Picture this. You have pointed an agent at a security API to rotate a secret, and partway through the call the connection times out. The agent cannot tell whether the rotation happened. It has to guess: try again and risk doing it twice, or stop and risk doing nothing. Before you trust it with the next one, you want to know whether the companies in this category have written down what a repeated call does.
The Security tag on apis.io is a fair place to look. It holds 886 providers and 507 APIs, and the post that reports on it frames the story with two numbers that run in opposite directions. 51.6% of its members have clear authentication documentation, against 37.0% of the rest of the catalog. But only 3.8% document idempotency, against 4.4% elsewhere. These are the companies you would expect to be careful about who may call an API, and the numbers say they are. The care has not reached what happens when the same call arrives twice.
Start with who sits at the top. The tag's top band is exemplar, with one listing per company. Cloudflare leads at 80.6 on the Kin Score, carried by developer ergonomics at 91.1 across 651 API pages. It is agent-native at 72.5, with idempotency, dry-run mode and documented reversibility all lit. Snyk scores 79.1, with operational transparency and access clarity at 92.1 each, while its contract governance at 22.0 is the weakest facet in the five. Elastic follows at 77.6. Its separate Elastic Stack listing sits right behind at 77.0, and the two read differently: idempotency and an MCP server are lit on the Stack and dark on the company listing. Paubox, the HIPAA compliant email infrastructure company, scores 77.0 from only 13 API pages. Amazon Secrets Manager rounds out the five at 76.8, with contract governance at 79.1 and seven API pages.
The cohort as a whole is ahead of the catalog, and the median shows it better than the mean. The 862 scored members average 27.3 against 20.5 for the 32,005 scored providers outside the tag. The medians are 24.6 and 13.4, a gap of 11.2 points. The difference sits at the bottom: 25.6% of Security is in the minimal band against 41.1% of everyone else. Exemplar is still rare at 2.8% against 1.7%. In the post's words, Security is not a category of leaders so much as a category with fewer empty listings.
Now the part that matters for your agent. Agent readiness is ahead by less, and at the very top it is behind. The tag averages 13.7 against 11.2, with 17.0% agent-ready against 13.0%. Then the ladder inverts: 8 providers, 0.9% of the tag, are agent-native, against 1.7% of the rest of the catalog.
The dimensions Security lights more than the market are the descriptive ones. Auth clarity leads at +14.6 points. Spec presence is 41.5% against 31.9%, and error semantics 30.4% against 21.8%. On the rest it is level or short. MCP server is 16.6% against 16.9%, and rate limit signal 33.6% against 33.7%. Reversibility is documented by 7.7% and dry-run mode by 1.2%.
The leaders show what the top band actually asks for. It is gated on idempotency and a stable error envelope, not on the score alone. Paubox has the second-highest agent readiness of the five at 63.3 and is agent-ready, not agent-native, because it does not light idempotency. Neither do Snyk or Elastic. Amazon Secrets Manager scores 42.8 and is agent-native. Among these five, only Cloudflare and Amazon Secrets Manager light idempotency, and only Cloudflare pairs it with an MCP server.
The post turns that into a statement about the category's own record. Security has documented the door and not what happens after it opens. A category built around access has written down less about retries than the market has.
So what do you take away? Your agent is more likely than average to learn how to authenticate and to find a contract. But at 96.2% of the tag it will not find a stated guarantee about a repeated call, and at 98.8% it cannot rehearse one. Here the writes are things like rotating a secret, changing a firewall rule or revoking a credential, and an agent that times out halfway through has to guess. Before you let it near those calls, check the provider's own idempotency and dry-run documentation, because the category's strong auth story will not tell you.
Read the original: https://apis.io/2026/11/01/security-explains-its-auth-better-than-the-market-and-documents-retries-worse/