An API marketplace designed for customers who might not be human

Telecoms grew up building a flow for every customer need. The API Marketplace was T-Mobile deciding to stop: open the systems themselves, let enterprise developers integrate directly — and design for a near future where the "user" placing a 10,000-line order might be a person, an AI agent, or both taking turns.
01Inverting the company
This wasn't a feature; it was the model turned inside out, touching effectively every part of the offering. The context that made it hard is the context that made it necessary: a marketing-first company running on roughly 200 codebases of legacy infrastructure, where every new customer need historically meant another bespoke build. A developer-first platform was the exit from that treadmill — and we could already see where MCP-style agent integration was heading: our future users would be a mix of human and AI.
02Decision: AI interprets, the interface confirms
The default path was the familiar one: forms. Enterprise admins manually keying employee and order data into UI screens, the way it had always worked. I argued we should stop designing for manual input at all — let customers hand us the data they already had, have frontier models interpret it, then show the interpretation back for confirmation and local edits.
The part I fought hardest for was where that confirmation lives. Chat alone couldn't carry it: a 5,000-line bulk change explained in a small conversational context window is a wall of words nobody can verify. I pushed for real-time UI as the confirmation surface — the model's interpretation rendered as live, editable, visual state, with conversation as an additional input channel rather than the only one. People confirm data they can see; they rubber-stamp data they can't.
03Decision: the data nobody wanted to touch
The slowest part of enterprise ordering was always the same: getting employee data into the system. The industry norm — ours included — was to avoid tying orders directly to user data at all; the security and compliance surface scared everyone. I pushed for an anonymized employee-data path: clients share what's needed for ordering without exposing identities, we integrate with their employee-data portals through the MCP layer, and the order builds itself around confirmed real needs.
That single change was the difference between an enterprise order taking 2–4 hours and taking 10–20 minutes. Early qualitative tests of the model-driven flow showed it resonating with exactly the users who had been burned by manual entry.
04Decision: making the economics and the lawyers say yes
Two objections could have killed it. Legal and compliance asked the right question — if our AI misinterprets an order, are we liable? And finance saw model token costs as an open-ended risk. The structure I argued for answered both at once: price the service, then waive the fee for the launch cohort in exchange for them stress-testing the system and accepting pilot terms. Partners got early access out of legacy systems their developers already wanted to leave; we got real-world error data under a controlled agreement, token-cost telemetry from real usage, and a value story — faster sales cycles, fewer botched orders to unwind — that could carry the future build-vs-open-source model decision.
05How it ended
Everything was built and ready to go. Then a reorganization and budget realignment cut the team — mine included — before launch. Whether it shipped after the handoff: unknown. I'm at peace with the work and not at peace with the timing, which is the lesson.
What I'd do differently: push harder and faster a year earlier. I treated organizational patience as a constant; it's a variable. If the pilot had launched before the reorg, the value would have been visible enough to defend itself. Speed isn't just a delivery concern — it's risk management against the org changing its mind.
The full working detail
Why each rule exists, and what it costs.
EvidenceChat vs. real-time UI as the confirmation surface
| Dimension | Chat-only | Real-time UI + chat input |
|---|---|---|
| Bulk changes (1k–10k lines) | Summarized prose; unverifiable | Live tables/visuals; scannable, sortable, checkable |
| Error discovery | User must notice from description | Anomalies visible in the data representation |
| Edit loop | Re-prompt and hope | Direct manipulation on the interpreted state |
| Trust building | Opaque — "the AI said so" | Transparent — see exactly what will execute |
| Audit / compliance | Conversation logs | Structured state diffs per confirmation |
The pattern — model interprets, interface renders interpreted state, human confirms visually, conversation stays available as an input channel — is what agentic enterprise UX is converging on. We were designing it against real 10,000-line orders in 2025.
MethodWhy anonymization was the breakthrough
Direct user-data integration had been avoided industry-wide for years — every design that touched identified employee data inherited a security and compliance surface that stalled projects. Anonymizing at the source flipped the question from “can we be trusted with your employee data” to “you keep your data; give us only the shape of the need.” It preserved the speed value — orders built from real needs, not manual re-entry — while shrinking the attack and liability surface that had killed prior attempts.
MethodThe pilot structure: liability, tokens, and trust in one move
Waived-fee pilot for the launch cohort under explicit test terms. What each party got: partners escaped legacy integration pain early and shaped the product; legal got contained, consented conditions for AI-error handling instead of open-ended liability; finance got real token-usage data to price against measured value — faster sales cycles, fewer error corrections — rather than fear; design got live qualitative evidence. One structure, four objections retired.
Constraint200 codebases and a marketing-first inheritance
T-Mobile grew as a marketing company first; the technology accumulated around campaigns rather than platforms, leaving roughly 200 codebases where a product-first company might have dozens. Every integration the marketplace promised had to negotiate that reality. It's also why the project mattered beyond its own revenue: a developer-first platform was the first structural exit from building one more bespoke flow per campaign, forever.
LessonDesigning for AI agents as first-class users
Treating “user” as human, agent, or hybrid changed concrete decisions: interfaces doubled as verification layers for agent-initiated actions; flows assumed machine-readable state — the same structure MCP-style integrations consume; confirmation steps were designed as the human checkpoint in otherwise automatable sequences. The design question shifted from “how does a person do this” to “where must a person be in the loop, and what do they need to see there.”
LessonSpeed is a stakeholder
The project died of timing, not quality — a reorg arrived before the pilot could prove its value. What I now treat as a design input: organizational patience is a depleting resource, and every quarter of polish spends it. If the value story needs a live pilot to be undeniable, getting to that pilot fast is not corner-cutting — it is how you protect the work from the org's own weather.
One trade-in flow for four systems →
Visit the marketplace as a developer would ↗ Simulated product site — built as part of this case study.