|
More requests than this report has ever counted, and
almost exactly the same number of distinct questions as
always. Inside those questions, the human list moved on
from who handles payments to how you take one back.
Week of September 28 – October 4, 2026 · 28,811
providers · 143,895 APIs
Every Monday I read what people and agents actually typed
into apis.io — the search box and the MCP server — as a demand signal
for the API economy. Nobody else has this data, so nobody
else can send you this email.
📈 The Demand Report
516,891 requests — the most in any week this report has
run, up 42% on last week's 363,576. Keyless callers
rose 240,399 → 331,092, up 38%. Distinct
terms rose 5,185 → 5,279, up 1.8%.
That last number is the one that matters. A hundred and
fifty thousand extra requests brought ninety-four new
questions with them. The vocabulary has sat between 5,000
and 6,000 distinct terms every week for ten weeks,
whatever the volume line does — and this week the volume
line was one machine running harder, not more people
arriving.
|
|
This week vs last: total searches +42% to 516.9k,
keyless API +38% to 331.1k, unique terms +1.8% to
5,279, MCP searches −37% to 3,508. Footnote: a
record volume on a near-flat vocabulary is a
machine, not demand; MCP fell back from its record
|
Agents stepped back from the record
MCP searches came in at 3,508, down 37% from last week's all-time high of 5,551. The
series: … 4,533 → 1,591 → 2,041 → 4,754 → 5,551
→ 3,508.
That's still the fourth-highest week in the run, and
above anything before late August. Share of all requests
fell to 0.68%, mostly because the denominator ballooned.
Two records in a row, then a step back that held most of
the gain — I'd call that a line settling, not a line
collapsing. Next week tells us which.
The human list asked how to take money back
Last week Stripe led the human list at 89. This week the
shape of the money questions changed:
|
Term
|
Sep 21–27
|
Sep 28–Oct 4
|
|
refunds
|
—
|
48
|
|
crypto
|
—
|
44
|
|
payments
|
28
|
43
|
|
stripe
|
89
|
13
|
|
Liquidity Providers
|
—
|
12
|
|
Salary Advance
|
—
|
12
|
|
Savings Overview
|
—
|
12
|
|
gold prices
|
—
|
10
|
refunds has never been in the top hundred before. This week it
came in at 48, second only to one provider's name. crypto is new to the top hundred too, at 44, and payments is back up to 43. Around them: liquidity providers,
salary advance, savings, gold prices, MarketPrice, Exchange Data.
Stripe answered "who moves the money." Refunds
is the question you ask once you've moved it and need
to move it back. That's also the question that
matters most for an agent: reversing a charge is the
operation where a retry can cost real money. It's who
this week's rated provider is.
Elsewhere at the top: quietforge (50) — a per-call document-processing API that is in the
index as a provider with no API pages yet; dbnomics (25), the open economic-data aggregator; Weather back up to 31; art (27), events (16), text to speech (12), SCIM (12), SPARQL Query (11).
The gate
Bounces off the paid surface came down: 15,050 → 12,716, across 24 resources. cohorts is the most reached-for gated resource for a fifth
straight week, at 5,491. security 3,854. scopes nearly doubled, 525 → 935 — the
permission question again. insights held its new level at 205.
The authenticated tiers stay off the scoreboard. pro reads 20,011 this week, and the tag-quality pass ran on
my own Understanding key on the 3rd. I'm still not
printing those tiers as demand.
🕳️ The Gaps (demand we couldn't answer)
The pipeline saw 927 raw unmet terms,
dropped 428 as noise and 323 the catalog can now answer,
and kept 176 — flat on last week's
177. The dictionary walk is still going (forfend, gemsbok, recrudesce, tauten).
Two candidates were dropped before the chart was drawn
because the provider is already indexed and only the
phrasing missed: integrate wisetack (Wisetack is in, with a Partner API) and everbridge vcc (Everbridge is in, with over three hundred APIs).
Eight rows, each re-probed against the live search this
morning and still returning nothing:
|
|
The Gaps — top zero-result searches: restaurant
depot at 4×; octabroker and baldor at 3×;
bancodebogota, sydbank, eurofunk kappacher,
flussonic and dallmeier at 2×
|
-
restaurant depot (4×) — the US
wholesale cash-and-carry chain that supplies
independent restaurants.
-
octabroker (3×, plus 4 across two
misspellings) — Octa, the forex and CFD broker. octafx returns nothing either.
-
baldor (3×) — Baldor, ABB's
industrial motors and drives brand. The machine layer,
a fifth week running.
-
bancodebogota (2×) — Banco de Bogotá,
one of Colombia's largest banks. The spaced form
returns other banks, not this one.
-
sydbank (2×) — a Danish commercial
bank.
-
eurofunk kappacher (2×, plus 6 more
as the name was typed out letter by letter) — Austrian
software for emergency-dispatch control rooms.
