practice. Then you have the API gateway who is really the the runtime proxy, you know, for everything which is part of the management about authentication, authorization, rate limit, throttling and everything. And then we have the appearance of AI gateways. So maybe in the room who has an AI gateway at least in test in their organization really few okay but still you know so it's coming so it's the same thing but for AI models right you know the control point for model prompts and hallucination token consumption and everything and then the new thing I think that is kind of actually diluting API management is context engineering you know I think at the end APIs and API management will be just feeding context you know and you can see there approxim imately 10,000 open position of context engineer you know they're really well paid so if you want to find a new career think about context right so API gateways really manage how software rich systems AI gateways how agents or LLMs or models like reason decide and and are governed but context engineering is really the discipline of giving the right context at the right time for an agent being sure that he's as always what he needs why because actually the context window of agent is limited now for now most of the frontier API like give up to 1 million token uh 1 million token window for context that's not huge right an organization has lot more institutional knowledge you know so you have to give the right context at the right time for the the agent so when he will do these actions so and there are research papers to have unlimited context infinite context because they actually they they have 1 million token on the context window and they call the previous 1 million token on a context window and they try to do it infinitely. So Google is having some research. But we found that no the more important is the better context than the infinite context. So it's an engineering problem. We don't have enough but we need to actually master it and optimize. Right. That's good. That's good. So for me context engineering is the thing that is that that's one of the killer of API management. The act two is that agents are taking all the management attention. they're taking all the management attention because with APIs we have requests per second you know rate limiting we just manage the output with uh LLMs and agents where tokens per second so it's not requests now it's tokens completely different world right completely different mindset and I think the future of context engineering in a business context will be cost per task so we're shifting from request per second to token per second to cost per task and that's the end goal Right? If we really want autonomous agents that enable company to thrive, we need new metrics. We need new models, right? Then we will see we will actually see if we earn productivity or not. So what what what chang into that? So of course the the reasoning and everything around that is really changing the way we have to think management of governance and in the in in the of technology. What stays the API stays you know they're still here to provide deterministic context you know they're here to stay they're already managed and and it works right business capabilities transactions and everything but what emerge is that new gateways are needed for AI capabilities so these are the AI gateways that is the new way to think uh like the management of LLMs and and and in organizations okay so two reasons that I think are hurting that have hurt API management. The third one is API management is not made to get intent. An agent needs intent, right? You know, everywhere from S SOA to RES, GraphQL, whatever API products mindset, LM application agent, multi- aents, right? But API management has reached his limits, you know, doesn't get the intent. It's mostly for calling URL path and getting response and and that's it, right? we had to hardcode and orchestrate ourselves you know the the the the different workflows now the workflows are directly thought by the agent so API management is not made for that right at least the way we know it the way we know it so we were shift we're shifting from call this endpoint to invoke this tool to solve your problems to actually complete this task management is not made for that the way we know it definitely not definitely So yeah the governance is completely shifting from you know requests to operations to capability to outcome and again the way we do API management today not made for that act four APIs are relegated to the execution layer APIs were there on the management layer you know because they were actually on API management side right but now they're just on the execution layer so now the workflow is mostly you have a user goal that try to a customer an employee right then the agent is planning the actions. He will check what are the tools, what are the data available, what's the context he can use and then he will call APIs to actually execute. But now APIs are relegated to execution, right? They're not the management layer of data flows and everything, right? So in my opinion, this is what's where it's going, right? So the reasoning layer will be where LLMs are mainly used or agents and they're the probabilistic planning. So we'll need to shift that. Then you have the context layer who will be mainly the control plane of all of this where MCP actually will come into the game give context to models right and maybe some rag also to give some data right you know all the as we say the PDF the confluent model the documents the wikies and stuff like that and then the execution layer will be made by APIs right we already have this it's already governed