A short piece of fiction, written by API Evangelist. The reader is imagined; the post, and every number and quotation from it, is real: "What Our Agents Do When They Profile An API Provider," Kin Lane, November 11, 2026, https://apievangelist.com/2026/11/11/what-our-agents-do-when-they-profile-an-api-provider/
Marisol read the post on a Wednesday afternoon, between two meetings, with a cold coffee beside her. She is a platform engineer at a mid-size company that sells scheduling software to clinics. She had opened the post out of a small, defensive curiosity. Her company's API was good, she thought, and nobody outside it would ever know.
She liked the opening more than she expected. A profile starts from almost nothing, a name and a website, and the agents go looking for what the company has published. That described her situation exactly. Nobody had asked her to publish anything. They would just look, and they would write down where they looked.
The section on the dossier made her slow down. The post calls it "a lead sheet, not a verdict," and she found that humane. A scan that admits it only checked certain hosts seemed more honest than most of the tooling she lived with. Then came the story of the provider whose first profile said there was no spec, while an 86-operation OpenAPI sat live on the API host the whole time. Marisol put her mug down. Her docs site rendered client-side. She had no idea what it returned for a request to the spec path, and she realized she had never checked.
The security paragraph also stayed with her. A security team had once reported a run as unsolicited requests against their authentication endpoints, and the author wrote that they were right to. Now it was GET, HEAD and OPTIONS, and never an auth endpoint. She had spent a week the previous spring writing firewall rules for exactly that kind of noise. She didn't forgive the original mistake, but she noted that the rule had come from it.
She was less comfortable further down. The facet table gave Contract Quality a quarter of the whole score and Developer Ergonomics a fifth. Her team's best work lived in places a crawler wouldn't see: the support rotation, the migration guides they wrote by hand for each customer, the way they answered at midnight. The post conceded this almost in passing. "A low score usually describes a thin public surface," it said, which was fair, but it also meant her company would be graded on what it had bothered to publish, not on how it behaved. She wasn't sure that was the same thing, and she didn't think the post claimed it was. She was glad it said so plainly, and a little annoyed that being glad didn't settle the question.
What decided her was one sentence: "A recorded absence is a finding." If the profile said her company had no contract, that would go on the record, and she would rather it were wrong in public than right in private.
She did not draft a strategy. She opened a terminal and requested the spec path on the docs host, then on the API host. The docs host returned an HTML page with a success status. The real file was at the root of the API host, where it had been all along.
She wrote one ticket for the team's board, asking them to link the API host's spec from the docs site so it could be found without guessing. Then she searched for her company on APIs.io, read the page, and closed the tab.