|
Something spent the week trying to take the permission
layer, search volume doubled without a single new buyer
in it, and the provider that just landed publishes the
exact thing the scraper was reaching for.
Week of August 17 – 23, 2026 · 26,891 providers ·
116,770 APIs indexed
Every Monday I read what people and agents actually typed
into apis.io — the search box and the MCP server — as a demand signal
for the API economy. Nobody else has this data, so nobody
else can send you this email.
📈 The Demand Report
The most reached-for thing in the catalog last week was
not an API. It was permission.
apis.io gates some resources behind a Pro plan, and it
logs every attempt that bounces off the gate. Here is that
log for the week:
|
Gated resource
|
This week
|
All seven prior weeks combined
|
|
security
|
2,803
|
12
|
|
scopes
|
1,055
|
8
|
|
ratings
|
43
|
112
|
|
me
|
22
|
25
|
|
gaps
|
17
|
12
|
3,858 attempts on two endpoints that had seen twenty in
the entire history of this report. ratings — which had been the most-reached-for gated resource
every single week I've run this — came fourth by two
orders of magnitude.
That is a machine, not a market. But what a
machine tries to take is still information, and this one
was specific. It did not sweep the API listings, which are
free. It went after the two resources that describe how an
API decides who is allowed to do what.
Here is why the second one matters more than the
first. Of 26,891 providers in the catalog, 23,676 publish a security artifact — 88%. Authentication is a solved, commodity disclosure;
everybody says whether they take a bearer token.
Only 2,459 publish scopes. That is 9.1%.
Scopes are the difference between "this API needs a
key" and "this key may read issues but not
delete a workspace." For a human integrator that is a
documentation nicety. For an agent it is the whole safety
model — the boundary between an autonomous caller that can
be trusted with a credential and one that cannot.
Ninety-one percent of the catalog does not publish that
boundary in machine-readable form, and last week something
crawled 1,055 times at the 9% that does.
The scarcest layer in the API economy right now is not
contracts. It is permissions.
The volume doubled and none of it was demand
|
|
This week vs last: total searches +106% to 91.1k,
keyless API +277% to 47.9k, unique terms +12% to
5,978, MCP searches −9.4% to 2,508. Footnote: three
green bars are one wordlist crawler; strip its 951
terms and real vocabulary fell to about 5,027
|
Three green bars up there are one crawler wearing a
dictionary.
Total searches went 44,212 → 91,117, and
the keyless tier — outside callers hitting the API
directly — went 12,718 → 47,897, up 277%.
The site's own tier rose 37% to 43,093. Every one of
those lines looks like a great week.
It was one caller walking an alphabetical English wordlist
through the search box. Abduct. Absolve. Abnegate. Abolish. Abominate. Abrade.
Abscond. Abstain. Straight down the A's into the B's, both
the -ise and the -ize spellings of every verb it could find. 951 distinct dictionary words in seven days.
That matters because it lands on the one line I've
told you to trust. Distinct search terms
read 5,978, up 12%, and 12% would be the
strongest vocabulary growth this report has recorded. Take
the 951 wordlist entries out and the real number is
about 5,027 — down 5.8% from 5,338.
Volume doubled. Vocabulary shrank. That
is the honest read of the week, and it is the third time
in six issues that a crawler has arrived to make a flat
week look like a good one. There is no permanently clean
tier here. There is only the arithmetic you do afterward.
The crawler is visible in the top-terms list too, sitting
at four to seven hits a week — Climax logged 7. So this week the noise floor is high: anything under 8 is unreadable, and the human vocabulary starts above it.
Above the floor, it is the usual unglamorous
specificity: payments (28), News (23) and News API (17), australia (16), cisco (15), Aml (14), fhir (13), real estate (12), Web search (12), flight (11), voice (11), Algolia (10), OCR (10), weather (10), EDI (9), sms (9), square (9), ebay (9), Agent Cards (8), forex (8), Zoho CRM API v8 (8), MTN Group (8), ING Australia (8), MAIF (8), Emarsys (8), Aquaculture (8), CO2 Emissions (8), Self Storage (8).
AML, FHIR, EDI, a French mutual insurer, an Australian
bank. Compliance plumbing and named vendors — the same
shopping list as every other week, and still not a
category among them.
Concentration is at an all-time low. The
top 100 terms account for 1,008 of 91,117 requests — 1.1%. One machine term, AVORA Agent Forge, takes 170 of those; the next-largest term is payments at 28. Strip the machine and the top 100 is 838 requests
spread across the widest tail this report has seen. Nobody
is converging on anything here.