it's already working and it's deterministic so we have the nondeterminist istic uh probabilistic planning but we need at the end to have deterministic actions this is why API will still be there but they lost prime time they've lost the the prime time of governance of course without API agent can only talk then we need tools we need API we need access to data access to systems to execute bounded capabilities so yeah so that's API will still be there but we will manage them in totally different way so what does that mean that means that for the agent era we should maybe now expose capabilities and not just uh raw endpoints right okay act five the gateway shift the gateway shift so we talked about API gateways and and AI gateways actually there is a big shift so I love this quote from Jensen again we're going to a world where it will be just API calls to LLM to API calls to LLM to API calls to LLM right in organization so that means we have two new models of architecture for API management uh you know either We have API management. We keep it for APIs flows and we have AI gateways for LLM flows. So two separate entity, two separate teams, two separate skills, two separate budgets and you know with all wrong that could be come with it or we have a mix. We have APIs calling LLMs calling APIs calling LLM and we have API management with AI capabilities. Many vendors actually in or which are API sponsors are actually doing this. You know they have they add AI capabilities to their API management. But there is an interesting sign. Kong one of the companies actually said that they are decoupling their AI gateway to their classic API gateway. So they still have AI capabilities into their API gateway but they say we're separating the AI gateway from that. Right. company like Port Key, they are just AI gateway. They have been acquired by uh PaloAato networks again just as a pure standalone AI gateway. Something is coming right you feel it. So of course at the end they will do the same thing but with a complete different mindset you know uh they will just still authenticate users or authenticate apps or authenticate clients. they will still root request but not the same way with API calls or or prompts completely different thing. Rate limiting will be token consumption. Uh caching will be semantic caching or prompt uh uh prompt caching. So it will be completely different completely completely different same job but not the same practice. So again that means we may also need to change the way we design governance because now we have intelligent systems. So maybe we'll go to more natural language governance you know instead of having a really more defined into into the system maybe you know the agent will be able to interpret a little bit but still specified at some point right so AI gateways will not directly replace API gateways but they are the last mile to the customer. So that means you know they will take prime time they will take the budget they will take the attention and API gateway will be released like ESBs and you know in the in the abbyss of the systems right so many architecture are possible but you you know like really from the user from the agent the API and API gateways will be released you know below right you know below but still there will be the deterministic uh authoritative execution boundary I'll give you access to the slide right So you can take photos totally fine but just to let you know I'll share the slides. Act six the tokconomics is replacing the APIomics. We talk about management but for me again the traditional API KPIs for API doesn't work well with the KPIs for agents you know latency errors and everything but again it's a completely different way to think it's not like errors uh call it's a it's response failure but how do you identify that the response failure from an agent you know did accomplish the task it's not the response so so many things are changing the way that the practice cannot be the same, right? The practice definitely can't be the same, right? So just an example how we count. We used to just have API calls, you know, reg limiting counting. Now the cost per task will replace the classic API calls. So imagine you have you have an agent that have 20k input tokens 2k output tokens four tool calls that is calling you know and you know and then you will have the cost per token then you will have to think completely how much you pay in infrastructure you will have to completely change the way classic API management is doing complete new mindset it needs to be something different in my opinion it needs it needs to be different and then when we have multi- aent that will scale, right? That will scale. And when you do the work with multi- aents, for example, 10 agents, four tasks per minute, 20k input token, 800k um uh input token per minute, 30 input token per second. For me, that will be the pulse of the company, right? How many tokens you burn per second, you know, and you will see like uh maybe company will compare their agility, their ability to execute with actually the token they burn per second, right? like electricity, you know, it will be a bill like electricity, right? Maybe at some point we will have the business outcome per dollar under policy as the end metrics, but again API management is not made for that. Definitely not made for that. Okay, act seven. Uh I'll check the time here. Oh, I still have some time. Act seven, context management as we said earlier for me includes already API management. It's part of it's it's a feature of context management. API management is a feature of context management. So again let's imagine again that we have a class we have APIs that are you know business