|
Agents searched apis.io nearly three times as often as
last week, a new record by a wide margin. The human list
kept asking the question it started asking last week,
how do I give the money back, and this week I went and
checked who lets an agent ask it safely.
Week of October 5 – 11, 2026 · 29,988 providers ·
147,572 APIs
Every Monday I read what people and agents actually typed
into apis.io — the search box and the MCP server — as a demand signal
for the API economy. Nobody else has this data, so nobody
else can send you this email.
📈 The Demand Report
MCP searches came in at 8,978 — up 156% on the week,
and 62% above the previous record of 5,551. The series: 4,533 → 1,591 → 2,041 → 4,754 → 5,551 →
3,508 → 8,978.
Nothing in my own tooling explains it. The tag-quality
pass ran on five days this week, but it calls the REST API
on a key, not the MCP server. There's no templated
block behind it either: no MCP-bearing term anywhere in
the top hundred. Share of all requests rose to 1.33%, even
on a record denominator.
The rest of the scoreboard was the machine again. Total
requests rose 516,891 → 673,315, up 30%, a new high for the
run, and keyless callers 331,092 → 490,436, up 48% — while distinct terms fell, 5,279 → 5,110, down 3%. More volume on a narrower vocabulary is one automated
caller. I don't count it as demand.
|
|
This week vs last: total searches +30% to 673.3k,
keyless API +48% to 490.4k, unique terms −3.2% to
5,110, MCP searches +156% to 8,978. Footnote: volume
set a record on fewer distinct terms — a machine;
the MCP bar is a new all-time high
|
The refund question held
Last week refunds entered the top hundred for the first time, at
48. This week it's the top human term, at 59. One week is a blip; two rising weeks is a question
people are actually asking.
|
Term
|
Sep 28–Oct 4
|
Oct 5–11
|
|
refunds
|
48
|
59
|
|
Payments
|
43
|
47
|
|
stripe
|
13
|
34
|
|
pix
|
—
|
10
|
|
payment
|
—
|
10
|
|
gold price API
|
—
|
10
|
Stripe came back up to 34. pix — Brazil's instant-payment rail — showed up at 10.
Payments-shaped searches have sat at the top of the human
list three weeks running now.
The resilience stack came back
The five-term cluster from #09 and #10 returned to the top
hundred, smaller and still in a tight band: aviation ADS-B flight API 15, satellite earth observation API 15, critical infrastructure outage API 13, emergency management alert API 13, telecommunications network status API 13. That makes three appearances in five weeks for the
same five sentences. Somebody keeps checking.
The gate
Bounces off the paid surface went 12,716 → 60,502 — almost five times last week. Nearly all of it is two
resources: cohorts 5,491 → 29,227 and security 3,854 → 23,334. Growth that
concentrated in two endpoints looks like one caller
working through them, so I'm reporting it as an ask,
not a crowd. Even so, the shape hasn't changed in six
weeks. The most reached-for thing behind the gate is still
"rank this group," and the second is still
"what does this API's security look
like." scopes doubled again, 935 → 2,084.
The authenticated tiers stay off the scoreboard. pro reads 82,521, and that's the tag-quality pass on my
own Understanding key.
🕳️ The Gaps (demand we couldn't answer)
The pipeline saw 694 raw unmet terms,
dropped 315 as noise and 240 the catalog can now answer,
and kept 139, down from 176.
Three candidates were dropped before the chart was drawn
because the provider is already indexed and only the
spelling missed: keepersecurity (Keeper Security is in), delinea totp (Delinea is in, with over a hundred APIs) and hostelworld room (Hostelworld is in).
Eight rows, each re-probed against the live search this
morning and still returning nothing:
|
|
The Gaps — top zero-result searches: gracely at 6×;
aggreg8 and divineshop at 4×; pawapay, ifthenpay,
emiratesnbd, adirondack trust and indosat at 2×
|
-
gracely (6×, plus 4 as gracely church and more as it was typed out) — church management
software. The most-searched genuine gap of the week.
-
aggreg8 (4×) — Australian pay-by-bank
and financial-data aggregation.
-
divineshop (4×) — a Vietnamese store
for software licences and game keys.
-
pawapay (2×, plus 2 as pawapa) — a mobile-money payments API across African
markets. A company whose product is an API,
and we don't carry it.
-
ifthenpay (2×, plus 6 as the name was
typed letter by letter) — the Portuguese gateway
behind Multibanco references and MB WAY.
-
emiratesnbd (2×) — Emirates NBD, one
of Dubai's largest banks. The spaced form returns
other companies that mention it.
-
adirondack trust (2×) — a community
bank in Saratoga Springs, New York.