Agent traffic has found its plateau
MCP searches came in at 2,508, down 9.4% from last week's record 2,768. The series now reads
35 → 42 → 310 → 1,027 → 518 → 1,924 → 2,768
→ 2,508.
Three weeks between 1,900 and 2,800 is a plateau, not a
decline. The share number fell hard — 6.3%
to 2.75% — but that is entirely the
denominator doubling underneath it. In absolute terms this
was the second-strongest agent week on record.
One small first: both authenticated tiers
showed up in the same week for the first time — owner at 48 calls and starter at 79. Two-figure numbers, and I'm reporting them
because they are the first weekly signal that isn't
anonymous.
🕳️ The Gaps (demand we couldn't answer)
The pipeline saw 1,341 raw unmet terms.
951 of those were the wordlist crawl. Genuine unmet demand
was 390 — squarely in line with the 366
and 453 of the two weeks before it, which is the clearest
proof available that nothing about last week's
headline volume was real.
I re-probed all 100 published zero-result terms against
the live API this morning: 14 now return results and 86 genuinely do not. The most-searched of the 14 was Temenos, which reads 74 APIs across 3 providers today. These
eight are from the 86:
|
|
The Gaps — top zero-result searches: Maasstroom
Energie G1 and fireapp at 4×, Abivax and
timetracelabs.com at 3×, then anvisa,
archlending.com, atlascontrol.io and bancodebogota
at 2× each
|
-
Maasstroom Energie G1 (4×) — the
sharpest row of the week. MaasStroom is a 426 MW
gas-fired plant at Pernis in Rotterdam. G1 is a generating unit. Somebody wasn't
looking for an energy company's API — they were
looking for per-unit generation data, by unit code,
the way the European transparency platforms publish
it. That is a person who knows exactly what shape the
answer takes.
-
fireapp (4×) — joint second, and I
can't honestly tell you who they meant. At least
three unrelated products ship under that name. If one
of them is yours, this is four people a week finding
nothing.
-
Abivax (3×) — French clinical-stage
biotech, microRNA immune regulation. Nasdaq-listed and
about as far from "has a developer portal"
as a company gets, which is exactly why someone
checking is interesting.
-
timetracelabs.com (3×) — TimeTrace
Labs, a frontier-AI lab working on systems that change
through time. Typed as a domain, not a name.
-
anvisa (2×) — Brazil's national
health regulator. Drug and device approvals for 200
million people.
-
archlending.com (2×) —
crypto-collateral lending, BTC/ETH/SOL.
-
atlascontrol.io (2×) — an all-in-one
platform for MSPs: RMM, helpdesk, quoting, billing,
Microsoft 365.
-
bancodebogota (2×, plus 2 more
as bancodebogota.co) — one of Colombia's largest banks, hunted
under both spellings.
Two patterns worth naming. Four of these
eight were typed as bare hostnames — timetracelabs.com, archlending.com, atlascontrol.io, bancodebogota.co. People increasingly arrive at a catalog holding a
domain, not a product name, and expect resolution from it.
And the geography is the same one I wrote about last week:
the Netherlands, France, Brazil, Colombia. The demand that
goes unanswered here keeps being demand for things outside
the English-speaking tech centres.
If you build in one of these lanes, this is your
invitation. Add your API in about two minutes: apis.io/add — or point your agent at the apis.io MCP server and let it submit for you.
🆕 New to the Index
The catalog stands at 26,891 providers and 116,770 APIs after a full refresh this morning — seven waves, zero
errors. Providers are up 316 on the week — recovering from
last week's first-ever decline — and APIs up 1,462.
The line that moved most is the agent one:
|
|
Last Monday
|
Today
|
|
|
MCP servers
|
3,826
|
4,212
|
+386 (+10.1%)
|
|
Agent skills
|
1,527
|
1,574
|
+47
|
|
Scopes artifacts
|
2,397
|
2,460
|
+63
|
|
Security artifacts
|
40,810
|
41,312
|
+502
|
The catalog added 386 MCP servers in seven days — a 10% jump in a week, and the fastest-growing artifact
type on the network by a wide margin. Scopes grew by 63.
That ratio is the whole story of this issue in two
numbers. Six new MCP servers land for every one new
declaration of what a key is allowed to do.
Publishing this week:
-
TaskFolk Ships a Checkout for Agents — a project-management platform that arrived with
four interfaces, and the fourth is a second OpenAPI
whose only four operations sell credits. See below.
-
Six of Eight New APIs Ship an MCP Server — the final submission batch, six of eight shipping
a hosted MCP server alongside the REST API, none of
them large companies. Across all four batches: 38
providers, 1,286 artifacts, zero failed runs.