bounded uh in context but then when you will have a request to do workflow to do when you will have something to do you will just pick the right context you know context packet I call it to actually execute the task right you know you will not have to do all the calls and getting all the answers and everything you will be able to just pick and choose right so if we take an example for refund workflow just imagine you know the user ask a refund for a specific invoice then the agent will build a context will check what's available what are the tools what are the APIs what's the policy what are the evidence you know that actually there was an issue and actually I can prove it then they will evaluate you know so they will evaluate with reasoning based on the context and then they will act but the action will be made with APIs right so API is still there but again the management layer will be before when the context would be built when the evaluation will be made and then the feedback aspect will be important you know to reinforce the good behavior or not about the agent. So the agent will never receive the whole system or the whole response only the scoped context and permitted capabilities on the fly. So the context management is maybe what we have tried to reach on API level. you know the role based management you know we only have four methods like get post put patch delete five and link if you add six one but you know it was kind of quite uh discreet now it will be a lot more blurry that can be scary that can be an opportunity right some people think we're going back in the old days and some people believe it's the future so I call them microcontext they're like microservices for context you know yeah like how many times you had the debate about what's the size of a micros service h how big it should be how small it should be right there's one that I like is that a microser should be as small as possible but big enough to represent a full business context or a full business capability right you know so for me that's that's one of the definition I like uh yeah context should be the same the context should be as small as possible but as big enough to be able to full to make the full uh to give the full context for agent to achieve his task with the right information right with evidence with grounded capabilities you know the fact that we are guarantee that the execution is doesn't come from an elucination so from API endpoint management to capabilities management that's another one because of course API endpoints are just a a way to request and get and get response but we now with agent we need to express into capabilities because we're at the execution layer Now we're at the execution layer. So you know from classic endpoint catalog we may go to a capability registry. So we have to not erase what we did but we may have to think differently right you know think in terms of capabilities because now agents are able to think in terms of capabilities based on what APIs provide right capabilities are provided by APIs but completely changing the way we think right you know so all the work we're doing on specification and everything it will be important for agents but maybe on the business layer the execution layer wow menu standards may will probably And then we already have some standards there. You have the open API specification. We have the MCP the model context protocol. And now we see more agent tool registries. So we're really shifting from of course open API specifications. So path method schemas parameters response everything still there and agent love this. MCP adds a lot of things. All right. the the the prompt the the the the resource access but now we see many registries know organization wants to have agent registries to know the identity of agents the capabilities that are actually available right so agent can know what they can do right so it's not just the context it's the capability so again API management is not made for that definitely not made for that and you can see for example uh many many large organization actually are the cloud you know Google and Microsoft and Amazon are actually fighting to be the agent registry, the capability registry for organizations. There's a big fight. So again, for me, the things have shifted already. Okay, what does that mean? That means that agent experience is the new developer experience. You know, in API management, you have developer portals for documentation, for developer on boarding. Maybe that's over. Of course, for now, not now immediately, but the next onboarding will be onboarding agents, you know, being giving the tools, the right context, the right tools for the agent on the fly, you know, to be able to actually build the application it needs with the info he needs, right, and get all the all all the tools he needs actually to make it happen. So for now we still have developers but over and over more most of the platform will be made directly for agents to discover and and build directly on top of of systems and APIs. So AX is the new DX right? So that's uh that's how we call it. So even open API so we have open API maintainers here specification but open API may shift may go maybe in the future to be like a lot more having I don't know if it will be part of the spec or kind of an an add-on but at some point you we may need to definitely make it agent optimized you know you know for to avoid elucidation using more standard like JSONLDD context linking or more semantic description intent putting intent directly into the into the specs. We'll see, right? We'll see. But I remember a world where in the hotel industry, you know, hotels um travel industry, sorry, travel