API usage is expanding across teams, products, and geographies, while security incidents and governance gaps remain material. The latest Postman, Akamai, and Cloudflare research places APIs at the center of software delivery, digital revenue, and internet traffic.
Table of contents
- API adoption and ecosystem size
- API-first development and delivery
- Protocols and API consumption
- Testing, documentation, and governance
- API security incidents and costs
- API attacks, exposure, and traffic
API adoption and ecosystem size
Postman’s 2024 State of the API Report recorded more than 35 million Postman users in 2024, compared with 25 million in 2023. The same report said Postman collections were being created in 266 countries, illustrating the geographic reach of API development activity. Even Antarctica saw 10 collections built during the year. These figures describe activity on the Postman platform and should not be read as a complete count of all API work worldwide.
The Postman API Network contained more than 100,000 APIs in 2024, contributed by more than 18,000 companies (Postman 2024 State of the API Report). Among respondents, 71% were engineers or developers. That professional mix is important when interpreting the report’s adoption and workflow findings: the results reflect a large technical audience, not a general population sample.
API-first practices also became more common in the 2024 report. Seventy-four percent of respondents said their organizations were API-first, up from 66% in 2023 (Postman 2024 State of the API Report). The report also found that 47% of developers could produce an API within a week in the prior year, while 63% said they could do so in 2024.
The business role of APIs was substantial. Sixty-two percent of respondents worked with APIs that generated income, and for 21% of companies, APIs drove more than 75% of total revenue (Postman 2024 State of the API Report).
API-first development and delivery
The 2023 Postman report connected API-first development with several reported benefits. More than 75% of respondents agreed that developers at API-first companies were more productive, created better software, and integrated faster with partners. The following benefits were cited by respondents:
- Performance benefits: 68%.
- Security benefits: 68%.
- Reliability benefits: 66%.
- Documentation benefits: 64%.
- Scalability benefits: 56%.
The 2023 report also identified API-first leaders within particular groups. Eleven percent of respondents rated themselves as highly API-first leaders. At companies with 1,000 or more developers, 15% of respondents were API-first leaders. Financial services also recorded 15% of respondents in that category (Postman 2023 State of the API Report).
The 2024 findings point to faster delivery, but not uniformly trouble-free change. Fifty-six percent of API changes succeeded with minimal issues. At the other end of the distribution, 5% of respondents experienced API change failure rates above 25%. API-first leaders were 83% likelier to say they could restore a failed API in under an hour (Postman 2024 State of the API Report).
AI was another visible area of movement. AI-related traffic across the Postman platform increased by nearly 73% in 2024. Fifty-four percent of respondents were using ChatGPT in 2024, while 43% planned to use it the following year. At the same time, 18% planned to skip AI entirely the next year (Postman 2024 State of the API Report).
Protocols and API consumption
The 2023 Postman State of the API Report measured use across several API and event-driven technologies. REST remained the most widely used protocol in the supplied figures, although its reported share declined across the preceding three measurements.
| Technology | Reported usage |
|---|---|
| REST, 2023 | 86% |
| REST, one year earlier | 89% |
| REST, two years earlier | 92% |
| Webhooks, 2023 | 36% |
| GraphQL, 2023 | 29% |
| SOAP, 2023 | 26% |
| WebSockets, 2023 | 25% |
| gRPC, 2023 | 11% |
| MQTT, 2023 | 9% |
| AMQP, 2023 | 9% |
| Server-Sent Events, 2023 | 6% |
| EDI, 2023 | 4% |
| EDA, 2023 | 3% |
These are survey shares, not market-share measurements. The figures show that REST was reported by 86% of respondents in 2023, while event-oriented options such as Webhooks and WebSockets appeared at 36% and 25%, respectively (Postman 2023 State of the API Report).
API consumption was most often connected to internal integration. Sixty-seven percent of respondents cited internal integration as a factor in API consumption. External integration followed at 57%. Other reported reasons included adding or enhancing functionality in internal applications at 49%, speeding up development timelines at 48%, and reducing development costs at 45%.
