More than half of the dynamic, non-cacheable HTTP traffic that Cloudflare processes is now API-related (Cloudflare Radar, 2025 Year in Review). APIs stopped being plumbing and became the product: 89 percent of developers now use generative AI daily, but only 24 percent design APIs for AI agents (Postman, 2025 State of the API Report), and 65 percent of organizations already earn revenue from their APIs (Postman, 2025). The flip side is exposure - Akamai recorded an average of 258 API attacks per organization per day in 2025, up 113 percent year over year (Akamai, State of the Internet 2026). This analysis consolidates data from Postman, Cloudflare Radar, Akamai, Salt Security, Gartner, SlashData, F5, Kong, and several market-research firms into one reference. Every figure below is attributed to the primary report it came from, with the year noted.
TL;DR
- More than 50 percent of dynamic HTTP traffic seen by Cloudflare is API-related (Cloudflare Radar, 2025 Year in Review).
- 82 percent of organizations follow some API-first approach; 25 percent are fully API-first, up 12 percent from 2024 (Postman, 2025 State of the API Report).
- 65 percent of organizations generate revenue from their APIs (Postman, 2025).
- More than 30 percent of the increase in API demand through 2026 will come from AI and LLM tools (Gartner, 2024).
- 99 percent of organizations experienced an API security issue in the past 12 months (Salt Security, Q1 2025 State of API Security Report).
- 87 percent of organizations reported an API-related security incident in 2025 (Akamai, State of the Internet 2026).
- Akamai documented 150 billion API attacks between January 2023 and December 2024 (Akamai, State of the Internet 2025).
- Global developer population reached 47.2 million in 2025 (SlashData, Global Developer Population Trends 2025).
- 95 percent of organizations use API gateways, up from 35 percent in 2019 (F5, 2025 State of Application Strategy).
- Kong projects the global economic impact of APIs will reach 17.3 trillion USD by 2030 (Kong, 2024 API Impact Report).
- Go accounts for 20 percent of automated API requests, up from 12 percent in 2024 (Cloudflare Radar, 2025).
- Only 10 percent of developers use Model Context Protocol (MCP) regularly, though 70 percent are aware of it (Postman, 2025).
1. Market Size and Economic Impact
Sizing the API economy depends entirely on where you draw the boundary. Narrow “API management” software markets land in single-digit billions; broader “economic impact” estimates that count the revenue APIs enable run into the trillions. Kong projects APIs will carry a global economic impact of 17.3 trillion USD by 2030 - a figure that counts the business activity APIs sit underneath, not licensing spend. Treat the trillion-dollar numbers as directional impact estimates and the billion-dollar figures as addressable software spend. For the software layer specifically, independent firms cluster the 2026 management and marketplace markets in the 8-to-25 billion USD range, which is the number to use for budgeting rather than headline-grabbing. See our SaaS statistics roundup for how API monetization folds into broader software revenue.
| Metric | Value | Source |
|---|---|---|
| Projected global economic impact of APIs by 2030 | 17.3 trillion USD | Kong, 2024 API Impact Report |
| Projected global economic impact of APIs by 2027 (earlier estimate) | 14.2 trillion USD | Kong, 2023 API Impact Report |
| API management market, 2025 to 2026 | 6.89B to 8.77B USD | Fortune Business Insights, 2025 |
| API management market, 2034 (projected) | 37.43 billion USD (21.7% CAGR) | Fortune Business Insights, 2025 |
| API marketplace market, 2025 to 2026 | 21.3B to 25.1B USD | Grand View Research, 2025 |
| API marketplace market, 2033 (projected) | 82.1 billion USD (18.4% CAGR) | Grand View Research, 2025 |
| API economy market, 2025 to 2026 | 17.13B to 20.21B USD (17.9% CAGR) | The Business Research Company, 2026 |
Outlier note: Kong’s 2024 report also forecasts the value of APIs to enable AI will grow 170 percent, and a 548 percent rise in the annual number of API attacks by 2030 (Kong, 2024 API Impact Report). Software-market figures from Fortune Business Insights and Grand View Research diverge because they scope “management” versus “marketplace” differently.
