Heriot-Watt University

aid: heriot-watt
name: Heriot-Watt University
x-type: university
x-category: Public Research University
description: 'Heriot-Watt University is a public research university based in Edinburgh, Scotland, with further campuses in
  the Scottish Borders, Orkney, Dubai and Malaysia, ROR 04mghma93. Its programmable footprint is small but — unusually for
  this cohort — not empty and not entirely rented. Two surfaces are genuinely institution-operated and openly callable without
  credentials: the Research Output Service (ROS) at www.ros.hw.ac.uk, a DSpace 8 deployment on the university''s own domain
  with a live OAI-PMH 2.0 endpoint and an unauthenticated DSpace REST/HAL API over its theses and research outputs; and the
  university''s SAML 2.0 identity provider, registered in the UK Access Management Federation as Heriot-Watt University, whose
  signed metadata is machine-readable through the federation''s MDQ service. Everything else that looks like a Heriot-Watt
  API is a vendor platform the university rents under its own name and is recorded here as a tenant relationship, not as Heriot-Watt
  engineering: the research portal at researchportal.hw.ac.uk is Elsevier Pure (the host CNAMEs to hwu.elsevierpure.com),
  library discovery at discovery.hw.ac.uk is Ex Libris Primo, canvas.hw.ac.uk is Instructure Canvas, and hw.ac.libcal.com
  is Springshare LibCal. Heriot-Watt operates no central developer portal, no public API documentation, no open-data portal
  and no course-catalog or timetabling API; the programme search at hw.ac.uk is server-rendered HTML with no JSON backend,
  and timetable.hw.ac.uk, though on the university''s own network, exposes no reachable public endpoint.'
type: Index
deliveryModel:
  model: saas
  open_source: false
  commercial: true
  callable_host: true
  label: Hosted service · you call their endpoint
  confidence: medium
  source:
  - pricing
  generated: '2026-08-30'
  method: derived
accessModel:
  pricing: free
  onboarding: none
  trial: false
  try_now: true
  public: true
  label: Free
  confidence: medium
  source:
  - plans
  generated: '2026-08-30'
  method: derived
position: Consuming
access: Public
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/heriot-watt.png
url: https://raw.githubusercontent.com/api-evangelist/heriot-watt/refs/heads/main/apis.yml
tags:
- University
- Higher Education
- Education
- Scotland
- United Kingdom
- Universities Scotland
- Research
- Research Data
- Institutional Repository
- Open Access
- OAI-PMH
- Identity Federation
- Library
- Learning Management
created: '2026-06-03'
modified: '2026-08-30'
specificationVersion: '0.23'
apis:
- aid: heriot-watt:research-output-service
  name: Heriot-Watt Research Output Service (ROS)
  description: 'The university''s own institutional repository of theses and research outputs, running DSpace 8 on www.ros.hw.ac.uk
    — a host under Heriot-Watt''s registrable domain with a matching PTR record, an open.access@hw.ac.uk administrative contact
    and Heriot-Watt''s own Handle prefix 10399. Two machine-readable surfaces are live and require no credentials: an OAI-PMH
    2.0 endpoint (Identify, ListMetadataFormats, ListSets and ListRecords all answer, with didl, mods, ore, mets, xoai and
    oai_dc metadata formats and community-level sets), and the DSpace REST/HAL API rooted at /server/api exposing communities,
    collections, items, bitstreams and the discover search index. The REST contract itself is DSpace''s product contract,
    shipped identically by every DSpace 8 installation, so no OpenAPI is saved under this institution; the deployment, the
    data and the OAI-PMH conformance are Heriot-Watt''s.'
