Webhook is not a market. It is a capability — 633 providers carry it and 980 reach it through at least one of their APIs, 1,406 APIs in all, spread across email, shipping, social data, payments and public records. Only 39.2% of those providers claim it as part of what they are. And yet no tag with 300 or more providers scores higher. Providers tagged Webhook average a Kin Score of 48.6 against 21.7 for the rest of the catalog, with a median of 49.1 against 15.0. Yesterday’s showcase found healthcare trailing the market on nearly every measure. Webhook is the opposite case, and the reason is worth understanding.
The five the tag page ranks first come from five different businesses. OpenMercantil leads at 88.2, exemplar — an independent public-data API for Spanish company intelligence that indexes the BORME company register and cross-references it with more than 80 official sources, carried by a perfect access clarity score and 94.7 on operational transparency. Xquik is second at 86.8, an independent X data and automation platform with signed webhooks, OAuth 2.1, three MCP servers and the highest Agent Readiness score in the cohort at 91.4 — seventeen of nineteen dimensions lit. Kit, formerly ConvertKit, scores 84.1 with a creator email platform whose v4 API covers subscribers, sequences, broadcasts and purchases. AfterShip is at 83.1, tracking shipments across 1,400+ carriers for post-purchase ecommerce. Salesforce Marketing Cloud completes the five at 82.6. Together they average 85.0, which is only 36.4 points above their own cohort — a narrow gap by catalog standards, because the cohort underneath them is strong too.
Almost nobody in this tag is at the bottom. 9.2% of webhook providers are exemplars against 1.0% of the rest of the catalog, 22.9% are strong against 3.8%, and 46.3% are developing against 12.8%. The minimal band holds 0.8% of the tag — five companies — against 36.5% of everyone else. That distribution is the finding. You cannot ship a webhook without committing to a payload shape, a delivery contract and an authentication story, and a provider that has written those down for its outbound events has usually written them down for its inbound API too. The capability forces the discipline, and the discipline is what the Kin Score measures.
On agent readiness the gap is wider still. Webhook providers average 32.8 against 10.5, and only 3.2% are human-only against 55.5% of the rest of the catalog. 63% of the cohort is agent-ready or agent-native, against 12.2% outside. The dimension gaps read like a checklist of what event-driven work demands: an event surface described by 86.4% against 8.9%, a machine-readable contract from 95.6% against 32.7%, documented auth from 93.7% against 37.3%, and a stable error envelope from 74.2% against 20.1%. 28.8% run an MCP server against 8.6% of the rest.
Then there is idempotency. Webhook delivery is conventionally at-least-once: a sender retries, and the receiver is expected to handle a duplicate safely. But only 19.1% document idempotency on their own API — the same guarantee pointed the other way, for the agent that calls in, times out and retries. That is better than the rest of the catalog’s 3.3%, and it still leaves four in five of the market’s best-prepared category dark on it. The rubric makes the cost visible. Agent-native requires idempotency on top of the score floor, so Kit at 60.4 and AfterShip at 59.6 are agent-ready, while OpenMercantil at 46.6 is agent-native. The two higher scores are held back by exactly the guarantee webhook receivers are routinely expected to provide. Documented reversibility — how an agent undoes what it just did — sits at 29.2%.
The safety work that does exist is instructive. Xquik’s agentic access profile maps 127 operations, 56 of them acting, and puts a human in the loop on all 56. That is one way to make a write surface safe for an agent. Idempotency is the cheaper one, and it is the one this category already understands better than anyone — it just hasn’t written it down for its own endpoints.
Webhook is the clearest evidence in the catalog that the Kin Score is measuring engineering discipline, not marketing. Providers that had to describe their events precisely ended up describing everything precisely, and agents are inheriting the benefit. The last step is to apply the retry contract they already enforce on their receivers to the API they expose themselves.