Gadjah Mada University (Universitas Gadjah Mada, UGM) is a public research university in Yogyakarta, Indonesia, founded in 1949 and the country's oldest and largest state university. Unusually for this cohort, UGM's programmable footprint is real and it is its own: the university operates and publishes a first-party OpenAPI 3.1.0 contract for UGM ID, its OAuth 2.0 / OpenID Connect authorization server at oauth.simaster.ugm.ac.id, complete with an OIDC Discovery document, an RFC 8414 authorization-server metadata document, PKCE, RFC 7662 introspection, RFC 7009 revocation, RFC 8693 token exchange, a Swagger UI and a public health endpoint. Alongside it UGM runs its own Shibboleth SAML 2.0 Identity Provider, a CAS server, and two independent, fully functional OAI-PMH 2.0 endpoints — the EPrints institutional repository at repository.ugm.ac.id and the university-wide Open Journal Systems platform at journal.ugm.ac.id, whose articles carry DOIs under UGM's own Crossref prefix 10.22146 (member 9411). None of that is a vendor's contract running under UGM's name; every host is under ugm.ac.id and every specification describes itself as UGM's. What UGM does not have is a developer programme. There is no developer portal, no self-service client registration, no dynamic client registration, no documented route to a client_id, no changelog, no status page, no terms of service and no licence on any surface. There is no open data portal — data.ugm.ac.id returns a maintenance page — no public course, timetable or registrar API, and no research-computing service catalog. The main site's WordPress REST API is deliberately closed to anonymous callers, and the whole /.well-known/ path is blocked at the edge. The honest summary is a genuine engineering surface with no consumer-facing programme around it, plus three real registry and federation relationships recorded as facts about the institution rather than as contracts it wrote.
Gadjah Mada University publishes 12 API contracts indexed on the APIs.io network, including Discovery API, Infra API, OAI PMH API, and 9 more. Tagged areas include University, Higher Education, Education, Indonesia, and Research.
The Gadjah Mada University catalog on APIs.io includes 1 JSON-LD context and 1 Spectral governance ruleset.
Gadjah Mada University’s developer surface includes API reference, documentation, status page, engineering blog, support, GitHub presence, authentication, and 27 more developer resources.
Regulatory Posture applies to this provider. Its tags matched the
Education & Research regime, so
Regulatory Posture carries 15 points of the composite.
If this regime is wrong for your business, say so on your
provider repo — the
applicability map is public and we will correct it.
Create-or-Update Ergonomics applies to this provider. This API accepts writes, so it
carries 10 points of the composite. It is scored from the published contracts
themselves: whether a caller can create-or-update in one call, whether the write accepts a key the caller already
holds, and whether the response says which branch ran. Without that, every write needs a search-and-branch in
front of it, and the first time that check is skipped a duplicate record is created.
Scored against the observed mean rather than raw — a provider at the catalog average is unchanged by this facet,
not penalised by it.
The six quality facets above are damped to 75 points between them,
because the conditional facet above carries the other
25. That is why each facet's contribution is shown against a damped
maximum: raising a quality facet moves the composite by 75% of its nominal
weight, not 100%. The full arithmetic is at apis.io/rating/.
Standards this provider implements or carries. De facto ones are profiled and measured by the API Commons; formal ones come from the standards directory and are linked by the provider's own tags. The evidence column says how each claim was established — not that it was made.
UGM's own Shibboleth Identity Provider, entityID https://sso.ugm.ac.id/idp/shibboleth, publishing an unsigned SAML EntityDescriptor from the university's own host — retrieved li...
Central Authentication Service at sso.ugm.ac.id/cas, the login surface UGM systems redirect users to. A bare GET redirects to /cas/login and returns the login form (200, verifie...
UGM's self-hosted Moodle learning platform, eLOK, at elok.ugm.ac.id, with Moodle Web Services enabled and token-gated. Verified live on 2026-09-01: /webservice/rest/server.php r...
Universitas Gadjah Mada is a Crossref member in its own name — member id 9411, DOI prefix 10.22146 — verified live on 2026-09-01 against the Crossref REST API. Every DOI minted ...
