API Versioning as a Translation Layer
API versioning as an architecture: requests enter through a version header, pass through a chain of reversible version changes, and reach controllers that only ever see the latest model.
Loading…
Topic
API
76 posts about API. Every summary links to the original.
- 76 posts
- 24 companies
- 8 explainers
See the idea
API explainers
The API Gateway Boundary: Where Protocol, Policy, and Protection Meet
The API gateway is the single boundary where protocol translation, auth, quotas, and routing become shared policy instead of per-service code. This layered diagram shows what belongs there and why.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Turn your REST APIs into MCP tools with Google Cloud API Gateway
Most enterprise REST APIs are invisible to AI agents, forcing teams to run separate MCP servers that duplicate their existing gateway logic. Google Cloud API Gateway in Public Preview solves this by acting as a remote MCP server — annotate the OpenAPI 3.0.x/3.1.x spec with x-google-api-management.mcp and deploy it with no extra infrastructure. The gateway accepts MCP JSON-RPC requests on a single /mcp endpoint, transcodes tools/call into the corresponding REST call, runs it through existing policies, and returns the response as an MCP result. Authentication via JWT or API key works unchanged for REST operations; tools/list is unauthenticated by default and requires JWT in production for security. With no separate server to operate, teams in Public Preview can expose up to 1,000 tools per gateway that support existing authentication and quota, and the MCP server is automatically discoverable via API hub and Agent Registry.
How to test that a dozen MongoDB drivers, in a dozen languages, conform to a dozen specs
MongoDB develops a dozen native client library drivers in a dozen languages, each idiomatic to its language but needing consistent API behavior. Instead of relying on English specs or Cucumber tests, engineers created a YAML-based domain-specific test language interpreted by runners in each driver. The Unified Test Format, built on this YAML language, now contains nearly 1,500 files testing conformance to specs covering retries, transactions, client-side encryption, and more. A natural experiment showed four of five drivers had lower nonconformance bug rates after adopting YAML tests; Node.js improved after fixing its test runner. The IEEE ISSRE 2026 accepted a paper on this approach, which has saved over 22,000 lines of test-runner code across seven drivers.
The Headless Dashboard Initiative
Resend announced a headless dashboard initiative to make all dashboard capabilities available programmatically via the MCP, CLI, and API. Recent releases include the Email Metrics API for deliverability and engagement data, a Headless Webhook API for listing events and replaying deliveries, and a Cancel Broadcast API. The Duplicate Broadcast API copies any broadcast into a draft, and the Share Email API provides expiring read-only email links. The team aims to make the dashboard best-in-class while committing to full headless operation for every future entity. Developers can start building today by connecting the MCP server or using the CLI.
Introducing Our New Dropbox API Documentation
Dropbox has launched a modernized API documentation site at https://docs.dropboxapi.com, rebuilt to make integration faster and more intuitive. The new documentation features interactive API testing that lets developers set parameters, issue API calls, and view real responses from the Dropbox API directly in their browser without switching tools. An embedded AI assistant offers instant help with endpoint questions, troubleshooting, and code examples, while the documentation integrates with MCP (Model Context Protocol) so AI tools like Claude Code and Cursor can access up-to-date API information. Through the MCP server at https://docs.dropboxapi.com/_mcp/server, developers can connect their AI assistants to answer questions, explore the API, and assist with integrations using information directly from the docs. The update delivers a clean, responsive, searchable interface that brings endpoints, types, schemas, and related documentation together, with improved navigation, and provides comprehensive information including detailed error responses, type definitions, and full request/response schemas.
How CSIRO built scalable, cost-optimized genomic variant querying on AWS
CSIRO built Serverless Beacon (sBeacon), a production-ready implementation of the Global Alliance for Genomics and Health (GA4GH) Beacon protocol for secure genomic variant querying. Its serverless architecture combines Amazon S3, AWS Lambda, Amazon DynamoDB, and Amazon Athena: genomic data remains in its original S3 location, while metadata is indexed in ORC tables and ontology indexes for query processing. Standard VCF files can be queried through API Gateway, with modular Lambda functions resolving ontology terms, querying Athena, and, when needed, issuing HTTP byte-range requests to source buckets so raw VCF bytes do not leave their owning organization. The post reports support for hundreds of millions of individuals and billions of genomic locations, approximately USD 0.40 monthly operation for a 1000 Genomes-scale dataset, roughly five-second real-world queries, and about 18-second generation-to-use onboarding, while noting that whole-genome range queries can time out.
A skills library for every agent
The post introduces Notion’s skills library and Skills API, aimed at helping teams share organizational knowledge across AI agents and workflows. The library is designed for nontechnical and technical users, with collaborative editing, database organization, supporting files, permissions, suggested edits, version history, usage analytics, and controls over skill distribution. The API provides endpoints for loading skills in spec-compliant file formats, with examples including synchronization to GitHub, installation through Vercel’s Skills CLI, and uploads or edits through MCP tools. Notion says early customers and partners are already using the API across agents and tools, while an open-source starter kit supports Notion-to-GitHub synchronization. Vercel’s Skills CLI can install individual Notion skill pages or workspace plugins, using standards-compliant files without handling Notion-specific formats.