  humanURL: https://www.ros.hw.ac.uk/
  baseURL: https://www.ros.hw.ac.uk/server/api
  x-operator: institution
  x-platform: DSpace 8.1
  tags:
  - Research
  - Institutional Repository
  - Open Access
  - Theses
  - OAI-PMH
  - DSpace
  properties:
  - type: APIReference
    url: https://www.ros.hw.ac.uk/server/api
  - type: ResearchRepository
    url: https://www.ros.hw.ac.uk/
  - type: Documentation
    url: https://www.hw.ac.uk/about/professional-services/information-services/research-support/ros-theses-repository
- aid: heriot-watt:identity-federation
  name: Heriot-Watt University Identity Provider (UK Access Management Federation)
  description: 'Heriot-Watt operates its own SAML 2.0 / Shibboleth identity provider and is a registered member of the UK
    Access Management Federation (registrationAuthority http://ukfederation.org.uk), which in turn exports to eduGAIN. Four
    entities carry OrganizationName "Heriot-Watt University": the IdP entityIDs https://shib1.hw.ac.uk/shibboleth, https://shibprod.hw.ac.uk/idp/shibboleth
    and https://shibdev.hw.ac.uk/idp/shibboleth (test), plus a service-provider entity https://courses.scholar.hw.ac.uk/shibboleth
    for the SCHOLAR Programme. Signed, per-entity SAML metadata is retrievable over the federation''s MDQ interface; the shib1
    IdP also serves its own metadata directly. This is a genuinely institution-operated, machine-readable surface, and the
    only Heriot-Watt one that is not a repository. Only shib1.hw.ac.uk resolves in public DNS today (137.195.101.235, Heriot-Watt''s
    own allocation); the shibprod, shibdev and courses.scholar names are registered in federation metadata but return NXDOMAIN,
    so the federation registration is currently ahead of the deployment.'
  humanURL: https://shib1.hw.ac.uk/shibboleth-idp/shibboleth
  baseURL: https://shib1.hw.ac.uk/
  x-operator: institution
  x-platform: Shibboleth Identity Provider
  tags:
  - Identity Federation
  - SAML
  - Shibboleth
  - Single Sign-On
  - eduGAIN
  properties:
  - type: Metadata
    url: https://shib1.hw.ac.uk/shibboleth-idp/shibboleth
  - type: IdentityFederation
    url: http://mdq.ukfederation.org.uk/entities/https%3A%2F%2Fshib1.hw.ac.uk%2Fshibboleth
  - type: Registry
    url: https://www.ukfederation.org.uk/
- aid: heriot-watt:research-portal
  name: Heriot-Watt Research Portal (Elsevier Pure)
  description: 'Heriot-Watt''s public research information portal — publications, projects, research data, activities and
    researcher profiles. It carries a hw.ac.uk hostname but is not institution-operated infrastructure: researchportal.hw.ac.uk
    is a CNAME to hwu.elsevierpure.com and on to eu.prod.elsevierpure.com, an Elsevier-hosted Pure tenancy. The data, the
    DOIs (prefix 10.17861, registered through DataCite client BL.HWU) and the landing pages are Heriot-Watt''s; the contract
    is Elsevier''s. Pure''s OAI-PMH and REST platform features are not open here — /ws/oai and /admin/oai return HTTP 500
    with a {"status":999} body, /ws/api and /ws/rest return 404, and /en/organisations/ is bot-challenged with 403 — so nothing
    programmatic is publicly reachable without an institutional arrangement. No Pure specification is saved under this institution.'
  humanURL: https://researchportal.hw.ac.uk/
  baseURL: https://researchportal.hw.ac.uk/
  x-operator: tenant
  x-platform: Elsevier Pure
  x-vendor-host: hwu.elsevierpure.com
  tags:
  - Research
  - Repository
  - Pure
  - Open Access
  - Publications
  properties:
  - type: Documentation
    url: https://www.hw.ac.uk/research-enterprise/research/research-environment/research-portal
  - type: ResearchRepository
    url: https://researchportal.hw.ac.uk/
- aid: heriot-watt:library-discovery
  name: Heriot-Watt Library Discovery (Ex Libris Primo)
  description: Library discovery and catalog search for Heriot-Watt's Edinburgh, Scottish Borders, Orkney, Dubai and Malaysia
    libraries, running Ex Libris Primo under the institution's view code 44HWA_V1 at discovery.hw.ac.uk. The host sits on
    Ex Libris infrastructure (31.186.254.152) and serves a Primo single-page application; any programmatic access is through
    Ex Libris Alma/Primo APIs on developers.exlibrisgroup.com, which is a generic vendor surface shared by every Ex Libris
    customer and is therefore not recorded under this institution. Recorded here as a tenant relationship only.
