It is easy this year to read every API story through the lens of MCP, skills, and the agent surface. Useful as that lens is, it can hide what is happening at the foundational layer — the actual REST endpoints, OpenAPI specs, SDKs, gateways, credentials, and documentation that make up the API economy. The week of May 4-8, 2026 produced 30 stories worth tracking that have nothing directly to do with MCP, agent skills, or AI-coding CLIs. Those 30 stories tell a different and equally important story about where the foundation is moving.
This roundup organizes them into six themes — API keys and credentials, API specs and documentation, GraphQL and federation, API management and gateways, API quality and testing, and the SDK launches that landed this week.
1. API Keys and Credentials Are Getting Real Attention
Zuplo published an entire week of API key content, and HubSpot dropped a careful piece on credential type selection. Combined with the Truto and DORA-compliance work, this is a category that is finally getting the systematic treatment it deserved a decade ago.
- Zuplo — The Missing Manual for API Keys. The flagship piece of the week’s content series.
- Zuplo — API Key Best Practices for 2026. Reasonable, practical, current.
- Zuplo — Add Self-Serve API Keys to Your Own App.
- Zuplo — Provision API Keys at First Login. The auto-provisioning UX pattern that quietly improves first-touch developer experience for every API.
- Zuplo — Using JWT and API Key Auth on the Same Route.
- Zuplo — API Key Week Wrap Up. The summary post.
- HubSpot — HubSpot Service Keys: The Right API Credential for Data Integrations. HubSpot doing the work of explaining which credential type to use for which integration pattern, with documentation that says when not to use each one.
- Truto — How to Manage Third-Party API Quotas Across Microservices at Scale.
- Truto — How to Manage Third-Party API Risk for DORA Compliance in EU Finance (2026).
- Auth0 — Secure Your Spring Boot API with Auth0 in Minutes.
What stands out: when a category is healthy, you see a single vendor (Zuplo here) doing a content series, an established platform (HubSpot) shipping the deeper conceptual piece, and operational guidance (Truto) framing the cross-cutting concern. All three patterns happened in the same week.
2. API Specs and Documentation Are Quietly Getting Better
The unsexy work of shipping cleaner specs and better-housed documentation continues, and it matters.
- Cisco / Webex — Webex Postman Collection Reaches GA Plus New OpenAPI Specs Repository. Postman collection plus an OpenAPI specs repo, both as first-class artifacts. The right shape.
- WooCommerce — WooCommerce REST API docs have a new home. Documentation rehoming is the kind of housekeeping that signals a vendor is investing in the developer relationship.
- Microsoft 365 Dev — Announcing general availability of the mailbox import and export Microsoft Graph APIs. Graph API GA, useful capability.
- Microsoft Power BI — Execute DAX Queries REST API (Preview). Programmatic DAX is exactly the kind of capability that turns a tool into a platform.
- Zuplo — How to Build a Production-Ready Flask REST API in 2026. Tutorial work for a current developer cohort.
- DreamFactory — The 8 Best API Documentation Examples. Curation of good examples is how the floor of documentation quality rises across the industry.
- APIMatic — April ‘26 Highlights: Add Custom Code to SDKs, Create API Portals Using AI Agents, and Publish SDKs From the APIMatic CLI.
3. GraphQL and Federation Make a Move
One headline-grabbing GraphQL story this week:
- Apollo — Apollo Federation Goes Full Rust. Rewriting Federation in Rust is a meaningful infrastructure move — performance, memory profile, and cross-language embeddability all change at the same time. Worth tracking the migration story over the next quarter to see whether the rewrite ships smoothly.
4. API Management and Gateways Keep Reshuffling
The API management space is in motion, with incumbents stepping back and new patterns emerging:
- DreamFactory — Is Oracle API Gateway Reaching the End of the Road? What to Do Next. The “the incumbent is dying” post is a reliable signal of an inflection point in a category.