Universitas Gadjah Mada's Research Organization Registry identifier, https://ror.org/03ke6d638, verified live on 2026-09-01 against the ROR v2 API. The persistent, machine-reada...
aid: gadjah-mada-university
name: Gadjah Mada University
x-type: university
x-category: Public Research University
description: 'Gadjah Mada University (Universitas Gadjah Mada, UGM) is a public research university in Yogyakarta, Indonesia,
founded in 1949 and the country''s oldest and largest state university. Unusually for this cohort, UGM''s programmable footprint
is real and it is its own: the university operates and publishes a first-party OpenAPI 3.1.0 contract for UGM ID, its OAuth
2.0 / OpenID Connect authorization server at oauth.simaster.ugm.ac.id, complete with an OIDC Discovery document, an RFC
8414 authorization-server metadata document, PKCE, RFC 7662 introspection, RFC 7009 revocation, RFC 8693 token exchange,
a Swagger UI and a public health endpoint. Alongside it UGM runs its own Shibboleth SAML 2.0 Identity Provider, a CAS server,
and two independent, fully functional OAI-PMH 2.0 endpoints — the EPrints institutional repository at repository.ugm.ac.id
and the university-wide Open Journal Systems platform at journal.ugm.ac.id, whose articles carry DOIs under UGM''s own Crossref
prefix 10.22146 (member 9411). None of that is a vendor''s contract running under UGM''s name; every host is under ugm.ac.id
and every specification describes itself as UGM''s. What UGM does not have is a developer programme. There is no developer
portal, no self-service client registration, no dynamic client registration, no documented route to a client_id, no changelog,
no status page, no terms of service and no licence on any surface. There is no open data portal — data.ugm.ac.id returns
a maintenance page — no public course, timetable or registrar API, and no research-computing service catalog. The main site''s
WordPress REST API is deliberately closed to anonymous callers, and the whole /.well-known/ path is blocked at the edge.
The honest summary is a genuine engineering surface with no consumer-facing programme around it, plus three real registry
and federation relationships recorded as facts about the institution rather than as contracts it wrote.'
type: Index
deliveryModel:
model: saas
open_source: false
commercial: false
callable_host: true
label: Hosted service · you call their endpoint
confidence: high
source:
- openapi
- probe
generated: '2026-09-01'
method: probed
note: 'Revised 2026-09-01. UGM operates callable hosts of its own — verified by live retrieval of an OpenAPI 3.1.0 document,
two OAI-PMH endpoints and a SAML descriptor. Not commercial: no pricing, no plans and no billing exist for any surface.'
accessModel:
pricing: free
onboarding: request
trial: false
try_now: true
public: false
label: Free · Credentials issued internally, read-only surfaces open
confidence: high
source:
- authentication
- probe
generated: '2026-09-01'
method: probed
note: Revised 2026-09-01. The discovery documents, the OpenAPI, /health and both OAI-PMH endpoints are anonymous and free
— verified with no credentials. Everything behind a token requires a client_id issued internally by DTI; there is no public
registration page and no dynamic client registration endpoint, so onboarding is `request` and `public` is false.
position: Consuming
access: 3rd-Party
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/gadjah-mada-university.png
url: https://raw.githubusercontent.com/api-evangelist/gadjah-mada-university/refs/heads/main/apis.yml
tags:
- University
- Higher Education
- Education
- Indonesia
- Research
- Identity Federation
- Authentication
- Research Repository
- Scholarly Publishing
- OAI-PMH
- Library
tags_raw:
- University
- Higher Education
- Education
- Indonesia
- Research
- Identity Federation
- Authentication
- OAuth
- Research Repository
- Scholarly Publishing
- OAI-PMH
- Library
created: '2026-06-03'
modified: '2026-09-01'
specificationVersion: '0.23'
apis:
- aid: gadjah-mada-university:shibboleth-idp
name: UGM Shibboleth SAML 2.0 Identity Provider
description: 'UGM''s own Shibboleth Identity Provider, entityID https://sso.ugm.ac.id/idp/shibboleth, publishing an unsigned
SAML EntityDescriptor from the university''s own host — retrieved live on 2026-09-01 (200, 6379 bytes, application/xml)
and saved to this repo. Advertises SAML 2.0, SAML 1.1 and the native Shibboleth 1.0 authn profile over HTTP-Redirect,
HTTP-POST and HTTP-POST-SimpleSign, with SOAP artifact resolution, three single-logout bindings, and a separate AttributeAuthority-
Descriptor exposing SAML 1.0 and SAML 2.0 SOAP AttributeQuery. Institution-operated by definition. Two findings are recorded
honestly: shibmd:Scope is declared as "ac.id" — the whole Indonesian academic namespace — rather than "ugm.ac.id", and
the entity is NOT present in the eduGAIN aggregate (10,616 entities checked 2026-09-01), so the IdP is self-published
rather than inter-federated. It is also not a developer API: no application can obtain an assertion without being registered
as a service provider.'