-
indosat (2×) — Indosat Ooredoo
Hutchison, the Indonesian telco.
Five of eight rows are money: two banks,
a pay-by-bank aggregator, and two payment gateways, from
Australia, Portugal, Africa, the UAE and upstate New York.
Banks and payment rails have now filled this section three
weeks running: India and Brazil, then Colombia and
Denmark, now this.
croxyproxy came back a fourth week, at 8×.
If you build in one of these lanes, this is your
invitation. Add your API in about two minutes: apis.io/add — or point your agent at the apis.io MCP server and let it submit for you.
🆕 New to the Index
The deployed index reads 29,988 providers and 147,572 APIs — up 1,177 providers and 3,677 APIs on the week.
That's the second week in a row above a thousand new
providers. As always, the API line counts specification
files, not products.
|
|
Last Monday
|
Today
|
|
|
MCP entries (all)
|
6,800
|
6,591
|
−209
|
|
— hosted endpoints
|
2,508
|
2,278
|
−230
|
Twenty-eight posts went up on the blog last week, and more
than half were about MCP and agents. Among them:
All on the apis.io blog.
⭐ Rated This Week: Adyen — the refund tool that
doesn't carry a key
This week's angle: refunds held the top of the
human list, on the week agents searched most. Last issue
was Square, where an agent can't refund twice. This
week is the other way to build it.
|
|
Adyen
|
Square (last issue)
|
|
Kin Score
|
66.1 strong
|
75.9 exemplar
|
|
Agent Readiness
|
43.0 agent-native
|
60.6 agent-native
|
|
Refund idempotency key
|
optional
|
required
|
|
MCP server
|
official, local, API key
|
official, hosted, OAuth
|
Both are agent-native. Both document idempotency properly
— Adyen accepts an Idempotency-Key header on its refund call, up to 64 characters, and the
scorecard verifies it. The difference is one word in the
contract. In Adyen's own published spec, the key
is required: false. Square makes it required. An agent that never sends one
gets no protection from Adyen if it retries.
That matters more than it sounds, because Adyen ships an
official MCP server, @adyen/mcp, and one of its tools refunds a captured payment. I read the source this morning, at the latest commit
(September 11). The refund tool takes a PSP reference,
currency, amount, merchant account and your reference, and
calls Adyen's refund endpoint. There's no idempotency key in the tool's
inputs, and the server never adds one. The word doesn't appear anywhere in the
server's code. So the safety Adyen's API offers
is never used by the agent tool Adyen built.
The door is a different design too. The server runs on
your machine via npx, with an Adyen API key in an environment variable.
There's no hosted endpoint and no OAuth. The README
is sensible about it: make a new webservice user, and
limit its roles to the tools you'll use. But a key in
an environment variable can do whatever that key can do,
and there's no consent step between an agent and a
refund.
The cheapest points left are in the tool, not the
API. Generate an idempotency key per refund call inside @adyen/mcp and Adyen's existing safety reaches every agent
using it. That's a few lines. Beyond that: no /.well-known/api-catalog on adyen.com or docs.adyen.com (both 404), no delegated
identity, no protected-resource metadata, and contract
governance at 27.3 — the same lowest facet Square had.
Adyen built the safety into the API and left it out of the
agent tool. For a payments API, the agent tool is where
it's needed most.
Kin Score rubric 0.23.0, Adyen scored 2026-10-11.
Bands: exemplar 66.5+ · strong 54.3–66.4 · developing
39.3–54.2 · thin 26.2–39.2 · emerging 11–26.1 · minimal
0–10.9. Agent Readiness: agent-native 38.7+ (gated on
idempotency AND error semantics) · agent-ready 28.6–38.6
· agent-aware 5.1–28.5 · human-only 0–5.
🤖 Reproduce this yourself
Adyen and Square, side by side, no key required:
find_providers(providers=["adyen","square"], fields=["slug","score","agent_readiness","api_count"])
The refund call's idempotency header, from
Adyen's own spec:
curl -s https://raw.githubusercontent.com/Adyen/adyen-openapi/main/json/CheckoutService-v71.json \
| jq '.components.parameters["Idempotency-Key"].required'
It prints false. Then the agent tool:
git clone --depth 1 https://github.com/Adyen/adyen-mcp
grep -rni idempotenc adyen-mcp --include='*.ts' | grep -v node_modules
It prints nothing.
Or read the demand data directly: apis.io/search-terms/, refreshed every Monday.
29,988 providers. 147,572 APIs. 8,978 agent searches, a
record by a mile — and the human list is still asking
how to give the money back. See a gap that's yours? → apis.io/add
The Demand Report is a weekly read of apis.io's
own search + discovery signal. Forward it to someone who
ships an API.
|
