Designing a well rounded API

I got recently an request to build an API from a user and I wanted to ask if people here have experience in designing one. Earlier we've only considered building a pull API, but this user requested us to build specifically a push API.

This got me to thinking that I don't know nearly enough about how to design a well rounded API. What I'm wondering about is:

• While I want to give our customers maximum privacy while using our API, I also want to have the ability to detect issues and potential attacks in real time. Are there best practices regarding analytics for the API usage?

• Usage based pricing is all the rage now which makes sense with AI agents and all. But I'm thinking about a flat monthly fee with some (upgradeable) limits, particularly considering the push model. Would really appreciate if anyone could share their experiences on how to discover the right pricing model for an API?

• I've also seen a few API providers making a Model Context Protocols to deliver their data once the user has subscribed. Any experiences with making them (and providing data through them as well)?
  

Really appreciate any help and insights!