2. APIs Now Dominate Internet Traffic
The clearest sign that the API economy is real shows up in raw packets, not surveys. More than half of the dynamic (non-cacheable) HTTP traffic Cloudflare handles is API-related, and most of it is automated rather than generated by a person in a browser. That matters because it reframes “traffic” as machine-to-machine by default: the audience for most requests is other software. The client-language mix also tells a story - Go, Python, and Java all gained share in 2025 as backend and data-pipeline workloads increasingly talk directly to APIs. For the infrastructure powering all this, see our cloud computing statistics.
| Metric | Value | Source |
|---|---|---|
| Share of dynamic HTTP traffic that is API-related | More than 50% | Cloudflare Radar, 2025 Year in Review |
| Bot share of overall web traffic (2025) | 53% to 58% | Cloudflare Radar, 2025 Year in Review |
| AI crawler share of HTML request traffic | 4.2% | Cloudflare Radar, 2025 Year in Review |
| Go share of automated API requests | 20% (up from 12% in 2024) | Cloudflare Radar, 2025 Year in Review |
| Python share of automated API requests | 17% (up from 9.6% in 2024) | Cloudflare Radar, 2025 Year in Review |
| Java share of automated API requests | 11.2% (up from 7.4% in 2024) | Cloudflare Radar, 2025 Year in Review |
| JSON share of API request payloads | ~97% | Cloudflare, Landscape of API Traffic (2021) |
| API calls as share of total requests | 54% | Cloudflare, Landscape of API Traffic (2021) |
Outlier note: the JSON share and the 54 percent total-request figure are most recent available from Cloudflare’s dedicated API-traffic analysis (Cloudflare, Landscape of API Traffic, 2021); the current traffic-dominance and client-language figures come from the 2025 Year in Review.
3. The AI-API Convergence
The defining shift of 2025 is that APIs are no longer consumed only by apps - they are consumed by agents. 89 percent of developers use generative AI daily, yet only 24 percent design APIs with AI agents as a consumer in mind - the single widest gap in Postman’s dataset and a warning that most API surfaces were not built for autonomous callers. Gartner’s demand forecast reinforces the trajectory from the buyer side. The Model Context Protocol, which standardizes how models call tools, shows the classic early-adoption shape: broad awareness, thin regular use. Because agents are prolific API callers, this theme connects directly to our AI agents statistics.
| Metric | Value | Source |
|---|---|---|
| Developers using generative AI daily | 89% | Postman, 2025 State of the API Report |
| Developers who design APIs for AI agents | 24% | Postman, 2025 State of the API Report |
| Year-over-year growth in AI API calls on Postman | 40% (7.53M calls) | Postman, 2025 State of the API Report |
| Developers aware of MCP / using it regularly | 70% / 10% | Postman, 2025 State of the API Report |
| Top AI-agent security concern (unauthorized or excessive calls) | 51% | Postman, 2025 State of the API Report |
| Increase in API demand from AI and LLM tools by 2026 | More than 30% | Gartner, 2024 |
| Enterprises using generative AI APIs or apps by 2026 | More than 80% | Gartner, 2023 |
Outlier note: OpenAI accounted for 56 percent of AI traffic (4.2M calls) on Postman’s platform, while Gemini and Llama grew 3.1x and 6.9x year over year respectively (Postman, 2025 State of the API Report). Gartner’s demand forecast appears in its 2024 press release.