  humanURL: https://discovery.hw.ac.uk/primo-explore/search?vid=44HWA_V1
  x-operator: tenant
  x-platform: Ex Libris Primo
  tags:
  - Library
  - Discovery
  - Catalog
  - Primo
  - Ex Libris
  properties:
  - type: LibraryCatalog
    url: https://discovery.hw.ac.uk/primo-explore/search?vid=44HWA_V1
  - type: Documentation
    url: https://www.hw.ac.uk/about/professional-services/information-services/find-resources
- aid: heriot-watt:canvas
  name: Heriot-Watt Canvas (Instructure)
  description: The university's virtual learning environment, an Instructure Canvas tenancy at canvas.hw.ac.uk (CNAME hwu-vanity.instructure.com).
    Canvas ships a documented REST API and LTI 1.3 platform role as product features; at Heriot-Watt the API is present but
    closed — GET /api/v1/accounts returns 401 with an unauthenticated error and requires an institutionally issued OAuth2
    token. The contract, the LTI certification and the API documentation all belong to Instructure, so none of it is saved
    under this institution. Recorded as a tenant relationship.
  humanURL: https://canvas.hw.ac.uk/
  baseURL: https://canvas.hw.ac.uk/api/v1
  x-operator: tenant
  x-platform: Instructure Canvas
  x-vendor-host: hwu-vanity.instructure.com
  tags:
  - Learning Management
  - Canvas
  - LTI
  - Teaching
  properties:
  - type: Documentation
    url: https://canvas.hw.ac.uk/
- aid: heriot-watt:libcal
  name: Heriot-Watt LibCal (Springshare)
  description: Springshare LibCal tenancy for library room bookings, events and opening hours at hw.ac.libcal.com (CNAME region-eu.libcal.com).
    LibCal's REST API exists at this host — the OAuth2 token endpoint /1.1/oauth/token answers 405 to a GET, confirming the
    route is routed and live — but it is gated behind an admin-provisioned OAuth client, so no unauthenticated call succeeds.
    The API contract is Springshare's and is not saved under this institution.
  humanURL: https://hw.ac.libcal.com/
  baseURL: https://hw.ac.libcal.com/1.1/
  x-operator: tenant
  x-platform: Springshare LibCal
  x-vendor-host: region-eu.libcal.com
  tags:
  - Library
  - Bookings
  - Event
  - LibCal
  - Springshare
  tags_raw:
  - Library
  - Bookings
  - Events
  - LibCal
  - Springshare
  properties:
  - type: Documentation
    url: https://hw.ac.libcal.com/
common:
- type: Website
  url: https://www.hw.ac.uk/
- type: About
  url: https://www.hw.ac.uk/about/professional-services/information-services/find-resources
- type: Status
  url: https://www.hwstatus.info/
- type: LinkedIn
  url: https://uk.linkedin.com/school/heriot-watt-university/
- type: Blog
  url: https://www.hw.ac.uk/news/blog
- type: Support
  url: https://www.hw.ac.uk/about/professional-services/information-services/contact-visit-us/contact-us
- type: TermsOfService
  url: https://www.hw.ac.uk/about/our-policies/terms-and-conditions
- type: PrivacyPolicy
  url: https://www.hw.ac.uk/about/professional-services/governance-and-legal-services/information-governance/protect-information/data-protection-overview/privacy-and-your-data-rights
- type: ResearchRepository
  url: https://www.ros.hw.ac.uk/
- type: APIReference
  url: https://www.ros.hw.ac.uk/server/api
- type: IdentityFederation
  url: http://mdq.ukfederation.org.uk/entities/https%3A%2F%2Fshib1.hw.ac.uk%2Fshibboleth
- type: LibraryCatalog
  url: https://discovery.hw.ac.uk/primo-explore/search?vid=44HWA_V1
- type: CourseCatalog
  url: https://www.hw.ac.uk/search/programmes
- type: OpenData
