Only 17 of 50 Personal APIs from Russian Services Are Open Without a Business Contract

Imagine telling an agent: "Order groceries, pay the internet bill and turn off the lights." In foreign news this already looks almost routine. But what about Russian services? Vika, the author of a study on Habr, decided not to guess and checked 424 companies and products across 16 categories.

Business gets APIs, buyers don't yet

The main conclusion: there are noticeably more connections for business than for personal tasks. Of the 424 services, 232 had an API, MCP or A2A, for a total of 312 connections. Of these, 233 are aimed primarily at business and only 50 at personal scenarios. That is 214 APIs, 97 MCP and one A2A. Among the MCP, 34 are official and 63 are third-party.

A typical example: through the Ozon Seller API you can manage products, prices and shipments. But this gives a buyer's agent nothing; it cannot place an order in your account.

An important caveat: the sample contains many business solutions, so the shares cannot be extrapolated to the whole market. The author did not test whether the connections work; she relied on documentation and the descriptions given by connector authors.

Search exists, purchasing almost doesn't

Among the 59 connections with personal scenarios, the picture is this: 53 support search, 8 support creating or confirming an order, and only 5 support a payment operation. Of these five, four are third-party MCP and one is the official YuMoney API.

VkusVill gives the agent a tool that finds products and creates a cart link. A human still has to complete the purchase. With Lenta, the API shows stores, prices and availability, but order placement is not confirmed in the published set. Delovye Linii (Business Lines) lets you create a shipping request, but cancellation or changes may be rejected after review.

A physical result (an order, a shipment, a command to a device) is declared for 10 personal connections across 9 services. Five of them are third-party MCP. Four use internal APIs or browser automation, for example the MCP for Yandex Eda and Pyaterochka. This is a fragile foundation: claims by authors are not the same as promises from the service owner.

Access is often closed before the first request

Official self-service access, without a corporate contract or paid plan, exists for 28 of the 312 connections, 17 of them personal. The remaining 284 need additional conditions or their access is unclear. For 191, corporate access, a seller account or a partner role is required; in 80 cases, approval or setup by an administrator is needed.

A2A turned up only once: with Albato Copilot, an external agent can create and run automations, but the address and token are issued by a manager.

There is good news too: the hypothesis that "APIs only read" was not confirmed. 186 connections change digital data, and 34 allow placing an order, shipment or booking, or sending a command to a device. These actions are simply concentrated in business tools. Yandex Disk and Smart Home offer personal official APIs, and the command to a device works without a purchase.

What developers and product managers should do

If you are building an agent for consumers, do not count on a ready-made "search, cart, payment" path. For now it is assembled from parts: official search, a cart link and human confirmation. If you own a service, the open opportunity is obvious: personal OAuth access without a seller account.

Before connecting, the author advises checking five things:

• whether personal access without a contract is possible;
• whether read and write permissions are separated;
• whether the operation requires confirmation;
• whether the order is protected against duplicate submission;
• whether the result can be verified.

The author has published the full registry with sources. It is useful as a map of what you can already try hands-on and where it is better to wait for official solutions.