Give every teammate and agent the right level of access to your Workers
Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV.
A Developer's Guide to API Access Policies in Auth0
Auth0 API Access Policies for Applications control whether an application can obtain an access token for a registered API, separately for user-delegated and client access. The FinFlow example separates a browser application that should reach both APIs from a machine-to-machine Risk Engine restricted to the Payments API. Policies provide three choices—allow_all, require_client_grant, and deny_all—while client grants specify an application's audience and permitted scopes, with the audience determining which API policy is evaluated. The guide shows Dashboard and Management API configuration, including subject_type_authorization settings and grants for user and client access. It also explains that third-party applications still require grants under allow_all, while default third-party grants establish a baseline and per-application grants take precedence for exceptions.
Higher usage limits and a SpaceX compute deal
An agreement with SpaceX will give the company access to all compute capacity at the Colossus 1 data center, adding more than 300 megawatts and over 220,000 NVIDIA GPUs within the month. Combined with other compute partnerships, the expansion supports higher usage limits: Claude Code five-hour limits double for Pro, Max, Team, and seat-based Enterprise plans, peak-hour reductions end for Pro and Max, and Claude Opus API limits rise considerably. The company says the new capacity will directly improve service for Claude Pro and Claude Max subscribers while it trains and runs Claude on AWS Trainium, Google TPUs, and NVIDIA GPUs. It is also expanding inference capacity in Asia and Europe and exploring orbital AI compute with SpaceX.
Introducing Claude
Anthropic is offering Claude more broadly after a closed alpha with partners including Notion, Quora, and DuckDuckGo, positioning it as an AI assistant for conversational and text-processing work. Available through a chat interface and API in the developer console, Claude supports summarization, search, writing, question answering, coding, and other tasks, while accepting direction on personality, tone, and behavior. The announcement introduces Claude, a high-performance model, alongside Claude Instant, a lighter, less expensive, faster option, and says both are being developed around helpfulness, honesty, harmlessness, reliability, and predictability. Partner deployments include Poe, Juni Learning’s Discord tutor, Notion AI, DuckAssist, Robin AI’s contract tools, and AssemblyAI’s audio platform. Reported benefits include natural conversation, richer tutoring responses, contract drafting and explanation, improved engagement, and stronger feedback, though these are partner and user reports rather than a controlled evaluation.
Anthropic acquires Stainless
Anthropic is acquiring Stainless, an SDK and MCP server tooling company founded in 2022, to expand how Claude and other agents connect to data and tools. Stainless has generated every official Anthropic SDK since the API’s early days and is used by hundreds of companies to produce SDKs, CLIs, and MCP servers from API specifications. Its tooling supports TypeScript, Python, Go, Java, and other languages, with libraries designed to feel native while remaining fast and reliable. The companies say combining their teams will advance developer experience and agent connectivity on the Claude Platform, while Stainless’s founder, Alex Rattray, said the team will continue its work within Anthropic.
ClickHouse as a streaming HTTP API
ClickHouse 26.8 can serve as a streaming HTTP API for controlled queries, using named handlers rather than requiring a separate pass-through layer. Using the UK property prices dataset, it sets up a MergeTree table with 30,452,463 transactions spanning 1995-01-01 to 2025-07-31 and occupying 339.08 MiB. The implementation covers named endpoints, typed query-string and URL-path parameters, result modification, direct table exposure, and framing formats that stream query data and progress in one response. It also uses an API user with a default JSONEachRow format and row limit, query logs for request visibility, and a SQL SECURITY DEFINER view to expose aggregates without granting access to source transactions. These features can replace a pass-through service for controlled queries, while business logic, orchestration, or application-specific validation still require an application layer.
Elevating security, control, and accessibility: Stack Internal 2026.6
Stack Internal 2026.6 is a release focused on administrative security, API control, developer portal integration, knowledge-health automation, and accessibility for enterprise AI workflows. Its new Admin Security page supports X-API-Key headers for API v2.3 requests, inactivity windows, per-application daily limits up to 10,000 requests per day, and service-credential rotation with non-displayable secrets. The release adds scheduled expiration for Announcement articles, generally available community broadcasts, expanded custom award limits, tag preference and synonym APIs, richer user data, and a Backstage plugin update supporting the New Frontend System alongside the legacy architecture. Accessibility work improves screen-reader announcements, keyboard and reflow navigation, focus management, high-zoom layouts, contrast, and semantic markup, while additional fixes address tags, suggested edits, and Slack rendering.