humanURL: https://sso.ugm.ac.id/
baseURL: https://sso.ugm.ac.id/idp/profile/Metadata/SAML
tags:
- Identity
- SSO
- SAML
- Shibboleth
- Federation
properties:
- type: IdentityFederation
url: https://sso.ugm.ac.id/idp/profile/Metadata/SAML
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: x-saml-metadata
url: authentication/gadjah-mada-university-saml-idp-metadata.xml
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
x-operator: institution
x-operator-evidence: 'The EntityDescriptor is served from sso.ugm.ac.id, a host under the institution''s own registrable
domain, and its entityID is https://sso.ugm.ac.id/idp/shibboleth. Deliberately classed `institution` rather than `federation`:
the federation class describes metadata carried by a federation operator (mdq.incommon.org, mdq.ukfederation.org.uk, metadata.surfconext.nl),
and this entity is absent from the eduGAIN aggregate and self-published from UGM''s own host. Calling it federated would
assert an inter-federation membership that the probe disproved. The surface class is identity federation; the operator
is the institution alone.'
x-entity-id: https://sso.ugm.ac.id/idp/shibboleth
x-sso-endpoint: https://sso.ugm.ac.id/idp/profile/SAML2/Redirect/SSO
x-scope: ac.id
x-probe:
baseURL_status: 200
baseURL_bytes: 6379
entity_id_url_status: 200
edugain_present: false
edugain_checked: https://technical.edugain.org/api.php?action=list_entities&format=json — 10616 entities, no ugm.ac.id
entity
probed: '2026-09-01'
- aid: gadjah-mada-university:sso-cas
name: UGM Single Sign-On (CAS)
description: Central Authentication Service at sso.ugm.ac.id/cas, the login surface UGM systems redirect users to. A bare
GET redirects to /cas/login and returns the login form (200, verified 2026-09-01). CAS defines a machine-readable /serviceValidate
response, but UGM publishes no service-registration route, no protocol documentation and no developer-facing contract
for it, so it is recorded as an authentication surface rather than as an API. It sits alongside, not behind, the OAuth
server and the Shibboleth IdP — three institution-operated identity stacks.
humanURL: https://dti.ugm.ac.id/knowledge-base/akses-365
baseURL: https://sso.ugm.ac.id/cas
tags:
- Authentication
- SSO
- CAS
- Identity
properties:
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Documentation
url: https://dti.ugm.ac.id/knowledge-base/akses-365
x-operator: institution
x-operator-evidence: sso.ugm.ac.id is under the institution's own registrable domain and hosts the Shibboleth IdP on the
same origin.
x-probe:
baseURL_status: 200
baseURL_effective: https://sso.ugm.ac.id/cas/login
documentation_status: 200
probed: '2026-09-01'
- aid: gadjah-mada-university:elok-moodle-webservices
name: eLOK Moodle Web Services (institution deployment)
description: 'UGM''s self-hosted Moodle learning platform, eLOK, at elok.ugm.ac.id, with Moodle Web Services enabled and
token-gated. Verified live on 2026-09-01: /webservice/rest/server.php returns the Moodle exception <ERRORCODE>invalidtoken</ERRORCODE>
— the service is on and wants a token, rather than reporting web services disabled — and /login/token.php (200) issues
tokens for username and password. The deployment, the host, the courses and the operations are UGM''s. The CONTRACT is
Moodle HQ''s product API, so no Moodle specification is saved under this slug and no Moodle engineering is credited to
the institution; this entry records the relationship and the verified deployment only.'
humanURL: https://elok.ugm.ac.id/
baseURL: https://elok.ugm.ac.id/webservice/rest/server.php
tags:
- LMS
- Moodle
- Education
- Students
- Authentication
tags_raw:
- Learning Management
- Moodle
- Education
- Students
- Authentication
properties:
- type: Documentation
url: https://elok.ugm.ac.id/
x-operator: institution
x-operator-evidence: elok.ugm.ac.id is under the institution's own registrable domain and the platform is self-hosted, not
a hosted MoodleCloud tenancy. Moodle markup confirmed in the served HTML.
