AI agents are now your APIs' biggest, weirdest consumers. They call 100x more often than humans, hallucinate parameters, retry on every ambiguity, fish your schema for tools you did not advertise, and read your error messages as prompts. Most APIs were not designed for this caller. The result in production today: retry storms, tool-spec drift, runaway costs, and audit trails that cannot tell a real user from an agent acting on their behalf.
This is a practical, pattern-driven talk for engineers, architects, and platform leads whose APIs are about to be hit, or already are.

I walk through eight patterns that decide whether your API survives agentic traffic:
1. Idempotency that survives non-deterministic callers, not just network retries.
2.Tool-spec design: naming, descriptions, and parameter shapes LLMs do not get wrong.
3.Capability-scoped tokens for agents, instead of broad API keys.
4.Backpressure and adaptive rate limits keyed to agent identity, not just IP.
5.Schema evolution when consumers cannot read changelogs.
6.Error messages as prompts: structured, actionable, safe to feed back to a model.
7.Observability that traces the agent to tool to downstream chain, with agent identity as a first-class span attribute.
8.Cost protection: semantic dedup, response caching, query budgets, and circuit breakers on token spend.

For each pattern I show the failure in code, the fix, and the operational signal that tells you it is working. Halfway through, I leave the slides for a live walkthrough of a reference API hardened against agent traffic, with a runnable harness that simulates a misbehaving agent so I can break and fix defenses on stage.

This is not about MCP, AP2, or any specific framework. The patterns hold whether your callers are LangChain or custom orchestrators. If your API will be called by something that is not a human in 2027, this is for you.

You leave with eight named patterns, working code, and a checklist your team can run on Monday.