Why Defensive API Design Means Treating Every External Interface as Unreliable

Software engineer Sergey Shinder argues that the most serious system failures he has encountered originated not from internal code but at the boundaries where his system communicated with external APIs. He outlines a pragmatic defensive approach: every outbound call must have a timeout, every response must be validated before use, and every dependency failure must have a deliberate handling plan such as retries, fallbacks, or clean error propagation. A key principle he highlights is the Circuit Breaker pattern, which stops a system from repeatedly calling a failing external service, giving it time to recover while protecting internal stability. Shinder emphasizes that the goal is not to prevent all errors — since external systems are outside one's control — but to ensure that another system's failure does not automatically become your own. He concludes that the integration boundary between two systems is the most vulnerable point in any architecture and deserves the most careful engineering attention.