x-contract-owner: Moodle HQ. This is the `shared_contract` class — the host verdict is institution and correct, and the
specification would still be the product's. No product spec is held here.
x-probe:
baseURL_status: 200
baseURL_body: <EXCEPTION class="core\exception\moodle_exception"><ERRORCODE>invalidtoken</ERRORCODE></EXCEPTION>
token_endpoint_status: 200
homepage_status: 200
probed: '2026-09-01'
- aid: gadjah-mada-university:crossref-membership
name: Crossref membership (member 9411, prefix 10.22146)
description: Universitas Gadjah Mada is a Crossref member in its own name — member id 9411, DOI prefix 10.22146 — verified
live on 2026-09-01 against the Crossref REST API. Every DOI minted by UGM's journals begins with that prefix, which links
the registry membership to the institution-operated journal platform. This is a FACT ABOUT THE INSTITUTION recorded through
a registry it is registered in. Crossref's own API contract belongs to Crossref and is deliberately not saved here; the
relationship is the finding.
humanURL: https://www.crossref.org/
baseURL: https://api.crossref.org/prefixes/10.22146
tags:
- DOI
- Crossref
- Registry
- Scholarly Publishing
- Persistent Identifiers
properties:
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: x-registry-record
url: https://api.crossref.org/members/9411
x-operator: registry
x-registrant-id: '9411'
x-doi-prefix: '10.22146'
x-probe:
baseURL_status: 200
member_record_status: 200
detail: api.crossref.org/prefixes/10.22146 returns member https://id.crossref.org/member/9411, name "Universitas Gadjah
Mada"
probed: '2026-09-01'
- aid: gadjah-mada-university:ror-record
name: ROR organization record (ror.org/03ke6d638)
description: Universitas Gadjah Mada's Research Organization Registry identifier, https://ror.org/03ke6d638, verified live
on 2026-09-01 against the ROR v2 API. The persistent, machine-readable identifier for the institution as an organisation,
and the join key between UGM's name and its research output across every scholarly system. A membership fact, not a contract
— ROR's API is ROR's.
humanURL: https://ror.org/03ke6d638
baseURL: https://api.ror.org/v2/organizations/03ke6d638
tags:
- Registry
- Persistent Identifiers
- ROR
- Research
- Organization Identity
properties:
- type: x-registry-record
url: https://ror.org/03ke6d638
x-operator: registry
x-ror-id: https://ror.org/03ke6d638
x-probe:
detail: api.ror.org/v2/organizations?query=Gadjah%20Mada returns ror.org/03ke6d638, ror_display name "Universitas Gadjah
Mada", links [https://ugm.ac.id]
status: 200
probed: '2026-09-01'
- aid: gadjah-mada-university:gadjah-mada-university-discovery-api
name: Gadjah Mada University Discovery API
description: RFC 8414 & OIDC Discovery
humanURL: https://oauth.simaster.ugm.ac.id/docs
baseURL: https://oauth.simaster.ugm.ac.id
tags:
- Discovery
properties:
- type: OpenAPI
url: openapi/gadjah-mada-university-discovery-api-openapi.yml
- type: x-openapi-original
url: openapi/_original/gadjah-mada-university-ugm-id-openapi.json
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: x-openid-configuration
url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
- type: x-oauth-authorization-server
url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: Documentation
url: http://repository.ugm.ac.id/information.html
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Documentation
url: https://journal.ugm.ac.id/
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
- aid: gadjah-mada-university:gadjah-mada-university-infra-api
name: Gadjah Mada University Infra API
description: Health check & infrastruktur
humanURL: https://oauth.simaster.ugm.ac.id/docs
baseURL: https://oauth.simaster.ugm.ac.id
tags:
- Infra
properties:
- type: OpenAPI
url: openapi/gadjah-mada-university-infra-api-openapi.yml
- type: x-openapi-original
url: openapi/_original/gadjah-mada-university-ugm-id-openapi.json
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: x-openid-configuration
url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
- type: x-oauth-authorization-server
url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: Documentation
url: http://repository.ugm.ac.id/information.html
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Documentation
url: https://journal.ugm.ac.id/
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
- aid: gadjah-mada-university:gadjah-mada-university-oai-pmh-api
name: Gadjah Mada University OAI PMH API
description: Open Archives Initiative Protocol for Metadata Harvesting, version 2.0.
