The Demand Report — Issue #09

The five most-searched terms last week were not five searches. They were one stack — outage, network status, flight tracking, emergency alerts, satellite imagery — and the catalog has exactly one thin answer for each. Week of September 7 – 13, 2026 · 27,596 providers · 133,764 APIs Every Monday I read what people and agents actually typed into apis.io — the search box and the MCP server — as a demand signal for the API economy. Nobody else has this data, so nobody else can send you this email. 📈 The Demand Report Here is the top of last week's search log, unedited: Term Requests Critical Infrastructure Outage API 197 Telecommunications Network Status API 196 Aviation ADS-B Flight API 195 Emergency Management Alert API 195 Satellite Earth Observation API 195 978 requests across five terms, all within two of each other. That evenness is one caller, and the sixth-placed term is University at 59 — so this cluster is four times the size of everything beneath it. I have written three issues in a row now about a machine's shopping list, and the reason I keep doing it is that the lists keep being legible. This one is the most legible yet. Read the five together and they are not five product searches. They are one system: is the grid up, is the network up, where are the aircraft, what has been declared an emergency, and what does it look like from orbit. That is a situational-awareness stack — the thing an emergency-management desk, a reinsurer, a national-resilience team or an agent doing any of their work would need to assemble. Nobody searched for "an API." Somebody searched for a capability set. So can the catalog assemble it? One at a time, honestly. The catalog has an answer for every one — and in every case it is thin, and it is an accident rather than a category. The stack asked for What we actually hold Aviation ADS-B one exact match — the ADS-B Exchange feed — plus FlightAware AeroAPI and Firehose, and Airlabs. 20 APIs on "flight tracking" Critical infrastructure outage 13 APIs on "power outage" — EPCOR, SSEN, Western Power, Manitoba Hydro, SaskPower. Individual utilities, mostly not American Telecom network status ThousandEyes Internet Insights, AEMO Outage Management, and 128 loose matches on "network status" Emergency management alert 5. Bandwidth Emergency Notification, Weatherbit Severe Weather Alerts, Department of the Interior Alerts Satellite earth observation 29 — NASA Earth Imagery and EPIC, AWS Earth Observation Jobs, then a run of agriculture NDVI products The sharpest absence is a standard, not a company. Emergency alerting has one: the OASIS Common Alerting Protocol, which is what IPAWS and the national weather services actually speak. Search the catalog for it and you get 34 fuzzy matches and not one CAP implementation. The layer that would let these five talk to each other is the layer that is missing. So the honest answer is: we can return one of each, and we cannot return the stack. A buyer assembling this has to know in advance that ADS-B Exchange, SSEN and NASA EPIC belong in the same sentence. The catalog will not tell them. Which is the thing 7,062 requests asked for again Last issue I reported that cohorts — the endpoint that scores and ranks a group of providers rather than finding one — went from never-touched to 7,187 gate bounces, and I flagged that one week is not a trend. It came back at 7,062. Gated resource Aug 31–Sep 6 Sep 7–13 cohorts 7,187 7,062 security 4,481 4,782 scopes 331 667 ratings 123 45 resolve 33 32 agent-readiness 16 16 Total bounces off the paid surface: 13,090 → 13,541. In a week when total volume fell 2%, keyless callers fell 25%, and the vocabulary hit the lowest point this report has ever recorded, the steadiest line in the entire dataset is demand for the layer that compares things. scopes doubled on top of it. Two weeks is not a law, but it is no longer a spike. And it sits underneath the lead: somebody spent last week hand-assembling a five-part stack one search at a time, and the endpoint that would have done it in one call refused them 7,062 times. A correction: the tier line is mine, not the market's Last issue I reported that pro and business requests appeared in the demand log for the first time and framed it as the first sign that a subscriber had actually used a key. I was wrong, and I am withdrawing it. by_tier records the plan on the presented key. It does not distinguish my keys from anybody else's, and I hold three: an Understanding key, an Influence key and an owner key. Checked this morning against /api/v1/me, they resolve to pro, business and owner exactly. Then the arithmetic. On 7, 11 and 12 September I ran a tag-quality pass over 56 tags, every call sending the Understanding key — the timestamps are in network/_qc/tag-qc.json, 43 of them on the 11th alone. pro went 289 → 2,655 in that same week. That is me. So is a good part of the rest: authenticated traffic reads 1,113 → 5,649, and I cannot show you which slice of it is a subscriber, because the log was never built to answer that. Until it carries a first-party flag, the authenticated line is not a demand signal and I will not print it as one. The gate bounces above are unaffected — a bounce is by definition a caller without the plan, and my keys have it. That is the number to read. The volume, and the vocabulary floor This week vs last: total searches −2.3% to 297.0k, keyless API −25% to 199.2k, unique terms −5.7% to 5,056, MCP searches +28% to 2,041. Footnote: vocabulary hit the lowest point of the run; the green bar is agents coming back Total requests came in at 297,000, down 