---
type: "article"
title: "The Demand Report — Issue #12"
summary: "The Demand Report issue #12 cover — half a million requests, and the people in them asked how to take money back. 516,891 requests, a record; 48 searches for refunds, new to the top hundred; 3,508 agent searches, the fourth-highest week."
newsletter: "APIs.io"
newsletter_handle: "apisio"
newsletter_url: "https://usecommune.com/n/apisio"
author: "Kin Lane (@kinlane)"
published: "2026-10-05T17:38:56.525Z"
canonical_url: "https://usecommune.com/n/apisio/a/8CxksHjE"
markdown_url: "https://usecommune.com/n/apisio/a/8CxksHjE.md"
chat_url: "https://usecommune.com/n/apisio/a/8CxksHjE/chat"
body_source: "native"
likes: 0
replies: 0
body_words: 1847
---

# The Demand Report — Issue #12

*More requests than this report has ever counted, and almost exactly the same number of distinct questions as always. Inside those questions, the human list moved on from who handles payments to how you take one back.*

**Week of September 28 – October 4, 2026 · 28,811 providers · 143,895 APIs**

***

Every Monday I read what people and agents actually typed into [apis.io](https://apis.io/) — the search box and the MCP server — as a demand signal for the API economy. Nobody else has this data, so nobody else can send you this email.

***

## 📈 The Demand Report

**516,891 requests — the most in any week this report has run**, up 42% on last week's 363,576. Keyless callers rose **240,399 → 331,092, up 38%**. Distinct terms rose **5,185 → 5,279, up 1.8%**.

That last number is the one that matters. A hundred and fifty thousand extra requests brought ninety-four new questions with them. The vocabulary has sat between 5,000 and 6,000 distinct terms every week for ten weeks, whatever the volume line does — and this week the volume line was one machine running harder, not more people arriving.

![This week vs last: total searches +42% to 516.9k, keyless API +38% to 331.1k, unique terms +1.8% to 5,279, MCP searches −37% to 3,508. Footnote: a record volume on a near-flat vocabulary is a machine, not demand; MCP fell back from its record](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-12-scoreboard.36e6b1b3.png)

### Agents stepped back from the record

**MCP searches came in at 3,508, down 37%** from last week's all-time high of 5,551. The series: … 4,533 → 1,591 → 2,041 → 4,754 → 5,551 → **3,508**.

That's still the fourth-highest week in the run, and above anything before late August. Share of all requests fell to 0.68%, mostly because the denominator ballooned. Two records in a row, then a step back that held most of the gain — I'd call that a line settling, not a line collapsing. Next week tells us which.

### The human list asked how to take money back

Last week Stripe led the human list at 89. This week the shape of the money questions changed:

| Term | Sep 21–27 | Sep 28–Oct 4 |
| --- | --- | --- |
| refunds | — | **48** |
| crypto | — | **44** |
| payments | 28 | **43** |
| stripe | 89 | **13** |
| Liquidity Providers | — | **12** |
| Salary Advance | — | **12** |
| Savings Overview | — | **12** |
| gold prices | — | **10** |

`refunds`** has never been in the top hundred before. This week it came in at 48**, second only to one provider's name. `crypto` is new to the top hundred too, at 44, and `payments` is back up to 43. Around them: liquidity providers, salary advance, savings, gold prices, `MarketPrice`, `Exchange Data`.

Stripe answered "who moves the money." Refunds is the question you ask once you've moved it and need to move it back. That's also the question that matters most for an agent: reversing a charge is the operation where a retry can cost real money. It's who this week's rated provider is.

Elsewhere at the top: `quietforge` (50) — a per-call document-processing API that is in the index as a provider with no API pages yet; `dbnomics` (25), the open economic-data aggregator; `Weather` back up to 31; `art` (27), `events` (16), `text to speech` (12), `SCIM` (12), `SPARQL Query` (11).