humanURL: https://oauth.simaster.ugm.ac.id/docs
baseURL: https://oauth.simaster.ugm.ac.id
tags:
- OAI-PMH
properties:
- type: OpenAPI
url: openapi/gadjah-mada-university-oai-pmh-api-openapi.yml
- type: x-openapi-original
url: openapi/_original/gadjah-mada-university-ugm-id-openapi.json
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: x-openid-configuration
url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
- type: x-oauth-authorization-server
url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: Documentation
url: http://repository.ugm.ac.id/information.html
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Documentation
url: https://journal.ugm.ac.id/
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
- aid: gadjah-mada-university:gadjah-mada-university-social-login-api
name: Gadjah Mada University Social Login API
description: Social provider login (Google, Microsoft, Facebook, LinkedIn)
humanURL: https://oauth.simaster.ugm.ac.id/docs
baseURL: https://oauth.simaster.ugm.ac.id
tags:
- Social Login
properties:
- type: OpenAPI
url: openapi/gadjah-mada-university-social-login-api-openapi.yml
- type: x-openapi-original
url: openapi/_original/gadjah-mada-university-ugm-id-openapi.json
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: x-openid-configuration
url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
- type: x-oauth-authorization-server
url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: Documentation
url: http://repository.ugm.ac.id/information.html
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Documentation
url: https://journal.ugm.ac.id/
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
- aid: gadjah-mada-university:gadjah-mada-university-oauth2-api
name: Gadjah Mada University O Auth2 API
description: Endpoint inti OAuth2/OIDC
humanURL: https://sso.ugm.ac.id/
baseURL: https://sso.ugm.ac.id/idp/profile/Metadata/SAML
tags:
- Authentication
tags_raw:
- OAuth2
properties:
- type: OpenAPI
url: openapi/gadjah-mada-university-oauth2-api-openapi.yml
- type: x-openapi-original
url: openapi/_original/gadjah-mada-university-ugm-id-openapi.json
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: x-openid-configuration
url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
- type: x-oauth-authorization-server
url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: Documentation
url: http://repository.ugm.ac.id/information.html
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Documentation
url: https://journal.ugm.ac.id/
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
- aid: gadjah-mada-university:gadjah-mada-university-me-api
name: Gadjah Mada University Me API
description: The Me API from Gadjah Mada University — 1 operation(s) for me.
humanURL: https://sso.ugm.ac.id/
baseURL: https://sso.ugm.ac.id/idp/profile/Metadata/SAML
tags:
- Me
properties:
- type: OpenAPI
url: openapi/gadjah-mada-university-me-api-openapi.yml
- type: x-openapi-original
url: openapi/_original/gadjah-mada-university-ugm-id-openapi.json
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: x-openid-configuration
url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
- type: x-oauth-authorization-server
url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: Documentation
url: http://repository.ugm.ac.id/information.html
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Documentation
url: https://journal.ugm.ac.id/
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
- aid: gadjah-mada-university:gadjah-mada-university-user-api
name: Gadjah Mada University User API
description: The User API from Gadjah Mada University — 2 operation(s) for user.
humanURL: https://sso.ugm.ac.id/
baseURL: https://sso.ugm.ac.id/idp/profile/Metadata/SAML
tags:
- User
properties:
- type: OpenAPI
url: openapi/gadjah-mada-university-user-api-openapi.yml
- type: x-openapi-original
url: openapi/_original/gadjah-mada-university-ugm-id-openapi.json
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: x-openid-configuration
url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
- type: x-oauth-authorization-server
url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: Documentation
url: http://repository.ugm.ac.id/information.html
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Documentation
url: https://journal.ugm.ac.id/
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
common:
- type: CapabilityMap
url: capabilities/gadjah-mada-university-capability-edges.yml
name: Gadjah Mada University Business Capability Map
- type: Website
url: https://ugm.ac.id/en/
- type: APIReference
url: https://oauth.simaster.ugm.ac.id/docs
