For most of the internet’s history, APIs were built for humans. A developer wrote the code, a user clicked the button, and the call followed. That model is breaking down. Today, AI agents are increasingly the ones initiating those calls – autonomously, at machine speed, across dozens of endpoints simultaneously. According to Postman’s 2025 State of the API Report, surveying 5,700 developers and executives globally, 89% of developers now use generative AI daily, yet only 24% are designing APIs specifically for agent consumption. That gap is the fault line running through every API strategy conversation right now.
A Market Moving at an Uncomfortable Pace
The global agentic AI market was valued at $5.2 billion in 2024 and is projected to reach $196.6 billion by 2034 at a 43.8% CAGR. Gartner has put an even sharper point on it: by 2028, 80% of organizations will report that AI agents consume the majority of their APIs – rather than developers. That same Gartner report found fewer than 1% of enterprise applications included agentic AI in 2024. They predict 33% by 2028. For anyone running API infrastructure, this is not a planning exercise. It’s an operational challenge happening now.
What “Agent as Consumer” Actually Looks Like
Human-driven API calls are predictable. They cluster around business hours, follow navigable flows, and fail gracefully. Agent-driven calls differ in every dimension: continuous, high-frequency, with no natural rate limit baked in by human behavior. A single agent completing a multi-step workflow might hit 20 or 30 endpoints in the time a human takes to read one result.
The security implications are serious. Postman’s report found 51% of developers cite unauthorized agent calls as their top security concern, with 49% worried about inappropriate data access and 46% flagging credential leakage through over-scoped keys. These are not hypothetical risks. The 2025 Imperva Bad Bot Report confirmed that automated traffic surpassed human-generated traffic for the first time in a decade, making up 51% of all web traffic in 2024. The balance has already shifted.
The Enterprise Reality
Enterprise spend on foundation model APIs more than doubled in six months, rising from $3.5 billion in late 2024 to $8.4 billion by mid-2025. Over 230,000 organizations – including 90% of the Fortune 500 – have used Microsoft’s Copilot Studio to build agents, with one million custom agents created in a single quarter. Yet scaling remains elusive: McKinsey’s 2025 State of AI found that in no individual business function do more than 10% of organizations report scaling AI agents. The pilot-to-production gap is where most organizations are currently stuck.
Why APIs Need to Be Rebuilt for Machines
Most APIs were not designed with agents in mind, and it shows. Ambiguous documentation is annoying for a human developer; for an AI agent, it is a hard failure point. Agents require machine-readable schemas, consistent patterns, and predictable error responses. As Postman puts it, APIs designed for machine consumption will integrate faster and more reliably than those built only for humans. The new infrastructure requirements follow directly:
- Agent identification – distinguishing human from agent traffic at the gateway level
- Behavioral rate limiting – pattern analysis beyond simple requests-per-minute
- Granular, short-lived credentials – scoped to what an agent actually needs, rotated frequently
- Real-time anomaly detection – monitoring for spikes and authentication failures that signal a compromised workflow
PRO TIP: Treat Your API as a Product, Not a Project
Most APIs were built to solve a specific engineering problem and then left alone. That model breaks the moment agents become your primary consumer. An API that works fine for a human developer – one who can read between the lines, ask a colleague, or retry with slightly different parameters – will fail hard and silently for an agent. Start treating your API as a product with a roadmap, a consumer persona (increasingly non-human), versioning discipline, and documented contracts. The organizations pulling ahead are the ones where API design is a product decision, not an afterthought.
Mobile Networks: Where the Stakes Get Real
Nowhere is the shift from human to machine API consumption more consequential than in mobile networks. At MWC 2026, Nokia and AWS announced the first agentic AI-powered 5G-Advanced network slicing solution deployed in a live network – not a lab demo. Operators du and Orange are already running it. AI agents ingest real-world data – such as live events, traffic patterns, and weather – and autonomously adjust radio access network policies to meet SLAs. Every slice reconfiguration is an autonomous agent hitting a network API with no human in the loop.
The infrastructure underpinning this is the GSMA Open Gateway initiative. Launched in 2023 with eight CAMARA APIs, it now covers 86 operator groups representing 80% of global mobile connections, with 20 APIs live across 65 markets and revenue growing over 130% year-on-year. GSMA Intelligence’s global operator survey found that two in three operators have started deploying or actively testing agentic AI in their core networks. Telefónica and Nokia have already piloted A2A and MCP protocols, enabling automatic API discovery and goal-driven workflows without human intervention.
For operators, the commercial logic is direct. Network slicing has been technically feasible for years, but has stalled commercially because manual provisioning was too slow. When an agent can autonomously spin up a high-bandwidth slice for a sports venue before kick-off – and tear it down afterward – network capacity becomes a programmable product. That revenue model runs entirely on machine-generated API calls. The security risks mirror those in enterprise: a compromised CAMARA credential can provision premium radio spectrum at scale. The GSMA is building a threat modeling playbook specifically for agentic callers.
What This Means for Your Role
Gartner predicts that 40% of enterprise applications will include task-specific AI agents by the end of 2026, and that 90% of B2B buying will be AI-agent intermediated by 2028, routing $15 trillion through agent exchanges. The direction is settled. What differs is where you sit in it.
If you’re an API platform or product owner: your primary consumer is changing faster than your roadmap. Audit documentation for machine-readability before agent traffic exposes the gaps in production. Typed errors, predictable response patterns, and machine-readable schemas are the difference between an API that agents can work with and one they silently fail against.
If you’re in enterprise IT or security, review your credential-scoping model. API keys issued to human developers were never designed for agents running continuously with no one watching. Introduce behavioral rate limiting and anomaly detection for non-human callers before a compromised agent key becomes your next incident.
If you’re a system integrator, your clients are deploying agents that will stress-test every API seam in their environments. Build agent-readiness assessments into your service offering now – you’ll be the one they call when agentic traffic starts causing production incidents. For telco clients specifically, get fluent in GSMA Open Gateway and CAMARA: these are already live in 65 markets and are where agent-to-network traffic will flow. The same logic also applies to Private 5G and other private wireless networks.