industry, they work with hotels, they work with flight companies. Hotels, you know, hospitality systems now, they they have been more into rest JSON over the last 15 years. Flight companies, their loss is still of so right. So I remember the time where companies were managing two different interface for two different industries. They were having their soap XML documentation for so people who wanted it and rest JSON documentation for industries that wanted rest JSON. Maybe we will do the same for a certain time. We'll have documentation for humans specs for humans documentation for agents specs for agents, right? I don't know the open API maintainers here what's what's there but guys you should do something okay and the grand finale is that actually I think context management is the new API management so and I put that into four pillars that and you will see that API management is is is uh reviving into this but uh uh what I call identity and intent business and domain knowledge and evidence execution and feedback The first one is identity and context. Of course, we need to know who is making the request. Are they allowed to make the request? Is the agent a known agent internal or external? Is the agent authorized to do this request? So, we will have this identity layer, right? And intent layer that we need to to figure out. So, that's the pillar, the first pillar of the context management. And again, identity and purpose, you know, are part of API management, but now they're completely completely changed, right? you know the policy aspect, the permission, the scope, oth, we will need the o for agents. Some people are working on it but it's not there completely standardized yet. The second pillar is maybe the one that is really familiar with what we have today. It's the business domain context. It's the APIs we know that execute specific capabilities right you know so that's still there and that will be part of context management. So APIs API management is there but in something else something larger. The third which is why I think API management is obsolete is that the knowledge and evidence context you know with APIs you only have really governed and structured um interfaces but what are the documents all the PDF all the non-structured documents in the organization that should be in the context you know that can give answer they are they don't exist in API management but they can exist in context management the docs the policies the wikis the you know the outdated uh confluence documents and last but not least is the execution and feedback context. So the tools that will you you will be able to call the the actually the the the decision how who is the organ person in the organization that is able to make a decision to actually say commit to the agent yes I can validate you you can commit to to this that will be part of the context you know where is the human in the loop so that will that how we can measure that so yeah APIs are not just called by the agent API response become the next context for the agent you As we said, you know, it's a it's a chain, right? Okay. So, what's the road map from shifting from API management to context management of still by API governance, but it's it's about tool exposure. What are the tools and capabilities that I can call by APIs, right? But to add to the context, what are my AI gateway controls? Because of course, I manage APIs, I need to manage models, how I can all of this is part of the context. what are my context contracts you know and like how do I manage the context and then what is the outcome governance that I want for my business right do I do can an agent do that if the price is good and if the policy enables it so the matching model so we had APIs non-managed then we had managed APIs then with MCP and other stuff we have managed tools tool coding and everything to feed context for agents then we have managed AI models. That's a shift. And then the end goal for me is context management which is the end goal with all of this. It actually it it use all of this use all of this but it's the end goal right for for for this. So I think I'm on time still have five minutes but there was a lot of things again there was a lot of things and again for me these are all uh let's say knife uh knife hit in API management practice as we know it for me to say that it will disappear right so will API management disappear I think yes it will disappear but the question is that API management is is API management that. So we checked in the tube stone. We checked on the G and there was nothing inside. There were nothing inside. Yes, it disappeared but maybe not dead. So maybe not dead. And and I just want to use a metaphor to finish about all what's going on, right? Is that I think API management will disappear like sugar disappears in the tea. You know so when you put sugar in hot tea or even cold disappear but now it lives everywhere you know it's actually everywhere the mindset of management authentication authorization rate limiting is there we just have to apply it to something else to models to tokens to context to whatever but it's still there it's still the same practice the mindset of the practice but just new way right you know so I think that's the same it's like a riding a horse or driving a car it's still moving you know you have you steer you give food or or gas or whatever but it's the same mindset right so yeah sugar and the tea lives everywhere and every drop every sip every spoon and actually reveal the taste but I have found another metaphor by a Persian poet called Roomie and another Middle East poet who khal jibran I don't know if you know if you know him um but uh so he said that