- type: Documentation
url: https://oauth.simaster.ugm.ac.id/openapi.json
- type: Status
url: https://oauth.simaster.ugm.ac.id/health
- type: PrivacyPolicy
url: https://ugm.ac.id/en/privacy-policy/
- type: Blog
url: https://ugm.ac.id/en/news/
- type: BlogRSS
url: https://ugm.ac.id/en/feed/
- type: Support
url: https://dti.ugm.ac.id/knowledge-base/
- type: IdentityFederation
url: https://sso.ugm.ac.id/idp/profile/Metadata/SAML
- type: ResearchRepository
url: http://repository.ugm.ac.id/
- type: LibraryCatalog
url: https://opac.lib.ugm.ac.id/
- type: ScholarlyPublishing
url: https://journal.ugm.ac.id/
- type: CourseCatalog
url: https://akademik.ugm.ac.id/
- type: AIPolicy
url: https://web.ugm.ac.id/etika-penggunaan-ai/
- type: AITooling
url: https://lib.ugm.ac.id/file/panduan-penggunaan-genai/
- type: GitHub
url: https://github.com/ugm-ac-id
- type: LinkedIn
url: https://www.linkedin.com/school/universitas-gadjah-mada/
- type: Authentication
url: authentication/gadjah-mada-university-authentication.yml
- type: Scopes
url: scopes/gadjah-mada-university-scopes.yml
- type: Conformance
url: conformance/gadjah-mada-university-conformance.yml
- type: Errors
url: errors/gadjah-mada-university-errors.yml
- type: Lifecycle
url: lifecycle/gadjah-mada-university-lifecycle.yml
- type: Rules
url: rules/gadjah-mada-university-rules.yml
- type: Vocabulary
url: vocabulary/gadjah-mada-university-vocabulary.yml
- type: Examples
url: examples/gadjah-mada-university-ugm-id-examples.yml
- type: JSONSchema
url: json-schema/gadjah-mada-university-ugm-id-schemas.json
- type: DomainSecurity
url: security/gadjah-mada-university-domain-security.yml
- type: Plans
url: plans/gadjah-mada-university-plans-pricing.yml
- type: RateLimits
url: rate-limits/gadjah-mada-university-rate-limits.yml
- type: FinOps
url: finops/gadjah-mada-university-finops.yml
- type: Review
url: review.yml
- type: x-json-ld
url: json-ld/gadjah-mada-university-context.jsonld
- type: x-blogs
url: blogs/blogs.json
x-coverage:
state: covered
reason: covered
detail: 'Six institution-operated surfaces found and verified by live probe on 2026-09-01, and one of them is a genuine
first-party contract: UGM publishes its own OpenAPI 3.1.0 document for UGM ID at https://oauth.simaster.ugm.ac.id/openapi.json
(200, 19677 bytes, servers[] both under ugm.ac.id, info.title "UGM ID", written in Indonesian, no vendor named), served
behind its own Swagger UI. Around it sit an OIDC Discovery document, an RFC 8414 metadata document, a public /health endpoint,
a self-published Shibboleth SAML 2.0 IdP, a CAS server, and two independent OAI-PMH 2.0 endpoints — the EPrints repository
and the OJS journal platform — both exercised through Identify, ListMetadataFormats, ListSets and ListRecords/ListIdentifiers
with real data returned. Two registry relationships are recorded as facts about the institution rather than as its contracts:
Crossref member 9411 with prefix 10.22146, and ROR 03ke6d638. One deployment, eLOK''s Moodle Web Services, is recorded
as a relationship with the contract left to Moodle. No vendor contract was found in this repo and none was added; nothing
was removed. The absences are stated as findings, not gaps in the probe: data.ugm.ac.id returns HTTP 200 serving a "UGM
- Maintenance" soft-404 so there is no open data portal, api.ugm.ac.id and hpc.ugm.ac.id do not resolve, no public course/timetable/registrar
API exists, github.com/ugm-ac-id is a real but empty org with zero public repositories, ai.ugm.ac.id 502s, the main site''s
WordPress REST API returns a machine-readable 401 refusal, and the entire /.well-known/ path on ugm.ac.id is 403''d at
the edge so the absence of security.txt cannot be distinguished from a block. Four of the twelve education-regime domain
standards are evidenced against fetched artifacts: oai-pmh, saml, shibboleth and crossref. The 2026-06-03 profile recorded
two surfaces and missed the OpenAPI, the journal platform, the SAML IdP and both registry memberships entirely.'
assessed: '2026-09-01'
method: pipeline-university + live probe
institution_surfaces: 6
tenant_surfaces: 0
registry_surfaces: 2
federation_surfaces: 0
federation_note: UGM runs a Shibboleth SAML 2.0 IdP — an identity-federation surface class — but it is self-published and
absent from eduGAIN, so it is counted as institution-operated rather than as a federation membership.
vendor_surfaces_removed: 0
contracts_saved: 1
contracts_derived: 2
evidence:
- url: https://oauth.simaster.ugm.ac.id/openapi.json
status: 200
note: OpenAPI 3.1.0, 19677 bytes, UGM's own. Saved to openapi/_original/.
