API Change and Platform Dependency Research Note

API Change and Platform Dependency Research Note

Finding

An upstream API change can alter access, fields, authentication, rate limits, permitted uses, attribution, display, storage, downstream sharing, webhook behavior, and termination rights. The dependent product must treat the change as a product, engineering, data, contract, privacy, support, and communication event.

Strava's current API agreement permits modification or discontinuation and imposes use restrictions. Garmin's June 30, 2025 guidelines apply attribution to primary displays, secondary screens, exports, APIs, social sharing, and materially influenced derived data. These are current records, not universal norms.

GitHub and Stripe demonstrate provider practices that reduce uncertainty through versioning, notices, migration guidance, testing, and limited rollback or support periods. A dependent team should not assume its provider offers the same protections.

Dependency model

Record the upstream provider, input, user journey, permitted use, technical path, data stored, downstream recipients, commercial contribution, failure signal, substitute, exit time, and owner.

Concentration is not the only risk. A dependency can be dangerous because access is revocable, the product cannot reproduce the input, migration takes too long, the user relationship belongs upstream, or contractual terms prevent the intended value.

Publication rule

Do not interpret a reader's contract or promise API continuity. Present adapt, negotiate, replace, narrow, and exit as product options that require technical, commercial, privacy, and legal review.