4. API-First Adoption and Developer Practices
Adoption is broad but shallow at the top end: most organizations do some API-first work, but only a quarter run fully API-first. 95 percent of organizations now use API gateways, up from 35 percent in 2019 - the sharpest structural change F5 has tracked, and evidence that API management moved from optional to default infrastructure. The developer base underneath is large and still growing, though the growth rate is cooling as the professional cohort matures. The persistent gateway sprawl and pain-point signal from F5 explains why governance keeps surfacing as an unsolved problem. For the people behind these numbers, see our developer survey statistics.
| Metric | Value | Source |
|---|---|---|
| Organizations following some API-first approach | 82% | Postman, 2025 State of the API Report |
| Fully API-first organizations | 25% (up 12% from 2024) | Postman, 2025 State of the API Report |
| Developers spending 10+ hours per week on API work | 69% | Postman, 2025 State of the API Report |
| Teams using REST / GraphQL | 93% / 33% | Postman, 2025 State of the API Report |
| Global developer population, 2025 | 47.2 million | SlashData, Global Developer Population Trends 2025 |
| Professional developer growth, 2022 to 2025 | +70% (21.8M to 36.5M) | SlashData, 2025 |
| Organizations using API gateways | 95% (up from 35% in 2019) | F5, 2025 State of Application Strategy |
| Organizations saying APIs have become a pain point | 58% | F5, 2025 State of Application Strategy |
Outlier note: SlashData reports developer-population growth decelerated to 10 percent in the last 12 months (SlashData, 2025); F5’s gateway and pain-point figures come from a survey of roughly 650 IT decision-makers (F5, 2025 State of Application Strategy).
5. Monetization and Revenue
APIs have crossed from cost center to profit center for most of the market. 25 percent of organizations that monetize APIs say APIs generate more than half of their total revenue - a threshold that turns an integration layer into a business model. The gradient by maturity is steep: fully API-first companies monetize far more aggressively than the rest, which is the strongest argument in the data for treating API strategy as revenue strategy rather than engineering hygiene. Investment intent confirms the direction, with far more organizations planning to spend more than to pull back.
| Metric | Value | Source |
|---|---|---|
| Organizations generating revenue from APIs | 65% | Postman, 2025 State of the API Report |
| Organizations where APIs drive 10%+ of total revenue | 74% | Postman, 2025 State of the API Report |
| Organizations where APIs drive 50%+ of total revenue | 25% | Postman, 2025 State of the API Report |
| Fully API-first orgs generating 25%+ of revenue from APIs | 43% | Postman, 2025 State of the API Report |
| Organizations planning to increase API investment (next 12 months) | 46% (vs 11% cutting) | Postman, 2025 State of the API Report |
| Projected US economic impact of APIs by 2030 | 3.4 trillion USD | Kong, 2024 API Impact Report |
| Developers saying AI investment created new-product opportunities | 83% | Kong, 2024 API Impact Report |
Outlier note: 20 percent of fully API-first organizations say APIs generate more than 75 percent of revenue, more than double the rate of other organizations (Postman, 2025 State of the API Report). Kong’s economic-impact framing appears in its 2024 API Impact Report.
6. API Security Under Siege
The same reach that makes APIs valuable makes them the preferred target. 99 percent of organizations experienced an API security issue in the prior 12 months - effectively the entire market - and Akamai’s daily-attack average more than doubled year over year. The most instructive figure is that 95 percent of API attacks came from authenticated sources, which means the perimeter is not the problem; abuse of legitimate access is. Governance remains the weak point, with only a small minority running any formal API posture strategy. The AI wave compounds this: automation makes attack campaigns cheaper and faster, and AI-generated code introduces new flaws.
| Metric | Value | Source |
|---|---|---|
| Organizations experiencing an API security issue (past 12 months) | 99% | Salt Security, Q1 2025 State of API Security Report |
| Organizations reporting an API-related security incident (2025) | 87% | Akamai, State of the Internet 2026 |
| Average daily API attacks per organization (2025) | 258, up 113% from 121 in 2024 | Akamai, State of the Internet 2026 |
| API attacks originating from authenticated sources | 95% | Salt Security, Q1 2025 |
| Attack attempts targeting external-facing APIs | 98% | Salt Security, Q1 2025 |
| Total web attacks in 2024 | 311 billion, +33% YoY | Akamai, State of the Internet 2025 |
| API attacks, January 2023 to December 2024 | 150 billion | Akamai, State of the Internet 2025 |
| Organizations with a formal API posture governance strategy | 10% (43% plan one) | Salt Security, Q1 2025 |
Outlier note: 61 percent of API attacks in 2025 involved unauthorized workflows or abnormal activity, up from 30 percent in 2024 (Akamai, State of the Internet 2026); Salt Security’s authenticated-attack and governance figures come from its Q1 2025 report. For defensive context, see our cybersecurity statistics.