### The gate

Bounces off the paid surface came down: **15,050 → 12,716**, across 24 resources. `cohorts`** is the most reached-for gated resource for a fifth straight week**, at 5,491. `security` 3,854. `scopes`** nearly doubled, 525 → 935** — the permission question again. `insights` held its new level at 205.

The authenticated tiers stay off the scoreboard. `pro` reads 20,011 this week, and the tag-quality pass ran on my own Understanding key on the 3rd. I'm still not printing those tiers as demand.

***

## 🕳️ The Gaps (demand we couldn't answer)

The pipeline saw **927 raw unmet terms**, dropped 428 as noise and 323 the catalog can now answer, and kept **176** — flat on last week's 177. The dictionary walk is still going (`forfend`, `gemsbok`, `recrudesce`, `tauten`).

Two candidates were dropped before the chart was drawn because the provider is already indexed and only the phrasing missed: `integrate wisetack` (Wisetack is in, with a Partner API) and `everbridge vcc` (Everbridge is in, with over three hundred APIs).

Eight rows, each re-probed against the live search this morning and still returning nothing:

![The Gaps — top zero-result searches: restaurant depot at 4×; octabroker and baldor at 3×; bancodebogota, sydbank, eurofunk kappacher, flussonic and dallmeier at 2×](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-12-gaps.59ad79d0.png)

- **restaurant depot** (4×) — the US wholesale cash-and-carry chain that supplies independent restaurants.
- **octabroker** (3×, plus 4 across two misspellings) — Octa, the forex and CFD broker. `octafx` returns nothing either.
- **baldor** (3×) — Baldor, ABB's industrial motors and drives brand. The machine layer, a fifth week running.
- **bancodebogota** (2×) — Banco de Bogotá, one of Colombia's largest banks. The spaced form returns other banks, not this one.
- **sydbank** (2×) — a Danish commercial bank.
- **eurofunk kappacher** (2×, plus 6 more as the name was typed out letter by letter) — Austrian software for emergency-dispatch control rooms. Somebody typed the whole company name, GmbH included, and got nothing at every step. It's the fourth week of resilience-shaped demand in this report: outage, alerts and cables, and now the room that dispatches the response.
- **flussonic** (2×) — a video streaming server that ships its own HTTP API.
- **dallmeier** (2×) — German video-security cameras and management software.

**Banks again, from two more countries** — Colombia and Denmark, after India and Brazil last week. And two rows of video: one company streams it, one records it.

`croxyproxy` came back a third week, at 6×.

**If you build in one of these lanes, this is your invitation.** Add your API in about two minutes: [**apis.io/add**](https://apis.io/add) — or point your agent at the [apis.io MCP server](https://apis.io/) and let it submit for you.

***

## 🆕 New to the Index

The deployed index reads **28,811 providers and 143,895 APIs** — **up 1,236 providers in a week**, and up 4,698 APIs. As always, the API line counts specification files, not products.

The MCP lines were quiet, which is the useful news after last week's jump:

|   | Last Monday | Today |   |
| --- | --- | --- | --- |
| MCP entries (all) | 6,714 | **6,800** | \+86 |
| — hosted endpoints | 2,499 | **2,508** | \+9 |

Last issue I said the jump to 2,499 hosted endpoints was the index catching up to servers that already existed, not a week of launches. This week's +9 is what that looks like afterward.

Thirty-five posts went up on the blog last week. Among them:

- [**DoorDash Drive Refunds puts the whole refund policy in one operation, and the policy lives in the enums**](https://apis.io/blog/)
- [**a16z's twelve agent-native companies mostly move money, and OpenAI is not one of them**](https://apis.io/blog/)
- [**Acronis scores exemplar, ships its own MCP server, and describes none of its 90 OAuth scopes**](https://apis.io/blog/)
- [**Twelve Data streams prices over a real WebSocket, and the only contract for it is one we wrote**](https://apis.io/blog/)
- [**Latin America has 403 providers on apis.io, and only 41 say they are headquartered there**](https://apis.io/blog/)
- [**The catalog indexes 127,757 JSON Schemas, and most never say which fields are required**](https://apis.io/blog/)

All on the [apis.io blog](https://apis.io/blog).

