Version 1 of the API was a single fat controller with no separation of concerns. Version 2 improved on this but still had code in the AppController. Version 3 used CakePHP's CRUD plugin to automate CRUD actions, implemented filtering and sorting, and separated code into distinct classes and plugins for improved flexibility and extensibility. Lessons learned were to use routing prefixes, CRUD plugins, authentication, and create separation of concerns between classes and plugins.