- url: https://oauth.simaster.ugm.ac.id/docs
status: 200
note: Swagger UI, loads /openapi.json.
- url: https://oauth.simaster.ugm.ac.id/.well-known/openid-configuration
status: 200
- url: https://oauth.simaster.ugm.ac.id/.well-known/oauth-authorization-server
status: 200
- url: https://oauth.simaster.ugm.ac.id/.well-known/jwks.json
status: 200
note: 'Empty key set: {"keys":[]} while RS256 id_tokens are advertised.'
- url: https://oauth.simaster.ugm.ac.id/health
status: 200
note: '{"services":{"database":"up","redis":"up","simaster":"up"},"status":"ok"}'
- url: https://oauth.simaster.ugm.ac.id/api/me
status: 401
note: Correct status, HTML body instead of the declared ErrorResponse schema.
- url: https://oauth.simaster.ugm.ac.id/oauth/token
status: 401
note: POST with no credentials returns a correct RFC 6749 invalid_client error object.
- url: https://oauth.simaster.ugm.ac.id/definitely-not-a-real-path-12345
status: 404
note: Genuine 404 — negative probe confirms no soft-404 behaviour.
- url: https://oauth.dev.ugm.ac.id/.well-known/openid-configuration
status: 403
note: Declared in servers[] as the Development Server; refuses anonymous callers.
- url: https://sso.ugm.ac.id/idp/profile/Metadata/SAML
status: 200
note: 6379 bytes of SAML metadata, entityID https://sso.ugm.ac.id/idp/shibboleth.
- url: https://sso.ugm.ac.id/idp/shibboleth
status: 200
- url: https://sso.ugm.ac.id/cas
status: 200
note: Redirects to /cas/login.
- url: http://repository.ugm.ac.id/cgi/oai2?verb=Identify
status: 200
- url: http://repository.ugm.ac.id/cgi/oai2?verb=ListIdentifiers&metadataPrefix=oai_dc
status: 200
note: 100 identifiers in the first page.
- url: https://repository.ugm.ac.id/cgi/oai2?verb=Identify
status: 403
note: HTTPS origin blocked at the edge while HTTP returns 200. Pointers are http:// on purpose.
- url: http://repository.ugm.ac.id/information.html
status: 200
- url: https://journal.ugm.ac.id/index/oai?verb=Identify
status: 200
- url: https://journal.ugm.ac.id/index/oai?verb=ListRecords&metadataPrefix=oai_dc
status: 200
note: 100 records in the first page.
- url: https://elok.ugm.ac.id/webservice/rest/server.php
status: 200
note: Moodle Web Services enabled — returns invalidtoken, not service-disabled.
- url: https://elok.ugm.ac.id/login/token.php
status: 200
- url: https://api.crossref.org/prefixes/10.22146
status: 200
note: Member 9411, "Universitas Gadjah Mada".
- url: https://api.ror.org/v2/organizations?query=Gadjah%20Mada
status: 200
note: ror.org/03ke6d638.
- url: https://api.datacite.org/clients?query=gadjah
status: 200
note: Zero results — no DataCite registration.
- url: https://technical.edugain.org/api.php?action=list_entities&format=json
status: 200
note: 10616 entities, no ugm.ac.id entity — the IdP is not inter-federated.
- url: https://data.ugm.ac.id/
status: 200
note: SOFT-404. Serves "UGM - Maintenance", body class page-404. No open data portal exists.
- url: https://ai.ugm.ac.id/
status: 502
note: Dead. Not recorded as a pointer.
- url: https://ugm.ac.id/wp-json/
status: 401
note: '{"code":"rest_cannot_access","message":"DRA: Only authenticated users can access the REST API."}'
- url: https://ugm.ac.id/.well-known/security.txt
status: 403
note: The whole /.well-known/ path is blocked at the edge — absence is indistinguishable from a block.
- url: https://api.ugm.ac.id/
status: 0
note: Does not resolve. No central API host.
# --- truncated at 32 KB (34 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/gadjah-mada-university/refs/heads/main/apis.yml
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
Kin Score
How this is scored →