Let’s talk about the strange phenomenon of being spectacularly right for entirely the wrong reasons.
A few years ago, we published a report out of the Office of the CTO titled Continuous API Sprawl. In it, we did some compounding math and made a bold prediction that made a lot of folks in IT nervously loosen their collars: by the year 2030, the world would be groaning under the weight of roughly 2 billion active APIs.
At the time, the prediction sounded bordering on apocalyptic. Today? It looks like we are perfectly on track to hit that 2 billion mark right on schedule. But here is the punchline: the mathematical model we used to get there has been utterly broken.
Our original math was a victim of pre-AI thinking. We assumed that API sprawl would be driven by human developers typing faster. We were wrong. The era of human-centric API sprawl is officially over. The era of agentic sprawl has begun.
The old math: The human speed limit
Our initial model was built on a straightforward, linear human equation. We took the total number of global developers, multiplied it by the percentage of them writing APIs, and then multiplied that by the average number of APIs each developer would churn out annually.
On paper, the compounding growth looked terrifying. To hit our 2030 numbers, the model assumed that by 2026, the average software engineer would be minting nearly 30 net-new APIs a year.
Reality, as it usually does, intervened.
While the global developer workforce did grow, hitting roughly 36 million today, human velocity hit a brick wall. Actual market data shows that today’s developers only produce about 3 to 5 net-new APIs annually. Why? Because the remaining 70% of their time is swallowed whole by maintenance, testing, fixing broken pipelines, and keeping the lights on.
Furthermore, the assumption that nearly every developer would eventually hand-code APIs capped out around 83%. The rise of low-code/no-code platforms and API-first SaaS abstracted the need for ground-up endpoint creation for standard integrations.
If human velocity was the only factor driving the market, our 2 billion API projection would have been a massive, embarrassing overestimation. So, why are we still on track to hit it?
The plot twist: Enter the AI agents
We built a model based on how fast a human could type, completely missing the fact that we were about to hand the keyboard over to the machines.
The variables driving API sprawl have fundamentally shifted. Sprawl is no longer a function of human developer velocity; it is a function of how fast an AI agent can chain endpoints together.
According to recent data from Postman and our own State of Application Strategy Report, over 51% of enterprises have already deployed AI agents into their workflows. These agents don’t interact with software by clicking around a graphical user interface. They interact autonomously by calling APIs. And when an agent lacks the specific integration (usually an API) it needs to complete a task, modern AI development tools will simply generate the necessary micro-APIs on the fly to bridge the gap.
We are currently seeing a staggering 40% year-over-year growth in AI-related API calls. Software is now writing software. The math has shifted from intentional, human-engineered architecture to machine-speed, autonomous generation. We are no longer waiting for a developer to spin up an endpoint; the agent does it in seconds.
The zombie factor and the death of governance
This brings us to the most dangerous flaw in our original model: the deprecation rate.
We naively assumed APIs had a "shelf life" of one to three years. We assumed humans would eventually clean up their messes. But in an agentic workflow, the deprecation rate approaches zero.
Agents spin up ephemeral, temporary endpoints for highly specific, transient workflows. While some are responsibly torn down, a staggering number are simply abandoned in place, inflating the total active count with micro-services that served a single, forgotten prompt.
This is why API sprawl has become an inventory crisis. Current industry aggregates show that 58% of organizations are actively suffering from API sprawl, and a terrifying 78% of IT executives admit they do not know exactly how many APIs they currently have running. In massive global enterprises, roughly 30% of APIs exist entirely outside any governance framework as unmanaged shadow IT.
If a human builds an API, it might get documented in the gateway. If a machine builds an API to talk to another machine at 2:00 AM on a Sunday, it becomes a permanent ghost in your infrastructure.
The 2030 reality check
So, we are maintaining our projection. By 2030, the global ecosystem will absolutely support 2 billion active APIs.
However, the composition of that 2 billion is drastically different than we originally envisioned. Less than 40% of those APIs will be formally documented, human-engineered endpoints sitting securely behind a traditional API gateway. The remaining 60% (or more) will be autonomously generated, undocumented, machine-to-machine integrations.
The challenge for IT leadership over the next four years is no longer managing developer output or improving CI/CD pipelines. It is surviving the security and operational blast radius of invisible, agent-created APIs that your team doesn't even know exist.
Technology is a force multiplier, but adding an AI agent to a poorly governed API ecosystem will only help you make mistakes at a scale and velocity you never thought possible. Get your governance in order now, keep your guardrails tight, and remember: just because an agent can build an endpoint, doesn't mean it should.
About the Author
Lori MacVittie is a Distinguished Engineer and Chief Evangelist in F5’s Office of the CTO with deep expertise in application delivery, automation strategy, and infrastructure. She is known for turning complexity into clarity whether she’s defining guardrails for AI agents, dissecting brittle multicloud architectures, or probing the limits of scalable systems. She brings more than thirty years of industry experience across application development, IT architecture, and network and systems operations. Before joining F5, she served as an award-winning technology editor. MacVittie holds an M.S. in Computer Science and is a prolific author whose publications span security, cloud, and enterprise architecture. She is also an avid tabletop and video gamer with unapologetically strong opinions about cheese.
More blogs by Lori Mac VittieRelated Blog Posts
AI App Delivery Top 10: Incomplete observability
AI won’t scale by itself. Without a unified control plane that collapses tooling and ownership boundaries, inference becomes the most brittle and coordination-heavy tier.
The influence of inference: APIs, DPUs, and context chaos
AI inference reshapes infrastructure, multiplying APIs, stressing compute, and complicating context. Learn why smarter architecture and runtime policy are essential.
Sessions are sticky, context is clingy: How inference cheats to maintain conversations
“Stateless” inference isn’t truly stateless—conversation state is hauled along in tokens each request. That replay drives bandwidth, compute, and latency as context grows.
APIs Are the Gatekeepers for Agentic AI
Learn why APIs are the foundation of Agentic AI, providing structured access to resources, seamless security, and dynamic validation at scale for next-gen agents.
Behavior and boundaries: The agentic security shift
Agents create emergent, unbounded sequences where risk accumulates over time. Security must shift from single-request validation to continuous behavioral governance across multi-step, evolving flows.
AI App Delivery Top 10: Lack of security and regulatory compliance
AI expands compliance from securing paths and stores to governing runtime behavior—model access, retrieval context, outputs, and agent actions—so controls must move closer to inference.