APIs: evolving without breaking your integrations
The day a partner consumes your API, its shape stops belonging to you. The question is no longer “how do I make it better?” but “how do I evolve it without breaking what runs elsewhere?”.
RGAIX team · · 7 min read
Tell compatible changes from the rest
The rule is simple to state: adding is compatible, removing and renaming are not. What makes it hard to apply are the in-between cases that look harmless.
| Change | Compatible? | Why |
|---|---|---|
| Adding an optional field | Yes | Clients ignore what they do not know |
| Making a field required | No | Breaks existing calls |
| Adding an enum value | Rarely | Strict clients reject the unknown |
| Widening a numeric type | Careful | Overflows on the client side |
| Changing the order of a list | Careful | Some clients rely on it |
The third line is the most underestimated: adding a new status to an enum breaks every client that strictly validates the values it receives. It is an addition, and yet it is a break.
Document what is not guaranteed
An API contract must say what can be relied on, but above all what cannot: the order of fields, the exact shape of identifiers, the presence of undocumented fields, the stability of natural-language error messages.
Without that list, every observed detail becomes an implicit guarantee. Integrators rely on what they see, not on what you intended to promise.
Version as little as possible
A new major version doubles the maintenance cost and forces every partner to plan a migration. Reserve it for unavoidable breaks, and prefer adding fields, progressive deprecation and default values.
- Add the new field next to the old one, removing nothing.
- Announce the deprecation with a date, in the documentation and in a response header.
- Measure who still uses the old field, by logging the calls.
- Warn the last remaining users individually before removal.
Make errors usable
An integration breaks more often on error handling than on the happy path. A stable machine-readable code, a natural-language message for humans, and a correlation identifier to find the call in your logs: those three elements avoid most round trips.
State what is safe to retry as well. A partner who does not know whether their request was taken into account will try again — and create a duplicate if you have not planned an idempotency key.
An API is a promise kept over time. What makes it reliable is not its elegance, but the predictability of its changes.
Related pages
Web & mobile development
Software that serves your business.
Discover the service ↗READ NEXTTaking over an existing project: the ten entry checks
Before writing the first line, ten checks say whether the takeover is feasible, expensive, or impossible as things stand.
Read the article ↗READ NEXTIncident response: collect the evidence before cleaning up
Cleaning a compromised server without looking for the entry point guarantees a repeat. The order of the steps matters more than their speed.
Read the article ↗Let’s talk about what is blocking you.
An emergency, a profile to find or a project to structure: let’s start with your need.