One thing that moved under everyone's feet,
again: the catalog was rescored today on Kin Score rubric 0.12.1. Numbers here are not comparable to #05's. MTN
Group, last issue's subject,
reads 54.1 today where it read 47.5 —
same provider, same week, different ruler.
All on the apis.io blog.
⭐ Rated This Week: TaskFolk — the 9%
This week's angle: the new arrival that publishes
the exact layer the scraper spent all week reaching
for.
TaskFolk scores 62.3, a strong band,
with Agent Readiness 51.9 — agent-native.
It is a project-management platform out of Dubai: issues,
sprints, releases, portfolios, forms, automations.
Twenty-year-old product category, and normally that means
a REST API and a docs page.
I checked its claims against its own servers this morning
rather than taking the catalog's word for it.
It publishes 47 OAuth scopes. GET /.well-known/oauth-authorization-server returns scopes_supported with 47 entries — workspaces:read, projects:admin, issues:write, on down — plus PKCE S256 and an open dynamic client registration endpoint
at /api/oauth/register. An agent can register itself, request exactly the
permissions it needs, and be refused the rest. That is the
9% artifact, shipped properly.
The MCP server refuses correctly. An
anonymous tools/list against taskfolk.ai/api/mcp/v1 returns a typed JSON-RPC error — code -32001, "Missing or invalid API key" — not an HTML
login page and not a 500. An agent can branch on that.
And it publishes an RFC 9727 API catalog at /.well-known/api-catalog, enumerating each surface as a linkset anchor with its
own service-desc: the REST API, the MCP server, and machine-payment
endpoints for ACP, UCP and x402. Four ways for a consumer
to pay without a human, declared in a discovery document.
|
Facet
|
Score
|
|
Discoverability
|
87.0
|
|
Access Clarity
|
84.2
|
|
Developer Ergonomics
|
58.9
|
|
Contract Quality
|
58.1
|
|
Operational Transparency
|
52.6
|
|
Contract Governance
|
30.3
|
Two contracts, both 100% callable, 187
operations across the REST surface.
Where it sits against the board, all
rescored today:
|
|
Kin Score
|
Agent Readiness
|
Band
|
|
TaskFolk
|
62.3
|
51.9
|
agent-native
|
|
MTN Group
|
54.1
|
48.0
|
agent-native
|
The cheapest points on the table: contract governance at 30.3 is the lowest facet on the
card and the one dragging a strong provider away from
exemplar. There is no published versioning policy and no
deprecation practice — on a product whose entire pitch is
that agents are first-class members of your workspace. An
agent that has registered itself, taken a scoped
credential, and wired a payment endpoint into its loop is
exactly the consumer that cannot survive a
silently-changed contract. TaskFolk built the permission
layer and the payment layer and has not yet published the
promise that the ground won't move.
Contract quality at 58.1 is the second-cheapest lift, and
on two specs it is a small amount of work.
Bands, rubric 0.12.1: exemplar 66.5+ · strong 54.3–66.4
· developing 39.3–54.2 · thin 26.2–39.2 · emerging
11–26.1 · minimal 0–10.9. Agent Readiness 0.2:
agent-native 46+ (gated) · agent-ready 34–45.9 ·
agent-aware 6–33.9 · human-only 0–5.9.
Two facets were renamed in this rubric line: governance is now Contract Governance (it scores rulesets, vocabulary, conformance and
overlays — artifacts describing a contract, never how a
company governs itself), and commercial_clarity is now Access Clarity (for a free statutory interface the
word commercial described nothing, and 14 of that
facet's 38 points never were). Both keys are
emitted side by side through 0.12.x, so #05's
labels and these are the same numbers.
🤖 Reproduce this yourself
The scarcity claim is two calls. Paste into your agent
against the apis.io MCP server:
find_providers(artifact_types=["Security"], limit=1, fields=["slug"])
find_providers(artifact_types=["Scopes"], limit=1, fields=["slug"])
Read meta.total on each. You'll get 23,676 and 2,459 against 26,891
providers — 88% versus 9.1%. That gap is the entire
argument of this issue, and it's one field in a free
call.
Then check the provider claim without trusting me or the
catalog:
curl -s https://taskfolk.ai/.well-known/oauth-authorization-server | jq '.scopes_supported | length'
Or read the demand data directly: apis.io/search-terms/, refreshed every Monday.
26,891 providers. 116,770 APIs. 3,858 attempts on the
permission layer in seven days — and 91% of the catalog
still doesn't publish one. See a gap that's yours? → apis.io/add
The Demand Report is a weekly read of apis.io's
own search + discovery signal. Forward it to someone who
ships an API.
|
