Most API problems we get called in to fix were never about the endpoints themselves. They were about decisions skipped early: no versioning strategy, no rate limiting, and authentication bolted on after the first integration partner asked for it.
Our checklist before any API goes live covers four things: a versioning contract that won't break existing consumers, authentication and rate limiting from day one, structured error responses instead of raw stack traces, and documentation generated from the source of truth rather than maintained by hand.
None of this is exotic. It just has to happen before the first external integration, not after the second one breaks.