How to Approve Real Users and Block Fake Accounts at Sign Up with Lookup and Verify in PHP
The tutorial shows how to combine Twilio Lookup and Verify in a PHP sign-up flow that screens phone numbers before sending an OTP. It starts with Line Type Intelligence to accept mobile numbers, optionally checks reachability with Line Status, and uses Identity Match to compare submitted first and last names against authoritative sources without revealing underlying data. If those checks pass, the application sends a six-digit verification code and validates it through a Verify service. The provided implementation uses PHP 8.5, Slim, Twig, Monolog, and the Twilio REST client, with environment flags controlling optional checks and logs recorded in data/app.log. Testing covers mobile, toll-free, VoIP, and name-mismatch cases, while the pricing discussion recommends ordering cheaper checks before more expensive Identity Match and Verify calls.
How to Confirm Phone Number Ownership with Lookup Identity Match
The tutorial shows how to use Twilio Lookup Identity Match to confirm that a person is linked to a submitted phone number and reduce sign-up fraud. It describes a zero-knowledge match against authoritative sources such as mobile carrier records, with possible use during sign-up, login, account changes, or checkout. The implementation starts from an international telephone input project, collects first and last names alongside an E.164 phone number, and passes them to the Lookup API with the identity_match field; the response exposes per-field statuses and a summary score. The sample JavaScript treats the check as successful when the phone is valid and both names are exact or high partial matches, then displays the result, while the post also notes approval requirements outside the US, test parameters, and alternative Lookup packages.
How to Confirm Phone Number Ownership with Lookup Identity Match in Python
The tutorial shows how to use Twilio Lookup Identity Match in Python to confirm that signup information is associated with a phone number and reduce signup fraud. It builds a Flask application that accepts an E.164-formatted number, first name, and last name, then calls the Lookup API with fields="identity_match" and the supplied identity attributes. The response exposes statuses including exact_match, high_partial_match, no_match, and no_data_available; the example accepts a result only when the number is valid and both names are exact or high partial matches. The implementation covers project setup with Flask, twilio, and python-dotenv, environment-based credentials, an intl-tel-input form, and frontend handling for success and failure messages. It also notes that Identity Match can use combinations of name, address, national ID, or date of birth, and points to other Lookup packages such as Line Type Intelligence and SIM swap detection.
Introducing 100K context windows
Claude’s context window has expanded from 9K to 100K tokens, or about 75,000 words, enabling businesses to submit hundreds of pages and sustain conversations for hours or days. The announcement describes using the larger window to digest documents, synthesize information across multiple files, answer questions, and work with full codebases, with the claim that complex questions may perform substantially better than vector-search approaches. In a test, Claude-Instant processed the 72K-token text of The Great Gatsby after one line was altered, identified the change correctly, and responded in 22 seconds; 100K tokens is also described as roughly six hours of audio. The capability is available through the API, with examples including financial analysis, legal review, developer-documentation search, podcast summarization, and rapid prototyping.
The Email Verification API
The proposed Email Verification API lets a browser verify that a submitted email address belongs to the user without sending them away from the current form to retrieve an OTP or magic link. Its flow involves the user, browser, mailbox provider (issuer), and application server (verifier): after mailbox registration, the browser and issuer create a token that is submitted with the address and checked server-side. Implementation requires an email input, a hidden email-verification-token input with a session-bound random nonce, and token verification using the site origin as audience; a JavaScript package handles parsing, lookups, and signature checks. The proposal is currently limited to Chrome’s origin trial and Gmail mailbox verification, so the source recommends progressive enhancement and other verification APIs where unavailable.
Video Call Integration on Different Platforms
Video calling can add direct, personal communication to customer and patient interactions without moving conversations to a third-party app or website. The post outlines an integration path based on choosing a platform, selecting development-specific SDKs, and either building a custom application or deploying and adapting an open-source one. Twilio is presented as a cloud communications platform offering APIs, SDKs, reference apps, and documentation, with SDKs for JavaScript, Android, and iOS; listed build examples also use Svelte, Go, Python, ASP.NET Core, Angular, Node.js, TypeScript, and Express. Open-source options provide features such as screen sharing and network-condition monitoring, while Twilio Video supports branded virtual backgrounds and layouts, but the source does not report implementation results.
Hello, Ireland! Sending SMS in Twilio’s Ireland Region
Twilio’s Ireland region, IE1, provides EU data residency for Programmable SMS, keeping personal data such as recipient phone numbers and message bodies in the EU through the supplier edge. Adopting it requires separate IE1 credentials and an IE1 Messaging Service, while US1 Messaging Services cannot be reused; SMS to and from +1 numbers, RCS, and WhatsApp are not currently supported. For API calls, the main code change is replacing api.twilio.com with api.dublin.ie1.twilio.com, while client SDK users switch the region parameter from us1 to ie1 and can retain the Dublin edge. Twilio’s logs include a region filter to verify where messages were processed, and the post notes that Studio and TaskRouter support in IE1 is still an initiative.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.