API sprawl is hard in any domain. In IoT device management and access control, it becomes exponentially harder. In our case:

• ~10 API products
• Overlapping customer problems and customer segments
• APIs responsible for IoT device lifecycle management, access control, and policy enforcement
• Live integrations across cloud, edge, and on-premise environments
• Multiple teams owning different APIs, device models, and commercial contracts

This creates unique challenges:

• The same physical device exposed through multiple APIs
• Fragmented developer experience
• High operational risk when consolidating APIs that directly control real-world access
• Migration is not just about endpoints—it affects devices already deployed in the field

The core problem: Our APIs evolved around teams and products, while devices, customers, and security policies cut across them.

Solution: This talk shares how we are re-architecting toward a single API platform for IoT device management and access control—while keeping existing customers and devices operational. The process:

1. Reframing APIs around devices and customer intent
2. Platform foundations that reduce structural cost
3. Consolidation without bricking devices
4. Organizational and commercial alignment to stop cost leakage