---
type: "article"
title: "The Demand Report — Issue #06"
summary: "The Demand Report issue #06 cover — the scarcest layer in the API economy is not contracts, it is permissions. 3,858 gated-resource attempts, 9.1% of providers publish scopes, 26,891 providers indexed."
newsletter: "APIs.io"
newsletter_handle: "apisio"
newsletter_url: "https://usecommune.com/n/apisio"
author: "Kin Lane (@kinlane)"
published: "2026-08-24T19:21:46.405Z"
canonical_url: "https://usecommune.com/n/apisio/a/bBHorUn5"
markdown_url: "https://usecommune.com/n/apisio/a/bBHorUn5.md"
chat_url: "https://usecommune.com/n/apisio/a/bBHorUn5/chat"
body_source: "native"
likes: 1
replies: 0
body_words: 2470
---

# The Demand Report — Issue #06

*Something spent the week trying to take the permission layer, search volume doubled without a single new buyer in it, and the provider that just landed publishes the exact thing the scraper was reaching for.*

**Week of August 17 – 23, 2026 · 26,891 providers · 116,770 APIs indexed**

***

Every Monday I read what people and agents actually typed into [apis.io](https://apis.io/) — the search box and the MCP server — as a demand signal for the API economy. Nobody else has this data, so nobody else can send you this email.

***

## 📈 The Demand Report

**The most reached-for thing in the catalog last week was not an API. It was permission.**

apis.io gates some resources behind a Pro plan, and it logs every attempt that bounces off the gate. Here is that log for the week:

| Gated resource | This week | All seven prior weeks combined |
| --- | --- | --- |
| `security` | **2,803** | 12 |
| `scopes` | **1,055** | 8 |
| `ratings` | 43 | 112 |
| `me` | 22 | 25 |
| `gaps` | 17 | 12 |

**3,858 attempts on two endpoints that had seen twenty in the entire history of this report.** `ratings` — which had been the most-reached-for gated resource every single week I've run this — came fourth by two orders of magnitude.

That is a machine, not a market. But *what* a machine tries to take is still information, and this one was specific. It did not sweep the API listings, which are free. It went after the two resources that describe how an API decides who is allowed to do what.

**Here is why the second one matters more than the first.** Of 26,891 providers in the catalog, **23,676 publish a security artifact — 88%.** Authentication is a solved, commodity disclosure; everybody says whether they take a bearer token.

**Only 2,459 publish scopes. That is 9.1%.**

Scopes are the difference between "this API needs a key" and "this key may read issues but not delete a workspace." For a human integrator that is a documentation nicety. For an agent it is the whole safety model — the boundary between an autonomous caller that can be trusted with a credential and one that cannot. Ninety-one percent of the catalog does not publish that boundary in machine-readable form, and last week something crawled 1,055 times at the 9% that does.

The scarcest layer in the API economy right now is not contracts. It is permissions.

### The volume doubled and none of it was demand

![This week vs last: total searches +106% to 91.1k, keyless API +277% to 47.9k, unique terms +12% to 5,978, MCP searches −9.4% to 2,508. Footnote: three green bars are one wordlist crawler; strip its 951 terms and real vocabulary fell to about 5,027](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-06-scoreboard.6429769f.png)

Three green bars up there are one crawler wearing a dictionary.

Total searches went **44,212 → 91,117**, and the keyless tier — outside callers hitting the API directly — went **12,718 → 47,897, up 277%**. The site's own tier rose 37% to 43,093. Every one of those lines looks like a great week.

It was one caller walking an alphabetical English wordlist through the search box. *Abduct. Absolve. Abnegate. Abolish. Abominate. Abrade. Abscond. Abstain.* Straight down the A's into the B's, both the `-ise` and the `-ize` spellings of every verb it could find. **951 distinct dictionary words** in seven days.

That matters because it lands on the one line I've told you to trust. Distinct search terms read **5,978**, up 12%, and 12% would be the strongest vocabulary growth this report has recorded. Take the 951 wordlist entries out and the real number is about **5,027 — down 5.8% from 5,338**.

**Volume doubled. Vocabulary shrank.** That is the honest read of the week, and it is the third time in six issues that a crawler has arrived to make a flat week look like a good one. There is no permanently clean tier here. There is only the arithmetic you do afterward.

The crawler is visible in the top-terms list too, sitting at four to seven hits a week — `Climax` logged 7. So this week the noise floor is high: **anything under 8 is unreadable**, and the human vocabulary starts above it.

Above the floor, it is the usual unglamorous specificity: `payments` (28), `News` (23) and `News API` (17), `australia` (16), `cisco` (15), `Aml` (14), `fhir` (13), `real estate` (12), `Web search` (12), `flight` (11), `voice` (11), `Algolia` (10), `OCR` (10), `weather` (10), `EDI` (9), `sms` (9), `square` (9), `ebay` (9), `Agent Cards` (8), `forex` (8), `Zoho CRM API v8` (8), `MTN Group` (8), `ING Australia` (8), `MAIF` (8), `Emarsys` (8), `Aquaculture` (8), `CO2 Emissions` (8), `Self Storage` (8).