Somebody typed the whole company name, GmbH included,
and got nothing at every step. It's the fourth
week of resilience-shaped demand in this report:
outage, alerts and cables, and now the room that
dispatches the response.
-
flussonic (2×) — a video streaming
server that ships its own HTTP API.
-
dallmeier (2×) — German
video-security cameras and management software.
Banks again, from two more countries —
Colombia and Denmark, after India and Brazil last week.
And two rows of video: one company streams it, one records
it.
croxyproxy came back a third week, at 6×.
If you build in one of these lanes, this is your
invitation. Add your API in about two minutes: apis.io/add — or point your agent at the apis.io MCP server and let it submit for you.
🆕 New to the Index
The deployed index reads 28,811 providers and 143,895 APIs — up 1,236 providers in a week, and up
4,698 APIs. As always, the API line counts specification
files, not products.
The MCP lines were quiet, which is the useful news after
last week's jump:
|
|
Last Monday
|
Today
|
|
|
MCP entries (all)
|
6,714
|
6,800
|
+86
|
|
— hosted endpoints
|
2,499
|
2,508
|
+9
|
Last issue I said the jump to 2,499 hosted endpoints was
the index catching up to servers that already existed, not
a week of launches. This week's +9 is what that looks
like afterward.
Thirty-five posts went up on the blog last week. Among
them:
All on the apis.io blog.
⭐ Rated This Week: Square — the refund an agent
can't send twice
This week's angle: refunds entered the top hundred
for the first time. A refund is the operation where an
agent's retry costs real money. So: who makes it
safe?
|
|
Square
|
|
Kin Score
|
75.9 exemplar
|
|
Agent Readiness
|
60.6 agent-native
|
|
Contracts / callable
|
42 / 100%, none derived by us
|
|
Idempotency · reversibility
|
verified · verified
|
That Agent Readiness score is higher than Stripe's
58.3 from last issue. Of the six payments providers I
compared this morning — Square, Stripe, DoorDash, Adyen,
PayPal, Loop — it's the highest.
The reason is in the contract. Square's RefundPayment operation — POST /v2/refunds — won't accept a refund without an idempotency
key. idempotency_key is a required field, right next to amount_money, and the schema says what it's for: a unique string
per refund request. An agent that times out and retries
sends the same key, and Square refunds once. Most APIs
offer idempotency as an option. Square makes it the price
of asking for your money back.
The door checks out too. mcp.squareup.com/mcp is Square's own hosted MCP server. An
anonymous initialize gets the right refusal:
HTTP/2 401
www-authenticate: Bearer realm="OAuth",
resource_metadata="https://mcp.squareup.com/.well-known/oauth-protected-resource/mcp",
error="invalid_token", error_description="Missing or invalid access token"
The RFC 9728 document names the resource and its
authorization server. That server publishes RFC 8414
metadata with a dynamic client registration endpoint at /register, so an agent can register itself. A made-up .well-known path returns 404, so none of this is a catch-all.
The cheapest points left are about saying what the door
allows. The MCP server's authorization metadata advertises
no scopes. Square's main OAuth has fine-grained
permissions, like separate read and write access to
payments, but an agent arriving at this door can't
learn them before it asks. For a server that can issue
refunds, that's the one thing an agent most needs to
know up front. The same metadata still accepts plain PKCE alongside S256. Neither squareup.com nor developer.squareup.com serves
a /.well-known/api-catalog, and there's no agent card — all 404 today.
Contract governance, at 27.3, is the lowest facet on the
scorecard.
Square has done the hardest part of agent-safe money: you
can't refund twice by accident. What's left is
telling an agent, before it registers, how much it will be
allowed to do.
Kin Score rubric 0.23.0, scored 2026-10-03. Bands:
exemplar 66.5+ · strong 54.3–66.4 · developing 39.3–54.2
· thin 26.2–39.2 · emerging 11–26.1 · minimal 0–10.9.
Agent Readiness: agent-native 38.7+ (gated on
idempotency AND error semantics) · agent-ready 28.6–38.6
· agent-aware 5.1–28.5 · human-only 0–5.
🤖 Reproduce this yourself
Square and Stripe, side by side, no key required:
find_providers(providers=["square","stripe"], fields=["slug","score","agent_readiness","api_count"])
The refund contract's required fields:
get_openapi(aid="square:square-refunds-api", include=["content"])
Look for RefundPaymentRequest.required: idempotency_key, amount_money.
Then the door, the way I checked it:
curl -s -D - -o /dev/null -X POST https://mcp.squareup.com/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' \
| grep -i www-authenticate
curl -s https://mcp.squareup.com/.well-known/oauth-authorization-server
Or read the demand data directly: apis.io/search-terms/, refreshed every Monday.
28,811 providers. 143,895 APIs. Half a million
requests, five thousand questions — and one of the
loudest was how to give the money back. See a gap that's yours? → apis.io/add
The Demand Report is a weekly read of apis.io's
own search + discovery signal. Forward it to someone who
ships an API.
|
