The verdict in three sentences
A software vendor that treats every partner integration as custom work ends up spending a growing share of its engineering team on one-off connectors. A well-designed public API costs €25,000 to €60,000 with a Berlin agency (2026 ballpark), plus €5,000 to €12,000 for OpenAPI documentation and a developer portal, over 10 to 16 weeks. The return comes from 30 to 50 % fewer integration requests and a resale channel your partners build themselves.
Scope of a serious partner API
A public API is not direct access to your database. It is a product, with a stable contract, versions, documentation and support. Integrators judge your API within an hour: if they get a first successful call in that time, they adopt it.
| Component | Content | Market cost (2026 estimate) | Build time |
|---|---|---|---|
| Contract design | Resources, OpenAPI 3.1 schemas, error conventions, pagination | €4,000 to €8,000 | 2 weeks |
| Endpoint development | 20 to 40 endpoints, automated tests, versioning | €12,000 to €30,000 | 5 to 8 weeks |
| Authentication and authorisation | OAuth2 client credentials, per-partner scopes, secret rotation | €4,000 to €9,000 | 1.5 weeks |
| Webhooks | HMAC-signed events, retries, delivery log | €3,000 to €7,000 | 1.5 weeks |
| Developer portal | Interactive docs, test keys, sandbox, changelog | €5,000 to €12,000 | 2 to 3 weeks |
| Observability | Per-client logs, alerts, usage dashboard | €2,000 to €6,000 | 1 week |
The sandbox is the most often forgotten piece. Without a test environment with dummy data, every partner asks for access to a real account and your support team spends its days creating demo tenants.
Security: what to require in 2026
APIs are now the main attack surface for SaaS vendors. The OWASP API Security Top 10 (2023 edition) lists the most common flaws, led by broken object-level authorisation: a partner reading another customer's data by changing an ID.
| Requirement | Concrete measure | Risk covered |
|---|---|---|
| Authentication | OAuth2 with short tokens of 15 to 60 minutes | Stolen permanent key |
| Object-level authorisation | Tenant check on every request, dedicated automated tests | Cross-customer data leak |
| Rate limiting | 60 to 600 requests a minute by partner tier | Overload, scraping |
| Webhook signing | HMAC SHA-256 plus timestamp, 5-minute window | Injected fake events |
| Logging | 12-month retention, alerts on 401 and 403 spikes | Late intrusion detection |
| GDPR (DSGVO) | Data processing agreement with each partner, minimal fields | Non-compliance, regulator fines |
| Penetration test | API pentest before launch, €4,000 to €10,000 on the market | Undetected flaws |
German enterprise buyers often also ask for alignment with BSI IT-Grundschutz or an ISO 27001 roadmap: plan the documentation effort early. The API gateway (Kong, Tyk, AWS API Gateway or Azure API Management) centralises quotas, keys and logs, at €100 to €600 a month depending on volume (2026 ballpark).
Berlin agency, in-house team or Kolonell
A senior backend developer in Berlin costs €70,000 to €90,000 gross a year, and a freelance API specialist €700 to €1,000 a day. Building the API in-house often ties up two people for a quarter, at the expense of the product roadmap.
| Option | Budget | Timeline | Watch out for |
|---|---|---|---|
| In-house team (2 developers, 3 months) | €40,000 to €55,000 loaded cost | 12 to 16 weeks | Product roadmap frozen |
| Senior API freelancer | €30,000 to €50,000 | 10 to 14 weeks | Documentation often neglected |
| Specialised Berlin agency | €30,000 to €72,000, portal included | 10 to 16 weeks | Require a pentest and a sandbox |
| Kolonell, complex application | 7,000,000 to 15,000,000+ FCFA (10,670 to 22,870+ EUR) | 10 to 16 weeks | OpenAPI contract signed off before coding |
An independent penetration test and gateway hosting sit outside the grid and are quoted separately. More on our custom web applications and cybersecurity pages.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Lena, CTO of a Berlin fleet management SaaS vendor, receives 220 integration requests a year from resellers and integrators, each taking 12 hours of development and support on average.
- Current cost: 220 x 12 h x €75 loaded = €198,000 a year.
- With a public API and portal, 40 % fewer requests: a saving of €79,200 a year.
- First-year cost: API €48,000 + portal €9,000 + gateway €300 x 12 = €60,600.
Payback comes in 60,600 / 79,200 = 0.77 years, or about 9 months. In following years only the gateway and maintenance remain, and the integrations partners build become a sales argument.
FAQ
REST or GraphQL for a partner API?
REST with OpenAPI remains what 80 to 90 % of integrators expect, because it is easy to document and test. GraphQL makes sense for partners who display highly varied data in their own interfaces.
Should we charge for API access?
Many vendors include it in higher plans and charge for volume above a quota, for example 100,000 calls a month. Per-call billing only becomes relevant at large scale.
How do we version without breaking integrations?
Version in the URL or a header, announce each deprecation 6 to 12 months ahead and run two versions in parallel. The developer portal changelog is the main tool for that communication.
How long until a first usable version?
A read-only API of 15 to 20 endpoints with OAuth2 and documentation can ship in 6 to 8 weeks. Write operations, webhooks and the full portal follow.
Let's scope your project. List the integrations your partners ask for most often, and we will scope the API contract, security and a 10 to 16 week plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
