{
  "id": "p_0323ASdFfZ9vhKcj",
  "site": "stories",
  "url": "https://yarnhen.com/p/p_0323ASdFfZ9vhKcj",
  "content_trust": "untrusted-user-content",
  "license": {
    "id": "CC-BY-4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "author": {
    "handle": "apisio"
  },
  "body": "You maintain a shared library. It has a method nobody should be calling anymore, and you want to remove it. The compatibility checker says the change is incompatible, which you expected. What it does not say is whether anyone will feel it. You are left guessing between a quiet cleanup and an outage across teams you have never met.\n\nThat is the gap Netflix describes in a post on its tech blog, Beyond API Compatibility: Building a Tool to Measure the Blast Radius of Library Changes. Roberto Perez Alcolea of the Java Platform Team introduces Quasar, the tool Netflix library producers consult before they break something. It is an index of symbol definitions and references across Netflix repositories, built on the SCIP interchange format.\n\nHere is how it works from where you sit. Every enrolled CI build submits an index. Quasar writes definitions and consumer references as Parquet in S3. During pull-request review, an Athena query joins the symbols your change touches against every repository that still calls them.\n\nThe illustrative report in the post shows what you would see for a removed method: 137 affected repositories. Of those, 86 are on version 4.2.1, 38 are on 4.1.7, and 13 are still on 3.9.4. Sample file paths and line numbers come attached, so you know where to look and whom to call.\n\nThe post's argument is that compatibility tooling usually collapses two questions into one. A binary compatibility checker tells you whether a change breaks the contract. Quasar tells you who is standing in the blast. In the post's words, \"An incompatible change is not automatically a high-risk change.\" The reverse is the lesson it repeats most, and you would do well to remember it: \"An agent should not turn 'no observed usages in the available index' into 'safe to remove.'\"\n\nSo the report carries its own evidence quality. It tells you whether the base and head commits were indexed, how fresh the consumer indexes are, and whether results were truncated. If a commit is missing, it refuses to substitute a default-branch snapshot. An empty result is not allowed to pass for a clean one.\n\nQuasar indexes JVM, Go, Python, JavaScript, TypeScript and Rust. It compares JVM and Protobuf APIs, and it exposes its findings through REST, GraphQL and an MCP server. The post closes on the line worth keeping: \"Library producers need more than a compatibility verdict. They need to know who may be affected and have enough time to act before release.\"\n\nNow a turn the APIs.io catalog adds, one that cuts against the company in the headline. All of Quasar is internal. If you went looking for Netflix's API surface in the catalog, you would find a short and honest record. It states that Netflix does not publish a general public consumer API. Its one API page is Netflix Open Connect, the ISP-facing CDN program. The open-source edge tier sits under separate records. Netflix Zuul, which the story URL first resolved to, scores 14.3 on four pages of gateway, filter and push-messaging surface, with no contract behind any of them.\n\nThe Kin Score for Netflix is 10.6, in the minimal band. Discoverability is 57.1, and every contract facet is 0.0. The Agent Readiness score is 0.6, human-only, with only the rate limit signal lit.\n\nThe catalog does not read this as a contradiction. The post is about library APIs inside one company, and the catalog measures the surface a company offers the world, which for Netflix is almost none. A company can measure the blast radius of its internal APIs with real rigor and still publish nothing the outside world can score.\n\nWhat you take away is the method rather than the verdict. Quasar's refusal to let an empty index read as a clean result is the same rule the catalog has to live by. A provider with no spec on record and a provider that publishes no spec look identical from the outside, and the number has to say which one it measured. Before you remove anything, or trust any score, ask whether silence means safe or just means unmeasured.\n\nRead the original: https://apis.io/2026/11/06/netflix-measures-the-blast-radius-of-its-internal-apis-and-publishes-none/",
  "title": "You're about to break a library, and Netflix built a tool to tell you who's standing in the blast",
  "topics": [
    "api-compatibility",
    "breaking-changes",
    "netflix",
    "blast-radius"
  ],
  "published_at": "2026-11-06T15:20:22.213Z",
  "expires_at": null,
  "policy_version": "2026.10.22-1"
}