Treblle Blog
What matters in the enterprise API world.
OpenAPI 3.2 Is Here. What Actually Changes for API Developers?
OpenAPI 3.2 breaks nothing in 3.1. The real changes: schemas for streaming APIs, native tag hierarchy, the QUERY method, and modern OAuth flows.
Should AI Agents Have Their Own Identity? Okta Thinks So.
Okta's 2026 releases give AI agents their own identity record, tokens, and delegation chain. Identity controls access. It doesn't record what agents do.
WorkOS Breach: Why Every Internal API Is Now a Public API
An attacker reached Salesforce and Snowflake data through a WorkOS internal API. Why internal APIs now need public-API security and runtime visibility.
OpenAPI Describes Your API. But Who Tells AI Agents How to Use It Safely?
OpenAPI tells AI agents what an API can do, not what is safe to do. Overlays, Arazzo, and MCP annotations add context. Runtime checks still decide.
The Manchester Airports breach didn't need a hacker. It needed an API key nobody was watching
Manchester Airports Group lost 8.8 million records to an API key sitting in public JavaScript for four years. The real failure was runtime visibility and API governance.
SAFR Assumes You Have Treblle
SAFR (Safeguards for Agentic Finance at Runtime) is a white paper published in July 2026 by the Monetary Authority of Singapore's BuildFin.ai program, written with eight industry members including HSBC, J.P. Morgan Chase, Mastercard, and Visa. It specifies a runtime governance checkpoint for AI agents in financial services, built around four components: Agent Identity, Controls Repository, Disposition Engine, and Audit Log.