AML, FHIR, EDI, a French mutual insurer, an Australian bank. Compliance plumbing and named vendors — the same shopping list as every other week, and still not a category among them.

**Concentration is at an all-time low.** The top 100 terms account for **1,008 of 91,117 requests — 1.1%**. One machine term, `AVORA Agent Forge`, takes 170 of those; the next-largest term is `payments` at 28. Strip the machine and the top 100 is 838 requests spread across the widest tail this report has seen. Nobody is converging on anything here.

### Agent traffic has found its plateau

MCP searches came in at **2,508, down 9.4%** from last week's record 2,768. The series now reads 35 → 42 → 310 → 1,027 → 518 → 1,924 → 2,768 → **2,508**.

Three weeks between 1,900 and 2,800 is a plateau, not a decline. The share number fell hard — 6.3% to **2.75%** — but that is entirely the denominator doubling underneath it. In absolute terms this was the second-strongest agent week on record.

**One small first:** both authenticated tiers showed up in the same week for the first time — `owner` at 48 calls and `starter` at 79. Two-figure numbers, and I'm reporting them because they are the first weekly signal that isn't anonymous.

***

## 🕳️ The Gaps (demand we couldn't answer)

The pipeline saw **1,341 raw unmet terms**. 951 of those were the wordlist crawl. Genuine unmet demand was **390** — squarely in line with the 366 and 453 of the two weeks before it, which is the clearest proof available that nothing about last week's headline volume was real.

I re-probed all 100 published zero-result terms against the live API this morning: **14 now return results and 86 genuinely do not.** The most-searched of the 14 was `Temenos`, which reads 74 APIs across 3 providers today. These eight are from the 86:

![The Gaps — top zero-result searches: Maasstroom Energie G1 and fireapp at 4×, Abivax and timetracelabs.com at 3×, then anvisa, archlending.com, atlascontrol.io and bancodebogota at 2× each](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-06-gaps.df33dea5.png)

- **Maasstroom Energie G1** (4×) — the sharpest row of the week. MaasStroom is a 426 MW gas-fired plant at Pernis in Rotterdam. `G1` is a *generating unit*. Somebody wasn't looking for an energy company's API — they were looking for per-unit generation data, by unit code, the way the European transparency platforms publish it. That is a person who knows exactly what shape the answer takes.
- **fireapp** (4×) — joint second, and I can't honestly tell you who they meant. At least three unrelated products ship under that name. If one of them is yours, this is four people a week finding nothing.
- **Abivax** (3×) — French clinical-stage biotech, microRNA immune regulation. Nasdaq-listed and about as far from "has a developer portal" as a company gets, which is exactly why someone checking is interesting.
- **timetracelabs.com** (3×) — TimeTrace Labs, a frontier-AI lab working on systems that change through time. Typed as a domain, not a name.
- **anvisa** (2×) — Brazil's national health regulator. Drug and device approvals for 200 million people.
- **archlending.com** (2×) — crypto-collateral lending, BTC/ETH/SOL.
- **atlascontrol.io** (2×) — an all-in-one platform for MSPs: RMM, helpdesk, quoting, billing, Microsoft 365.
- **bancodebogota** (2×, plus 2 more as `bancodebogota.co`) — one of Colombia's largest banks, hunted under both spellings.

**Two patterns worth naming.** Four of these eight were typed as bare hostnames — `timetracelabs.com`, `archlending.com`, `atlascontrol.io`, `bancodebogota.co`. People increasingly arrive at a catalog holding a domain, not a product name, and expect resolution from it. And the geography is the same one I wrote about last week: the Netherlands, France, Brazil, Colombia. The demand that goes unanswered here keeps being demand for things outside the English-speaking tech centres.

**If you build in one of these lanes, this is your invitation.** Add your API in about two minutes: [**apis.io/add**](https://apis.io/add) — or point your agent at the [apis.io MCP server](https://apis.io/) and let it submit for you.

***

## 🆕 New to the Index

The catalog stands at **26,891 providers and 116,770 APIs** after a full refresh this morning — seven waves, zero errors. Providers are up 316 on the week — recovering from last week's first-ever decline — and APIs up 1,462.

The line that moved most is the agent one:

|   | Last Monday | Today |   |
| --- | --- | --- | --- |
| MCP servers | 3,826 | **4,212** | **+386 (+10.1%)** |
| Agent skills | 1,527 | **1,574** | \+47 |
| Scopes artifacts | 2,397 | **2,460** | \+63 |
| Security artifacts | 40,810 | **41,312** | \+502 |

**The catalog added 386 MCP servers in seven days** — a 10% jump in a week, and the fastest-growing artifact type on the network by a wide margin. Scopes grew by 63.

That ratio is the whole story of this issue in two numbers. Six new MCP servers land for every one new declaration of what a key is allowed to do.

Publishing this week:

- [**TaskFolk Ships a Checkout for Agents**](https://apis.io/blog/) — a project-management platform that arrived with four interfaces, and the fourth is a second OpenAPI whose only four operations sell credits. See below.
- [**Six of Eight New APIs Ship an MCP Server**](https://apis.io/blog/) — the final submission batch, six of eight shipping a hosted MCP server alongside the REST API, none of them large companies. Across all four batches: 38 providers, 1,286 artifacts, zero failed runs.

