10 years would be a reasonable good start for a deprecation policy for an API-providing infrastructure company.

It is not uncommon to have 5-year-old systems in production, and a factor of two above that sounds like a good minimum.