The American API Access Act
I’m Just a Bill, Yes I’m Only a Bill
Audio by Eleven Labs can be a little wonky
Real quick- what’s an API?: An API is like a doorway that lets different computer programs (Toast, Opentable, etc) talk to each other and share information.
I was recently at a wonderful conference put on by the Southern Smoke Foundation in New Orleans. There was a panel on AI and Restaurants that had multiple restaurant tech companies participating. There was a general sense that AI would be very impactful to restaurants and guests. One participant, arguably one of the most influential restaurant tech folks of the last 20 years, going so far as to say “...it will be all it is cracked up to be.” I very much agree.
That’s what made the answer to my question to the panel that much more frustrating. I asked “What are your company’s stances on open APIs for operators? Modern tools like LLMs, Claude Code, etc have made it possible for us to do more with our data. Your companies tend to withhold access to that data beyond cumbersome CSVs. We need access to OUR data via API to make the most of the tools available to us.” And I reinforced OUR data one more time.
The answer I received bothered me a little at the time but has festered for a week now. It’s not actually relevant the person or company as I believe their sentiment speaks for many top restaurant tech companies. Paraphrasing a bit here:
“There is a cost to a company to provide that API and maintain it and if it breaks that’ll be a problem for the restaurant and the company. Also, I question whether a small independent restaurant needs API access or has the resources to use it effectively.”
I would have preferred the panelist smiled, walked off the stage and came to pat me on the head.
Why API Access Matters Now
The dismissive response I got—that small operators don’t need API access—misses what’s fundamentally changed in the last two years. It’s not 2019 anymore, when building custom tools required hiring developers and maintaining complex infrastructure.
Modern AI tools like ChatGPT and Claude have collapsed the barrier between “I need this” and “I can build this.” An operator can now describe what they need in plain English and get a working tool—a scheduling assistant that knows when the Sox play the Yankees, a training module that references your actual recipes and procedures, a P&L analyzer that speaks in your restaurant’s language. Not generic software configured to sort of work for you, but tools built for exactly how your restaurant operates.
But only if you can access your own data.
I can build these tools for Shy Bird because Toast provides API access to our sales data, albeit at a cost that I think is too high. Without that, I’d be stuck manually downloading CSVs and copying data around like it’s 2005.
The panelist was right about one thing: there is a cost to maintaining APIs. But that’s a choice about what business you’re in. Are restaurant tech companies commoditized utilities that extract rent from transactions, or are they platforms that enable and empower operators.
Here’s what makes this particularly galling: these companies are now racing to sell us AI-powered features built on... our own data. Features we could build ourselves if we had access to it. The same data they claim is too complex for us to handle directly, they’re now packaging back to us as premium subscriptions.
This isn’t sustainable. And I don’t think it changes without external pressure.
The American API Access Act
So if the industry won’t provide access voluntarily, and polite questions at conference panels get dismissed with a pat on the head, maybe it’s time for a different approach. As that little scrap of paper on Capitol Hill might say: sometimes you need Congress to step in.
Here’s what that could look like:
Section 1: Findings and Purpose
WHEREAS, restaurants generate substantial operational data through point-of-sale systems, reservation platforms, and other technology services that reflects their proprietary business practices;
WHEREAS, recent advances in artificial intelligence have made it feasible for operators to build custom tools using their own operational data;
WHEREAS, many restaurant technology providers restrict programmatic access to customer data, creating artificial barriers to innovation while the cost of maintaining API infrastructure has become standard practice in other technology sectors;
NOW, THEREFORE, be it enacted:
Section 2: Definitions
(a) QUALIFYING PROVIDER: A restaurant technology provider with annual recurring revenue exceeding $20 million OR more than 2,500 restaurant locations using their primary product.
(b) OPERATIONAL DATA: Data generated by a restaurant through use of the provider’s system, including sales transactions, customer information, inventory levels, labor hours, and reservation data.
Section 3: Required API Access
(a) Any Qualifying Provider must provide customers with API access to all Operational Data meeting industry-standard protocols for authentication and data formatting.
(b) Providers may charge infrastructure fees that are publicly disclosed and comparable to other software industries, but not structured to make access commercially prohibitive.
Section 4: Emerging Provider Protection
Companies not meeting Qualifying Provider criteria are exempt from Section 3 requirements to encourage innovation and reduce barriers to entry for new restaurant technology companies.
Section 5: Data Portability
Upon request, all providers must furnish complete Operational Data exports in machine-readable format within 30 days, with no fees for quarterly requests.
Section 6: Enforcement
(a) The Federal Trade Commission shall enforce this Act and may establish technical standards.
(b) Customers may bring private action for violations and recover reasonable attorney’s fees.
Section 7: Effective Date
This Act takes effect 18 months after enactment.
Back to Reality
Now, obviously this bill doesn’t exist. And I’m not naive enough to think Congress is going to prioritize restaurant data portability when they can’t keep the government funded.
But the fact that we can even imagine needing legislation like this points to how badly the incentives are misaligned. In a functioning market, restaurant tech companies would be competing on who provides the most empowering platform. They’d be racing to provide robust APIs because that’s what creates lock-in through utility, not lock-in through data capture.
Instead, we get panel discussions where industry leaders patronize and techsplain why we don’t really need access to our own data. And responses like this.
The irony is that the big players are the ones best positioned to win in an open ecosystem. They have the data infrastructure, the customer relationships and the partner leverage. If they opened up their platforms and made it easy for operators to build on top of them, switching would become unthinkable.
But that requires thinking like a platform, not like a tollbooth. It requires believing that your competitive advantage comes from being the best foundation, not from higher walled gardens.
Until that changes—whether through competition, regulation, or a genuine shift in industry thinking—operators are stuck paying rent on our own data and being told we should be grateful for the privilege.