actually maybe if I didn't say that about management but I use a metaphor that maybe API management will disappear like the river disappear into the sea, right? So that's his end goal. The goal of the river was to disappear in the sea, right? That was the end goal. It was there to do a path. But when something bigger was coming is just to was just to be diluted and and and there right so I will just finish by this poem right uh by Khalbran called the river cannot go back. So I I really I will read it out loud. So it is said that before entering the sea, a river trembles with fear. She looks back at the path she has traveled from the peaks of the mountains, the long winding roads crossing forests and villages. In front of her, she sees an oceanian so vast that to enter there seem nothing more than to disappear forever. You see the metaphor with life, right? But there is no other way. There is no other way. The river cannot go back. Nobody can go back. to go back is impossible in existence. The river needs to take the risk of entering the ocean because only when will fear disappear. Yeah. Because that's where the river will know it's not about disappearing into the ocean but of becoming the ocean. So API management this is what I think will disappear but to become something else that I call context management. So it still be there your practice is still there just have to think differently. Thank you very much. >> [applause] >> Yeah, I can answer some questions. >> Any questions? >> Thank you so much, Mi, for this talk and I think this is probably the first funeral I'm walking away excited and happy from. So, thanks for the stellar job that you did there. loved the notion of you know uh microcontext API AI gateways agent experience specifically the question I wanted to ask is in the space of AI gateways especially in the open source realm do you see anything interesting coming coming up which we should keep an eye on >> interesting companies or features >> AI gateways yeah >> yeah any new startups or any new you know open source >> so AI gateways again uh what do you call an AI gateway does an API gateway with AI manage >> features not Okay, so pure standalone gateway. >> So there are few ones. There is a pure pure LLM gateways that are actually too much LLM like LLM light or stuff like that. But two that I again um I'm sponsored by everyone so I can say whatever I want but no uh the the there's port key port key that has the idea of a full standalone um AI gateway you know so port and it's open source okay right uh and then I didn't check but the the kong split for the AI gateway I don't know yet how much they keep up open source how much is what's enterprise whatever but at least I would they've been really good on that It's really well adopted. I would I would check but I didn't check this one. Port key I would recommend. >> Again I would recommend others but you asked me the question. So >> thank you. >> Thanks VI. Uh just on the same context we are working with uh True Foundry. >> True Foundry. Okay. >> It's pure play of AI gateway and we keep the uh old API gateway intact. Yeah. So that one maybe you can >> port key true foundry and we need a third one uh you know to I don't know in India but in France we're not allowed to do publicity I we have to at least give three names so I need to find a third name so I said kong so >> yesterday >> standway >> yeah but I think it's still part of their API Sorry there >> very delighted talk like yesterday it was so great so just want to add not a question about that river sentiment so we have in office quoting Thomas Edison saying that river is not one by its speed but it's a relentless pursuit of forwardl looking so river becoming a ocean and our journey is uh expanding further. Huh. I think you gave a very good message. >> Yeah. So that's it. So there is also another message that I wanted to try but uh let's say in the it's a globe but people call it the west. You know the west we believe there is an end because there's a beginning and in more middle east or you know east Southeast Asia we believe there is a beginning because there was an end before right you know so you know let me think. Thank you m as nar said you have mixed of philosophy concepts technology everything together which is really super worked out very well. So my question is around the how the security needs to be evolved like what's the role of security in this transition. >> It's funny because I removed the three slides on security this morning because I didn't thought I would have the time to to to make it happen. No again security is is one of the arguments to say that API management is obsolete the way we know it because the security is completely different. you know the prompt injection you know hallucination is kind of a part I consider part of security in a sense that it can do harm to the user so I consider a part of a of governance and and security yeah it's a it's a new world and API management companies actually you know where they were not ready with so many the gateway it was not enough for many let's say attacks you know bola attacks you know or other type of business logic attacks or whatever the API gateways were not ready so even on API the gateways they were not ready for more complex attacks with LLM it's even a new realm so yeah it has to be something totally different it has to be the ocean and not the river right you know so so yeah but uh the the attack surface is completely different and most of API management companies are they're learning like everyone but they're their previous tools and gateways are not are not ready for that >> all right thanks a lot thank you mi for the wonderful >> [snorts]