  url: https://www.hw.ac.uk/about/professional-services/governance-and-legal-services/information-governance/access-information/foi/publication-scheme/external-and-government-relations-open-data/8.19-open-data
- type: Conformance
  url: conformance/heriot-watt-conformance.yml
- type: VulnerabilityDisclosure
  url: security/heriot-watt-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/heriot-watt-domain-security.yml
- type: Plans
  url: plans/heriot-watt-plans-pricing.yml
- type: RateLimits
  url: rate-limits/heriot-watt-rate-limits.yml
- type: FinOps
  url: finops/heriot-watt-finops.yml
- type: Review
  url: review.yml
x-coverage:
  state: covered
  reason: covered
  generated: '2026-08-30'
  method: probed
  detail: 'Heriot-Watt operates two genuinely institution-owned, machine-readable, openly callable surfaces, both verified
    by live probe on 2026-08-30: the ROS DSpace 8 repository at www.ros.hw.ac.uk (OAI-PMH 2.0 Identify/ListMetadataFormats/ListSets
    all 200, DSpace REST/HAL root 200, no credentials required) and its SAML 2.0 identity provider registered in the UK Access
    Management Federation (signed per-entity MDQ metadata 200, self-served IdP metadata 200). Beyond those, the footprint
    is rented: researchportal.hw.ac.uk is an Elsevier Pure tenancy by CNAME and its programmatic endpoints are closed (500
    on /ws/oai, 404 on /ws/api), discovery.hw.ac.uk is Ex Libris Primo, canvas.hw.ac.uk is Instructure Canvas with a 401 API,
    hw.ac.libcal.com is Springshare LibCal with an OAuth-gated API. No central developer portal, no llms.txt (404), no open-data
    portal, no course or timetabling API — the programme search is server-rendered HTML with no JSON backend, and timetable.hw.ac.uk,
    though inside Heriot-Watt''s own 137.195.0.0/16 network, serves only a default landing page with every probed path returning
    404. The two GitHub organisations matching the university name (github.com/heriot-watt, github.com/heriot-watt-university)
    both hold zero public repositories and carry no identifying metadata, so neither is recorded. No public generative-AI
    policy or AI-tooling statement appears anywhere in the 6,401-URL sitemap.'
  evidence:
  - url: https://www.ros.hw.ac.uk/server/oai/request?verb=Identify
    status: 200
  - url: https://www.ros.hw.ac.uk/server/api
    status: 200
  - url: https://www.ros.hw.ac.uk/server/api/core/communities
    status: 200
  - url: http://mdq.ukfederation.org.uk/entities/https%3A%2F%2Fshib1.hw.ac.uk%2Fshibboleth
    status: 200
  - url: https://shib1.hw.ac.uk/shibboleth-idp/shibboleth
    status: 200
  - url: http://metadata.ukfederation.org.uk/ukfederation-metadata.xml
    status: 200
  - url: https://api.datacite.org/clients/bl.hwu
    status: 200
  - url: https://api.crossref.org/members/14708
    status: 200
  - url: https://researchportal.hw.ac.uk/ws/oai?verb=Identify
    status: 500
  - url: https://researchportal.hw.ac.uk/ws/api
    status: 404
  - url: https://canvas.hw.ac.uk/api/v1/accounts
    status: 401
  - url: https://hw.ac.libcal.com/1.1/oauth/token
    status: 405
  - url: https://discovery.hw.ac.uk/
    status: 200
  - url: https://www.hw.ac.uk/search/programmes
    status: 200
  - url: https://timetable.hw.ac.uk/api/
    status: 404
  - url: https://www.hw.ac.uk/llms.txt
    status: 404
  - url: https://www.hw.ac.uk/.well-known/security.txt
    status: 200
  - url: https://www.hwstatus.info/
    status: 200
    note: 406 to simple clients; returns 200 with a full browser header set. Bot-challenged, not dead.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com