Summary: API Economy by the Numbers
| Metric | Value | Source |
|---|---|---|
| Projected global economic impact of APIs by 2030 | 17.3 trillion USD | Kong, 2024 API Impact Report |
| API management market, 2026 (projected) | 8.77 billion USD | Fortune Business Insights, 2025 |
| API marketplace market, 2033 (projected) | 82.1 billion USD | Grand View Research, 2025 |
| Share of dynamic HTTP traffic that is API-related | More than 50% | Cloudflare Radar, 2025 Year in Review |
| Bot share of overall web traffic (2025) | 53% to 58% | Cloudflare Radar, 2025 Year in Review |
| Go share of automated API requests | 20% | Cloudflare Radar, 2025 Year in Review |
| Developers using generative AI daily | 89% | Postman, 2025 State of the API Report |
| Developers who design APIs for AI agents | 24% | Postman, 2025 State of the API Report |
| Increase in API demand from AI and LLM tools by 2026 | More than 30% | Gartner, 2024 |
| Organizations following some API-first approach | 82% | Postman, 2025 State of the API Report |
| Global developer population, 2025 | 47.2 million | SlashData, 2025 |
| Organizations using API gateways | 95% | F5, 2025 State of Application Strategy |
| Organizations generating revenue from APIs | 65% | Postman, 2025 State of the API Report |
| Organizations where APIs drive 50%+ of revenue | 25% | Postman, 2025 State of the API Report |
| Organizations experiencing an API security issue (12 months) | 99% | Salt Security, Q1 2025 |
| Organizations reporting an API-related incident (2025) | 87% | Akamai, State of the Internet 2026 |
| Average daily API attacks per organization (2025) | 258 (+113%) | Akamai, State of the Internet 2026 |
| API attacks, January 2023 to December 2024 | 150 billion | Akamai, State of the Internet 2025 |
| Projected US economic impact of APIs by 2030 | 3.4 trillion USD | Kong, 2024 API Impact Report |
Methodology and Sources
Data was gathered by aggregating figures directly from primary reports, vendor research, analyst press releases, and market-research firms published in 2024 to 2026, with each statistic traced to the original publisher and dated to the report year rather than the year it was quoted elsewhere.
- Postman - 2025 State of the API Report (7th annual; 5,700+ developers, architects, and executives surveyed)
- Cloudflare - Radar 2025 Year in Review and Landscape of API Traffic (2021)
- Akamai - State of the Internet 2026 (Apps, APIs, and DDoS) and State of the Internet 2025 (Web Application and API attacks)
- Salt Security (Salt Labs) - Q1 2025 State of API Security Report
- Gartner - API demand from AI and LLMs press release (2024) and generative AI APIs adoption press release (2023)
- SlashData - Global Developer Population Trends 2025
- F5 - 2025 State of Application Strategy Report (~650 IT decision-makers)
- Kong - 2024 API Impact Report / Economic Impact of APIs
- Fortune Business Insights - API Management Market (2025)
- Grand View Research - API Marketplace Market (2025)
- The Business Research Company - API Economy Global Market Report 2026
Data watch: Postman’s State of the API Report is published annually in Q4, so the 2026 edition is expected around October 2026; Cloudflare’s Radar Year in Review lands each December; Akamai’s State of the Internet security reports publish in spring; Salt Security refreshes its State of API Security roughly annually; SlashData updates its developer-population estimates each quarter; and F5’s State of Application Strategy publishes annually. Market-research figures (Fortune Business Insights, Grand View Research, The Business Research Company) diverge by scope and are cross-referenced rather than treated as a single canonical number.
Last updated: July 16, 2026.
We review and update this page quarterly as new data is published.