Nordic APIs 2026: your next customer is an agent

Three days at the Clarion Hotel Stockholm

From 12 to 14 October, Nordic APIs held its Summit at the Clarion Hotel Stockholm under the theme Evolving APIs for the Agentic Era. The show was there as an event partner, and the host, Luca Berton, was also on the programme. Between the sessions the show also recorded conversations with seven guests; who they are is further down. Where the show did film this season is in the overview of the conferences of 2026.

One sentence holds the week together: the next caller of your API is not a human, and most of what was built for humans — keys, consent screens, pre-registration, error messages — breaks when an agent arrives.

Monday: the Great Sticky Wall

The half-day UnConference opened with no agenda. Facilitators asked attendees to write topics on sticky notes, and the notes went onto a whiteboard that filled three rooms and three time blocks.

What people chose to spend a free afternoon on is the finding. Of nine topics, at least five were about agents and the rest about security or quality. Nobody proposed a session on designing a nicer REST endpoint. The questions were how to find agent traffic nobody knew about, what OWASP means when the client is an LLM, and what “human in the loop” actually means in an implementation.

Tuesday: three keynotes, one message

Bankettsalen was full by nine. Nordic APIs put more than sixty speakers on this year’s programme, and the opening room looked the part.

Bill Doerrfeld: the patterns that change

Bill Doerrfeld, Editor in Chief of Nordic APIs, opened by showing how integration used to work. His slide Finding APIs, circa 2016 listed twelve steps, from searching the internal wiki to requesting access from the owning team and waiting. Days to weeks, before a line of integration code.

Two numbers from that keynote are worth carrying around. Seventy per cent of MCP tools do not tell an agent why a call failed or what to do next, from Arcade.dev’s ToolBench, which graded more than 92,000 MCP servers and 640,000 tools. And 49.8% of respondents to Salt Security’s State of Agentic AI and API Security 2H 2026 confirmed or suspected that an agent had taken an action their organisation did not intend, expect or authorise; over half of those reported an unauthorised external API call or transaction.

He told the story of an agent given free rein to run a café in Sweden, which ordered 3,000 rubber gloves for two employees and went $16,000 over budget. The slide after it was titled Wait, this isn’t silly anymore…

His framing: agents act on delegated intent. One intent becomes dozens or hundreds of calls, made under delegated authority at machine speed, and permissions accumulate into privilege drift.

Jacob Ideskog: a front door for strangers

Jacob Ideskog, CTO of Curity, gave the keynote the rest of the week kept referring back to. He started with a village store where a child arrives with a note from a parent. No ID, no card, no signature — just a note. The shopkeeper trusts it because everyone knows everyone. Agents are that child, and the internet is not a village.

His reframing cuts through most AI security talk: internal agents are a CISO problem, the back office being reorganised. The real shift is external agents arriving as customers — casual browsers evaluating your API, tourists who sign up once and leave an abandoned account behind as a risk you keep carrying, and regulars who become your best customers.

For everything past the entrance, his point was that nothing needs inventing: FAPI 2.0 for sender-constrained tokens, token exchange so delegation is explicit, rich tokens and narrow context tokens. Banks arrived here first, under open banking, where every call could be fraud.

He closed by turning security into a commercial argument: agents don’t just get through safely, they prefer to shop there.

Jeroen Delbarre: governance and budgets

Jeroen Delbarre, Director Product Line at Axway, brought the enterprise figures — around 62% of organisations experimenting with agents (McKinsey), fewer than 5% of enterprise applications with agents in 2025 against roughly 40% expected by the end of 2026 (Gartner), and 88% of executives planning to raise AI budgets (PwC). His three risks each had a headline: data leakage, costs out of control, uncontrolled actions. One of them was an agent that cost $47,000 while everyone assumed it was working.

Three speakers, one message: identity, delegation and budget are now API design problems.

The breakouts

With three parallel tracks, these are the rooms the host sat in.

Andrea Arcuri of Kristiania University of Applied Sciences showed how fuzzing finds access-control bugs automatically, and where it stops. A fuzzer can easily replay user A’s request as user B. The hard question is what a 200 means: a broken object-level authorisation bug, or a user who genuinely had rights.

Andreas Siegel of pentacor gave the most practical MCP session of the day, built around four walls every agent hits — discovery, security, client wiring and governance — and a live demonstration of the anti-pattern, where an agent asks for an API key in chat and the secret ends up in prompt history and logs.

The sharpest number of the day came from a lightning demo. WunderGraph compared a frontier model exploring a GraphQL schema on its own against their prompt-to-capability approach on the same question. The model took 33.6 seconds, eleven turns, thirteen tool calls and 58,000 input tokens, at $0.256. The alternative took 4.9 seconds and three model calls, at $0.0048. Letting the agent wander was 6.8 times slower and 54 times more expensive.

Jonas Iggbom of Curity went deeper on agent identity with four questions to put to an authorisation server vendor, Pavel Kornev of SAP presented Open Resource Discovery — now carrying MCP servers and agents as first-class citizens, and donated to the NeoNephos Foundation — and Lin Sun of Solo.io ran an almost entirely live demo of agentgateway. Thierno Diallo of Axa France presented the API Green Score, whose advice turns out to apply to agents too: smaller exchanges reduce avoidable work, and every unnecessary field an agent reads costs tokens.

Wednesday

The host was on the Wednesday programme in the Production Agent Systems track, in Bankettsalen, with The API Guardrails Behind Safe Multi-Tenant AI Platforms — six platform decisions between an AI demo and a platform, one legal-research agent built twice, and a ninety-minute lab.

Recorded in Stockholm

Six of the seven have their episode page now, with no release date yet.

On Tuesday:

• Viola Marku, Head of Customer Success at WunderGraph, on GraphQL federation for agentic workflows, and why adoption is a human problem.
• Vidar Seland, Product Manager for OBOS ID at OBOS.

On Wednesday:

• Erik Wilde, OAI Ambassador at the OpenAPI Initiative, on the OpenAPI, Arazzo and Overlays specifications, and deterministic workflows for agents.
• Jacob Ideskog, CTO and co-founder of Curity, on the move into the AI era as a transition other industries have made before, like the village store of his keynote, only at a much larger scale.
• Andi Mann, Chief Product and Technology Officer at Apica, on what observability means when agentic systems are non-deterministic, and his advice for founders.
• Curtis Schofield of PagerDuty.
• Gertrude Chilufya of Reframe Tech.

The thread

Nobody in Stockholm was selling the idea that agents are a feature you add. Every speaker described an obligation that lands on whoever runs the platform: knowing which agent is calling, making delegation explicit, capping what it can spend, and proving afterwards who approved what. Jacob Ideskog’s line about the banks applies to the whole week. They did not build sender-constrained tokens and strong client authentication because they were visionaries. They did it because they had no choice, and now neither does anyone else.

Where to read more

• The host’s day one notes, keynote by keynote, with the slide figures and their sources.
• What the summit set out to do, written before the event.

Next

New episodes every Tuesday, on YouTube first, then Apple Podcasts, Spotify and Amazon Music; every platform is listed on the home page.

Built something the rest of us run on? Being a guest is free: how it works.