Forty-two percent cited adding or enhancing functionality in products and services for customers. Reducing operating costs was cited by 40%, while improving organizational security or IT governance was cited by 30% (Postman 2023 State of the API Report).
Testing, documentation, and governance
API creation and oversight were distributed across different organizational structures in the 2024 Postman report. Forty-eight percent said API creation was owned by the development team. The same share, 48%, said a central team oversaw API strategy and governance. Forty percent reported a business-oriented directive guiding API development.
Developers also reported varied ways of understanding APIs. Forty-four percent said they dig through source code to understand APIs. Only 1% admitted that they do not test APIs. Among named testing priorities, performance testing was used by 45% of respondents and security testing was prioritized by 37% (Postman 2024 State of the API Report).
Security tooling was not universal. Twenty-seven percent did not use API key vault security tools. Among those who did, 28% favored AWS Key Management and 24% favored Azure Key Vault (Postman 2024 State of the API Report). These percentages describe reported preferences among the relevant respondents; they should not be combined into a complete ranking of every key-management option.
Akamai’s 2024 API Security Impact Study adds a production-lifecycle perspective. Only 13% of respondents tested APIs in real time from development through production, and only 18% tested APIs daily across that lifecycle. Among enterprises with full API inventories, just 27% knew which APIs returned sensitive data (Akamai 2024 API Security Impact Study).
API security incidents and costs
Akamai reported that 84% of respondents experienced an API security incident in the past 12 months. The country-level figures were 83% in the United States, 83% in the United Kingdom, and 84% in Germany. In the study’s earlier measurements, the 2022 incident rate was 76% overall, 75% in the United States, and 77% in the United Kingdom. In 2023, the rate was 78% overall, 85% in the United States, and 69% in the United Kingdom (Akamai 2024 API Security Impact Study).
The study said API incidents rose for three straight years during its study period. Reported impacts included increased stress or pressure for the team at 27.0%, harm to department reputation with senior leaders or the board at 26.6%, and costs incurred to help fix the issue at 25.8%.
Other reported impacts were fines from regulators at 25.4%, loss of customer goodwill and churned accounts at 25.0%, loss of productivity at 24.1%, loss of trust and reputation at 23.8%, and loss of employee goodwill at 23.8%. Increased internal scrutiny by the business was cited by 23.5% (Akamai 2024 API Security Impact Study).
Remediation costs varied by country. The average cost for U.S. respondents was $591,404, compared with £420,103 for U.K. respondents and €403,453 for German respondents. U.S. C-suite respondents reported an average cost of $943,162 to address API incidents, nearly 60% above the U.S. average (Akamai 2024 API Security Impact Study).
The study also included a Gartner-quoted comparison stating that API breaches leaked at least 10 times more data than the average security breach. This is a reported comparison in the Akamai study, not an independently verified estimate here.
API attacks, exposure, and traffic
Akamai recorded 108 billion API attacks from January 2023 through June 2024. Web application and API attacks rose by 49% between the first quarter of 2023 and the first quarter of 2024 (Akamai 2024 API Security Impact Study).
Cloudflare’s 2024 API Security and Management Report identified additional exposure and traffic measurements. Nearly 60% of organizations permitted write access to at least half of their APIs. Machine learning found about 31% more API endpoints than customers had self-reported, pointing to a gap between declared inventories and observed endpoint counts.
Too Many Requests responses, or 429 errors, represented 51.6% of API error rates in the Cloudflare report. Blocking DDoS attacks accounted for 33% of API mitigation techniques. APIs represented 57% of internet traffic, while Cloudflare served more than 50 million HTTP requests per second on average and blocked an average of 170 billion cyber threats each day (Cloudflare 2024 API Security and Management Report).
Taken together, these figures describe an API environment that is broad, revenue-connected, and increasingly central to software delivery. They also show why inventory accuracy, lifecycle testing, access control, change recovery, and security testing remain practical priorities for organizations building services across media and streaming ecosystems.