← Insights
AI & Automation

The Open API Isn't the Green Light You Think It Is

Tenant Inc. just let AI tools read live PMS data. The vendors are calling it openness. It's a diligence event, and most operators are about to skip the diligence.

Aaron Farney 24 years operating self-storage | Founder, Ingenra 4 min read
A storage facility roll-up door standing open, dark inside

Tenant Inc. opened its Nectar API to AI tools on July 13. Point Claude, ChatGPT, or any AI agent straight at your live Hummingbird data, no developer required, no waiting for a roadmap item. It's not the only one doing this. QuikStor has bolted on three integrations in as many months. The vendors are calling this openness. For a growth-stage multi-site operator, it's not a green light. It's a new diligence event, and most operators are about to skip the diligence.

An open API removes the excuse

Here's the trap. An open API removes the excuse. For years, "our systems don't talk to each other" was a vendor problem - the PMS was a walled garden, and you needed a developer or an integrator to get anything out of it. That excuse is disappearing fast. Which means the next mistake isn't "we couldn't connect our data." It's "we connected it before we knew what it actually said."

A mapping artifact at machine speed

Picture a 22-site operator, half the portfolio acquired over six years. Every acquisition arrived with its own unit-type naming, its own discount code taxonomy, its own idea of what "occupied" means during a lock-out dispute. Nobody has ever reconciled that across the whole portfolio - there's never been a reason to, because nobody was reading all 22 sites side by side in real time. Now someone on the ops team points an AI reporting tool at the open API, because it's July 2026 and doing that took an afternoon instead of a developer sprint. First week, it produces a clean occupancy trend chart. Somebody acts on it. Turns out three of those sites code "occupied" differently, so the "trend" is a mapping artifact, not a fact about the business. The AI tool didn't lie. It read exactly what it was given, faster and with more confidence than a person would have, and nobody had checked whether the data underneath was safe to trust at that speed.

That's the real risk in this news cycle, and it has nothing to do with the AI itself. An open API doesn't create clean data. It creates a much faster path from whatever data you actually have to a decision someone will act on. If your systems already reconcile - one taxonomy, one source of truth per metric, a known owner for each integration - an open API is a legitimate gift. You skip paying an integrator for the basic plumbing and go straight to building on top of it. If they don't reconcile yet, the open API just gives the gap a shorter fuse.

The scope question nobody asks

There's a second layer worth naming: access scope. "Open API" tells you the door exists. It doesn't tell you what the AI tool sitting on the other side of it can actually do - read-only on reporting fields, or does it also touch billing, access control, lease terms? Vendors publish developer docs; they don't publish a pre-built risk assessment for your specific stack. That's a decision an operator has to make deliberately, not one that happens by default because a connection worked on the first try.

Two days now or two days later

I don't recommend treating "the API is open" as the trigger to connect it. The trigger should be: do we know, in writing, which fields reconcile across every site, who owns each integration once it's live, and what scope of access we're granting. That's maybe two days of work for a mid-market operator who's never mapped it. Skipping it doesn't save those two days - it just moves them to after something's already gone wrong in front of ownership.

None of this is an argument against open APIs. The direction is right, and operators who've done the mapping work should move on this faster than they're currently moving - Nectar and whatever follows it are useful once the plumbing underneath is honest. The argument is against treating vendor openness as a substitute for your own architecture work. The vendor's incentive is to look integration-friendly. Whether your data is actually fit to hand to an AI tool at that speed is a question only you can answer, and it's worth answering before the connection, not after the first bad report gets presented as fact.

That's the exact question a Blueprint engagement runs through before anyone touches an API console - not whether the door is open, but whether what's behind it is safe to walk through at machine speed.

Start with a Blueprint