2.3%, and keyless callers fell hard — 266,651 → 199,207, down 25% — as last week's caller eased off. Distinct search terms came in at 5,056 — the lowest of the entire run. The series across nine measured weeks: 5,553 → 6,082 → 5,595 → 5,547 → 5,338 → 5,978 → 5,514 → 5,363 → 5,056. Total requests stayed near 300,000. That is the sixth consecutive week of volume and vocabulary pointing in opposite directions, and by now the interesting question is not which to believe but what is eating the vocabulary. Two machines are, and neither is a buyer. The dictionary crawler from August is back, working the E's and F's — flugelhorn, gastropod, inglenook, keelhaul. And last issue's catalog crawler is still reading our own index back to us, now in camelCase: receivetags, reexportdataset, rejectaccess, roleassignees, editmetadata, filedownloads. Neither produces a distinct human term; both inflate the request count. Agent traffic recovered: MCP searches 1,591 → 2,041, up 28%. Last issue I called 4,533 a spike and named 1,500–2,800 as the durable band. It landed at 2,041, inside it. That call held. Above the noise the human list is the usual: University (59), Payments (52), Football (25), Moomoo (23), AI (22), Text To Speech (15), OpenAI (14), Pulmonary Embolism (13), Wireless Network Monitoring (13). 🕳️ The Gaps (demand we couldn't answer) The pipeline saw 1,183 raw unmet terms, dropped 662 as noise — the largest noise share yet, which is the two crawlers — and kept 234, double last week's 113. I re-probed all 100 published zero-result terms this morning. All 100 still return nothing — a second consecutive clean sweep. Three candidates came off the list before it was drawn, because the provider is already indexed under a spaced name: coinsph (Coins.ph), enablebanking (Enable Banking) and duckcreek (Duck Creek). That is the third week running for this, and it is no longer a footnote — the squashed no-space domain is a normal way to type a company, and while the search misses it, some share of "unmet demand" every week is a provider we already hold. I would rather tell you the number is soft than quote it as though it were clean. Seven rows survived, each checked against the live catalog by hand: The Gaps — top zero-result searches: dataionics 4×, manitou 3×, then imunify, comarch, auvik, bitdefender and boomplay at 2× each dataionics (4×) — and it lands straight on the lead. Dataionics does "geospatial data access and delivery at scale." That is the fifth row of the resilience stack, searched for by name, and we do not have it. manitou (3×) — Manitou Group, the French manufacturer of telehandlers, aerial work platforms and earthmoving machinery. Second week running for the machine layer, after schneider m221 and viessman. imunify (2×, plus 2 as imunif) — Imunify360, the Linux web-server security suite from CloudLinux, on a great many shared hosts. comarch (2×, plus 2 as comarc) — Comarch, a Polish global software house whose telecom OSS/BSS runs at carriers. Also inside the stack: "telecommunications network status" is what that software is for. auvik (2×) — cloud network management and visibility. Also inside the stack, and it pairs with Wireless Network Monitoring at 13 in the top terms. bitdefender (2×) — a global cybersecurity vendor with a real management API, and we simply do not have it. Some absences have no story; this one is just a hole. boomplay (2×) — African music streaming with something near 100 million listeners. The non-Anglophone pattern, again. Three of seven are inside the lane the lead is about — geospatial delivery, telecom OSS, network visibility. When the same week's top demand and top gaps point at the same capability set, that is the clearest buy signal this report produces. One repeat worth naming without giving it a row: apifootball came back a third consecutive week, at 5×. I published it in #08 and I discount previously-published terms, so it is not on the chart — but three weeks of somebody looking for a football-data API by product name is a standing invitation. If you build in one of these lanes, this is your invitation. Add your API in about two minutes: apis.io/add — or point your agent at the apis.io MCP server and let it submit for you. 🆕 New to the Index The deployed index reads 27,596 providers and 133,764 APIs. Tonight's build carries 28,483 and 138,375 and ships this week, so the pair above is the pair you can check right now. Two thirds of the live MCP servers are somebody else's engineering Three weeks ago I wrote that only a quarter of our MCP inventory is a hosted endpoint. Two weeks ago the index re-cut the count to require a real server rather than a candidate manifest. This week the scoring rubric asked the next question, and it is the sharpest of the three: of the servers that are real and reachable, who actually built them? The probe enumerates tools/list and fingerprints the tool-name set. Of 660 servers that answered with an enumerable tool list, 305 — 46% — serve a tool list byte-identical to at least one other provider's. Only 20 distinct fingerprints account for all 305. Providers sharing it Served at What it is 129, 13 tools /api/ucp/mcp one commerce protocol — create_cart, create_checkout, complete_checkout, get_order, lookup_catalog 68, 9 tools /_api/mcp Wix — CallWixSiteAPI, ExecuteWixAPI, BrowseWixRESTDocsMenu 36, 1 tool /api/mcp Shopify — search_shop_policies_and_faqs, and nothing else 15, 1 tool — Mintlify — searchDocs, and nothing else Thirty-six companies — Allbirds, Blue Origin, Athletic Greens among them — "have an MCP server," and what it can do is search their shop policies. One tool, installed by their storefront platform, identical across all thirty-six. Nothing here is a criticism of those companies; a platform shipping an agent surface to its whole customer base is a good thing, and it is how most of the web gets any new capability. It is a criticism of the count. "Provider X has an MCP server" has been carrying the implication that provider X made a decision about agents, and for 305 of 660 measured servers, provider X's platform made it for them. The rubric now grades authorship accordingly — a platform-authored server earns a quarter of what a first-party one does, matching how agentic_commerce has always scored the same distinction. 