**One thing that moved under everyone's feet, again:** the catalog was rescored today on **Kin Score rubric 0.12.1**. Numbers here are not comparable to #05's. MTN Group, last issue's subject, reads **54.1** today where it read 47.5 — same provider, same week, different ruler.

All on the [apis.io blog](https://apis.io/blog).

***

## ⭐ Rated This Week: TaskFolk — the 9%

*This week's angle: the new arrival that publishes the exact layer the scraper spent all week reaching for.*

[TaskFolk](https://apis.io/providers/taskfolk/) scores **62.3, a strong band**, with **Agent Readiness 51.9 — agent-native**. It is a project-management platform out of Dubai: issues, sprints, releases, portfolios, forms, automations. Twenty-year-old product category, and normally that means a REST API and a docs page.

I checked its claims against its own servers this morning rather than taking the catalog's word for it.

**It publishes 47 OAuth scopes.** `GET /.well-known/oauth-authorization-server` returns `scopes_supported` with 47 entries — `workspaces:read`, `projects:admin`, `issues:write`, on down — plus PKCE `S256` and an open dynamic client registration endpoint at `/api/oauth/register`. An agent can register itself, request exactly the permissions it needs, and be refused the rest. That is the 9% artifact, shipped properly.

**The MCP server refuses correctly.** An anonymous `tools/list` against `taskfolk.ai/api/mcp/v1` returns a typed JSON-RPC error — code `-32001`, "Missing or invalid API key" — not an HTML login page and not a 500. An agent can branch on that.

**And it publishes an RFC 9727 API catalog** at `/.well-known/api-catalog`, enumerating each surface as a linkset anchor with its own `service-desc`: the REST API, the MCP server, and machine-payment endpoints for ACP, UCP and x402. Four ways for a consumer to pay without a human, declared in a discovery document.

| Facet | Score |
| --- | --- |
| Discoverability | 87.0 |
| Access Clarity | 84.2 |
| Developer Ergonomics | 58.9 |
| Contract Quality | 58.1 |
| Operational Transparency | 52.6 |
| Contract Governance | 30.3 |

Two contracts, both **100% callable**, 187 operations across the REST surface.

**Where it sits against the board**, all rescored today:

|   | Kin Score | Agent Readiness | Band |
| --- | --- | --- | --- |
| **TaskFolk** | **62.3** | **51.9** | **agent-native** |
| MTN Group | 54.1 | 48.0 | agent-native |

**The cheapest points on the table:** contract governance at 30.3 is the lowest facet on the card and the one dragging a strong provider away from exemplar. There is no published versioning policy and no deprecation practice — on a product whose entire pitch is that agents are first-class members of your workspace. An agent that has registered itself, taken a scoped credential, and wired a payment endpoint into its loop is exactly the consumer that cannot survive a silently-changed contract. TaskFolk built the permission layer and the payment layer and has not yet published the promise that the ground won't move.

Contract quality at 58.1 is the second-cheapest lift, and on two specs it is a small amount of work.

*Bands, rubric 0.12.1: exemplar 66.5+ · strong 54.3–66.4 · developing 39.3–54.2 · thin 26.2–39.2 · emerging 11–26.1 · minimal 0–10.9. Agent Readiness 0.2: agent-native 46+ (gated) · agent-ready 34–45.9 · agent-aware 6–33.9 · human-only 0–5.9.*

*Two facets were renamed in this rubric line: *`governance`* is now ****Contract Governance**** (it scores rulesets, vocabulary, conformance and overlays — artifacts describing a contract, never how a company governs itself), and *`commercial_clarity`* is now ****Access Clarity**** (for a free statutory interface the word commercial described nothing, and 14 of that facet's 38 points never were). Both keys are emitted side by side through 0.12.x, so #05's labels and these are the same numbers.*

***

## 🤖 Reproduce this yourself

The scarcity claim is two calls. Paste into your agent against the [apis.io MCP server](https://apis.io/):

```javascript
find_providers(artifact_types=["Security"], limit=1, fields=["slug"])
find_providers(artifact_types=["Scopes"],   limit=1, fields=["slug"])
```

Read `meta.total` on each. You'll get 23,676 and 2,459 against 26,891 providers — 88% versus 9.1%. That gap is the entire argument of this issue, and it's one field in a free call.

Then check the provider claim without trusting me or the catalog:

```javascript
curl -s https://taskfolk.ai/.well-known/oauth-authorization-server | jq '.scopes_supported | length'
```

Or read the demand data directly: [**apis.io/search-terms/**](https://apis.io/search-terms/), refreshed every Monday.

***

**26,891 providers. 116,770 APIs. 3,858 attempts on the permission layer in seven days — and 91% of the catalog still doesn't publish one.** See a gap that's yours? → [**apis.io/add**](https://apis.io/add)

*The Demand Report is a weekly read of apis.io's own search + discovery signal. Forward it to someone who ships an API.*

***

## Discussion

No replies yet.