An IoT API must be safe when connectivity is unreliable. For each provider under IoT APIs, identify whether the API reads telemetry, changes device state, or manages identities; these need different controls.
Use a disposable device or simulator. Send a command, disconnect it, reconnect, and inspect whether the command is queued, lost, or replayed. Measure telemetry freshness and timestamp zones. Test authentication scope, rate limits, pagination, and duplicate event handling. For actuators, use a safe physical setup and never experiment on production equipment.
Document firmware compatibility, data retention, and how credentials are rotated. A demo response does not prove that a device reached the intended state. Require a confirmation from the device and a timeout/fallback plan.
Akousa