1,055 servers gate tools/list behind auth and are never classified at all; they keep full credit, because unknown is not a finding. Last Monday Today MCP entries (all) 4,801 4,961 +160 — real servers 2,560 2,651 +91 — hosted endpoints 1,254 1,298 +44 — providers credited with MCP 2,476 2,566 +90 Security artifacts (providers) 24,328 24,423 +95 Scopes artifacts (providers) 2,824 2,871 +47 Nineteen posts published last week — the heaviest run yet. A few worth your time: We Found Twenty-Five Live x402 Services. One Was in Our Catalog. 899 APIs Can Upsert. 39 Tell You What Happened. Blockscout Runs an MCP Server the Catalog Cannot See WorkOS Chose 409 Over an Idempotent Create Wagtail Ships an Agent API and Refuses the AI Button An Agent Cannot Fill In a Form All on the apis.io blog. ⭐ Rated This Week: ADS-B Exchange vs FlightAware — twenty points of weather report This week's angle: the two providers that answer the week's most-searched capability, and the single facet that separates them. Aviation ADS-B Flight API drew 195 requests. The catalog returns exactly one exact match — ADS-B Exchange, the unfiltered community feed — and one obvious commercial alternative, FlightAware with AeroAPI and Firehose. Same question, two postures. ADS-B Exchange FlightAware Kin Score 38.6 thin 58.4 strong Agent Readiness 30.6 agent-ready 37.2 agent-ready Contracts / callable 5 / 100% 8 / 100% Twenty points apart. Now look at where the twenty points are: Facet ADS-B Exchange FlightAware Discoverability 68.5 59.3 Contract Quality 68.0 65.9 Access Clarity 50.0 84.2 Developer Ergonomics 21.4 47.0 Contract Governance 9.8 4.5 Operational Transparency 0.0 76.3 ADS-B Exchange writes a better contract and is easier to find. It beats FlightAware on discoverability, on contract quality, and even on contract governance — where both are poor. Its five specifications are 100% callable, none of them derived by us. It scores zero on operational transparency, and that is nearly the whole gap. I checked it rather than trusting the number. status.adsbexchange.com does not resolve. Its provider record carries thirteen common artifacts and not one of them is a status page, a changelog, a deprecation notice or a support channel. FlightAware's carries thirty-four, including a live status.flightaware.com, a Firehose revision history, an error catalog and a published lifecycle. Here is why that matters this week specifically, and not as a general scolding. The search that surfaced both of these was somebody assembling a resilience stack — a system whose entire job is to know whether things are working. A feed that publishes no status page, no incident history and no deprecation notice cannot go in that stack, however good its OpenAPI is, because the first question that system has to answer about its own inputs is "is this source up right now?" ADS-B Exchange has built the hard part. The 68.0 contract quality is real engineering and the community feed is genuinely the unfiltered one. The cheapest twenty points in this issue are a status page and a changelog — and they would move it from thin to the top of developing without touching a line of the API. Kin Score rubric 0.22.0, scored 2026-09-14. Bands: exemplar 66.5+ · strong 54.3–66.4 · developing 39.3–54.2 · thin 26.2–39.2 · emerging 11–26.1 · minimal 0–10.9. Agent Readiness 0.2: agent-native 38.7+ (gated on idempotency AND error semantics) · agent-ready 28.6–38.6 · agent-aware 5.1–28.5 · human-only 0–5. 0.22.0 regrades MCP servers by authorship, so agent-readiness moved for providers running a platform-built server; neither of these two runs an MCP server, so neither is affected by that change. 🤖 Reproduce this yourself The stack question, one term at a time, no key required: apis_io_search(q="ADS-B", return="apis") apis_io_search(q="power outage", return="apis") apis_io_search(q="Common Alerting Protocol", return="apis") One exact match, thirteen utilities, and nothing that speaks CAP. The endpoint that would have answered it in a single call still refuses: curl -s "https://apis.io/api/v1/cohorts?limit=1" {"error":"unauthorized", "detail":"The cohorts endpoint requires an authenticated caller. Register at ..."} Note the refusal has two shapes, and they mean different things: an anonymous caller gets 401 pointing at registration, while a key without the plan gets 402 pointing at the plans page. Last issue quoted the 402. Both land in the bounce count above. And this week's two providers, checked the way I checked them: curl -sI https://status.flightaware.com/ # 200 curl -sI https://status.adsbexchange.com/ # does not resolve That is the twenty points, on the wire. 27,596 providers. 133,764 APIs. Five terms, 978 requests, one stack — and one thin answer each. See a gap that's yours? → apis.io/add The Demand Report is a weekly read of apis.io's own search + discovery signal. Forward it to someone who ships an API. Unsubscribe | 606 W 57th New York, NY 10019