- DreamFactory — Beyond API management with DreamFactory. Same vendor staking out the next-generation framing.
- DreamFactory — Multi-Version API Management for AI Workflows. Versioning specifically for AI workflows is going to be a real category. Different versions for different agent contexts; rolling deprecations that respect agent-side caches.
- NGINX — NGINX Gateway Fabric 2.6: F5 WAF for NGINX Comes to the Gateway API. Kubernetes Gateway API maturity continues; WAF integration raises the floor on production deployments.
- Perforce / Akana — Streamline API Management with Akana API Ops. API ops as a category framing for the discipline of managing APIs at scale.
5. API Quality and Testing Keeps Getting Better
Quality and testing tooling is a slow-and-steady part of the API economy that does not get the headlines but matters every day:
- MuleSoft — Intelligent Assurance: How AI Transforms API Quality. AI-assisted quality assurance is going to be a category — every API testing vendor will ship a version of this within twelve months.
- Harness — API Testing Enhancements: Easier Setup, Smarter Scans.
- Kreya — Testing REST APIs with Kreya. Tooling space that rewards the underrated.
- Truto — How to Handle Long-Running SaaS API Tasks in AI Agent Workflows. The long-running-task problem in agent contexts is exactly the kind of operational issue that does not have a clean solution yet.
6. SDK Launches and Updates That Landed
The SDK side of the API economy keeps shipping. A representative slice of this week:
- Vonage — Introducing Audio Connector SDK & Pipecat Serializer for AI Audio Apps. Audio is a fast-moving category and Vonage is shipping the SDKs to ride it.
- Airbyte — The Airbyte Agent SDK: Ship Agents, Not Data Plumbing. Agent-flavored SDKs from data integration vendors will keep showing up — Airbyte’s framing is the right one.
- Autodesk — Secure Service Account SDKs now in Beta: .NET and TypeScript. Service-account auth in SDK form is the right pattern for machine-to-machine integrations.
- AWS — Announcing AWS SDK for Swift’s Transfer Manager for Amazon S3.
- Sentry — Improved debugging for Expo apps with the React Native SDK.
- Nutrient — Nutrient SDK product updates for Q1 2026.
- OpenAI — Advancing voice intelligence with new models in the API.
- Google Workspace — Now generally available: Bulk import using client-side encryption and the Drive API.
- Anthropic / Finout — Anthropic’s Enterprise Analytics API: Per-User AI Cost Attribution Is Finally Here. Cost attribution at the per-user level is one of the most-requested AI-API features, and Anthropic landing it is a small but real shift.
- EODHD — Exchange Details API v2 is live.
What This Signals For the Network
Three takeaways from a week of “just API” stories:
- The credentials story is finally getting the systematic treatment it has needed. Zuplo’s API key week, HubSpot Service Keys, Auth0 Spring Boot, and the Truto third-party API risk pieces all in one week is the strongest “this category is healthy now” signal we have seen in a while. Combined with the agent-identity work covered in the broader newsletter, it suggests credentials are about to become the most-discussed API operational concern of 2026.
- API management is mid-restructure, with old incumbents fading and AI-aware management arriving. The Oracle Gateway “end of the road” post, DreamFactory’s multi-version-for-AI piece, and the NGINX Gateway WAF all point in the same direction.
- The SDK + spec + docs trio is quietly improving in parallel with the agent surface. The vendors paying attention to all three layers (Cisco’s Postman + OpenAPI repo, APIMatic publishing SDKs from a CLI, Autodesk shipping Secure Service Account SDKs in beta) are positioning well for whatever the agent ecosystem looks like in 2027.
The foundation matters even when the headlines are about MCP, skills, and agent CLIs. We are tracking all of these signals — credentials, specs, gateways, SDKs, quality tooling — across every provider in the api-evangelist network on apis.io. If you ship API tooling we should know — apis.io is where we index the API economy at its actual surface.