***

## ⭐ Rated This Week: Square — the refund an agent can't send twice

*This week's angle: refunds entered the top hundred for the first time. A refund is the operation where an agent's retry costs real money. So: who makes it safe?*

|   | Square |
| --- | --- |
| **Kin Score** | **75.9** exemplar |
| **Agent Readiness** | **60.6 agent-native** |
| Contracts / callable | 42 / 100%, none derived by us |
| Idempotency · reversibility | verified · verified |

That Agent Readiness score is higher than Stripe's 58.3 from last issue. Of the six payments providers I compared this morning — Square, Stripe, DoorDash, Adyen, PayPal, Loop — it's the highest.

The reason is in the contract. Square's `RefundPayment` operation — `POST /v2/refunds` — **won't accept a refund without an idempotency key.** `idempotency_key` is a required field, right next to `amount_money`, and the schema says what it's for: a unique string per refund request. An agent that times out and retries sends the same key, and Square refunds once. Most APIs offer idempotency as an option. Square makes it the price of asking for your money back.

The door checks out too. `mcp.squareup.com/mcp` is Square's own hosted MCP server. An anonymous `initialize` gets the right refusal:

```javascript
HTTP/2 401
www-authenticate: Bearer realm="OAuth",
  resource_metadata="https://mcp.squareup.com/.well-known/oauth-protected-resource/mcp",
  error="invalid_token", error_description="Missing or invalid access token"
```

The RFC 9728 document names the resource and its authorization server. That server publishes RFC 8414 metadata with a **dynamic client registration endpoint** at `/register`, so an agent can register itself. A made-up `.well-known` path returns 404, so none of this is a catch-all.

**The cheapest points left are about saying what the door allows.** The MCP server's authorization metadata advertises no scopes. Square's main OAuth has fine-grained permissions, like separate read and write access to payments, but an agent arriving at this door can't learn them before it asks. For a server that can issue refunds, that's the one thing an agent most needs to know up front. The same metadata still accepts `plain` PKCE alongside `S256`. Neither squareup.com nor developer.squareup.com serves a `/.well-known/api-catalog`, and there's no agent card — all 404 today. Contract governance, at 27.3, is the lowest facet on the scorecard.

Square has done the hardest part of agent-safe money: you can't refund twice by accident. What's left is telling an agent, before it registers, how much it will be allowed to do.

*Kin Score rubric 0.23.0, scored 2026-10-03. Bands: exemplar 66.5+ · strong 54.3–66.4 · developing 39.3–54.2 · thin 26.2–39.2 · emerging 11–26.1 · minimal 0–10.9. Agent Readiness: agent-native 38.7+ (gated on idempotency AND error semantics) · agent-ready 28.6–38.6 · agent-aware 5.1–28.5 · human-only 0–5.*

***

## 🤖 Reproduce this yourself

Square and Stripe, side by side, no key required:

```javascript
find_providers(providers=["square","stripe"], fields=["slug","score","agent_readiness","api_count"])
```

The refund contract's required fields:

```javascript
get_openapi(aid="square:square-refunds-api", include=["content"])
```

Look for `RefundPaymentRequest.required`: `idempotency_key`, `amount_money`.

Then the door, the way I checked it:

```javascript
curl -s -D - -o /dev/null -X POST https://mcp.squareup.com/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' \
  | grep -i www-authenticate

curl -s https://mcp.squareup.com/.well-known/oauth-authorization-server
```

Or read the demand data directly: [**apis.io/search-terms/**](https://apis.io/search-terms/), refreshed every Monday.

***

**28,811 providers. 143,895 APIs. Half a million requests, five thousand questions — and one of the loudest was how to give the money back.** See a gap that's yours? → [**apis.io/add**](https://apis.io/add)

*The Demand Report is a weekly read of apis.io's own search + discovery signal. Forward it to someone who ships an API.*

***

## Discussion

No replies yet.