Regulatory Posture

15% of the composite, when it applies 32 checks · 164 pointsconditional facet regulatory

For providers in a regulated industry ONLY: does the API publish the consent, security, legal, and standards-conformance posture its regime demands? Consent-scoped authorization (OAuth/OIDC scopes), a published security + vulnerability-disclosure posture, terms/privacy as legal basis, and evidence of conformance to the industry's data standard. Not applied to unregulated industries — see the composite math note below.

29,770providers scored on it

27,068score above zero

14.8mean sub-score

11.8median sub-score

0at 100

This facet is conditional. It is computed for every provider so its panel can render, but it enters the composite only where it applies — 29,770 of the 29,770 scored providers in the catalog. The counts on this page are over that population, not the whole catalog, and everyone else is neither measured against it nor penalised for it. The applicability rule and the composite arithmetic are on the rubric page.

How it is scored

32 checks worth 164 points, grouped by the artifact each one reads. A facet's sub-score is its awarded points normalized against the points that were actually applicable to that provider — a check needing an artifact the provider does not publish at all is N/A, and leaves both sides of the fraction.

Regulatory Posture · regulatory

Check	Rule	Points
Consent-scoped authorizationPublished OAuth/OIDC scopes — the machine-readable expression of least-privilege, consented access every data-sharing regime is built on. The single strongest regulatory signal.	`common[].type includes "OAuthScopes" OR a scopes artifact is present`	10
Authentication model documentedA documented authentication/authorization model (OIDC, mTLS, PAR). A regulated API that will not say how it authenticates cannot be trusted to hold the line the regime draws.	`common[].type includes "Authentication" or "OpenIDConnect"`	6
Security posture publishedA published security policy or domain-security posture. Regulated data demands a stated, verifiable security stance, not an assumed one.	`common[].type includes "Security" or "DomainSecurity"`	6
Vulnerability disclosure programA VDP / responsible-disclosure channel. For a regulated provider this is table stakes, and its absence is a conspicuous gap.	`common[].type includes "VulnerabilityDisclosure"`	6
Terms of service (legal basis)Machine-findable terms establishing the legal basis for access — the contract a regulator expects to exist and be discoverable.	`common[].type includes "TermsOfService"`	4
Privacy policy (data handling)A published privacy policy stating how personal/consumer data is handled — the disclosure most regulated regimes require.	`common[].type includes "PrivacyPolicy"`	4
Compliance / certification disclosurePublished compliance, certification, or trust-center content (SOC 2, ISO 27001, PCI, regime attestations) — evidence the provider holds itself to an external standard, not just its own word.	`common[].type includes "Compliance" or "TrustCenter" or "Trust"`	5
Data-standard conformanceEvidence the API conforms to the industry's data standard (a named standard, conformance artifact, or a published vocabulary/JSON-LD context). In a regulated space, speaking the mandated shape is the difference between interoperable and merely present.	`implements a recognized data standard — common[].type includes "Standard"/"Conformance", or a Vocabulary/JSON-LD context is published`	5
Conforms to the standard named for its regimeThe provider conforms to the standard RECOGNIZED FOR ITS REGIME, resolved against the standards catalog: OBIE, the DSB Consumer Data Standards, FDX or Berlin Group for open banking; US Core / USCDI for health; ACORD, CIECA or CSIO for insurance; CAMARA or TM Forum for telecom; Green Button / ESPI or cds-energy for energy.This supersedes the generic check above in strength for a reason the banking quartet made plain: a `Standard` tag credits an intention, while naming the instrument credits a fact. It is also the check the insurance quartet needed to state its emptiest finding honestly — ACORD is live inside a machine-readable contract at exactly one company worldwide.	conformance/ declares conformance to a standard listed under the matched regime`s `standards:` — not merely a generic Standard tag	8
FAPI / hardened authorization profileThe security profile CDR, UK Open Banking and PSD2 actually mandate, beyond generic OAuth: the FAPI profile, pushed authorization requests, private_key_jwt client authentication, mTLS-bound tokens. Generic OAuth is table stakes; this is the stack the regime specifies.	`conformance declares FAPI or FAPI 2.0, or auth artifacts document PAR, private_key_jwt or mTLS-bound tokens`	6
Published consent modelA consent surface a machine can read. This is the structural gap the whole series found and the reason it is weighted where it is: in market after market whose entire premise is consumer consent, machine-readable consent ran in the single digits. A FHIR Consent resource is exposed by essentially nobody; insurance ran at 2.5% in the US and zero among every market's leaders, in the most personally-invasive data business in the economy.Weighted heaviest in insurance and telecom precisely BECAUSE no rule compels it there — where consent is unmandated its presence is a genuine differentiator rather than a compliance artifact.	`a machine-readable consent surface — consent scopes, a FHIR Consent resource, a CDR consent artifact, or a documented consent/authorization model`	7
Action / write surfaceThe regime is actionable, not read-only. An agent that can move money on an account is a different animal from one that can only read it, and the score should say so: the UK — which mandated payment initiation — scored 87% on idempotency, where read-only Australia scored 0%.	`the contract exposes payment initiation, VRP, or another mutating regulated operation`	4
SMART-on-FHIR configuration servedA served `.well-known/smart-configuration` with published SMART-on-FHIR scopes. The structural finding across all four healthcare markets: the security scopes often exist, but the smart-configuration is served almost nowhere — so the check has to weight a DISCOVERABLE, consent-legible surface rather than the mere presence of scopes somewhere in prose.	`a .well-known/smart-configuration is served, or SMART scopes are published`	6
PCI scope and strong customer authenticationPCI-DSS attestation or scope disclosure together with strong customer authentication (3-D Secure, PSD2 SCA). The two disclosures every payments regime is built on, and the ones a merchant's own auditor will ask for first.	`PCI-DSS attestation or scope disclosure, plus 3-D Secure / SCA support`	6
Machine-readable entitlement and redistribution termsEntitlement and redistribution terms in machine-readable form, plus MiFID II or exchange data-licensing disclosure. In market data the licence IS the product boundary, and a consumer who cannot read it programmatically cannot build against it safely.	`redistribution / entitlement / data-licensing terms published as machine-readable data`	6
Third-party certificationA certification issued and published by somebody other than the provider. Canada runs the only public, tiered insurance API certification programme in the world (CSIO) and it was invisible to the score — its own table lists the country's largest P&C insurer as Not Yet Rated while smaller competitors hold higher tiers, which is exactly the published signal a rubric should read.THE CAUTION THIS CHECK CARRIES, learned from real estate: RESO certification is real, independently tested and industry-mandated, and it is worth 2.0 points of measured difference — because all three certified organizations return 401 on the very contract they are certified against. A certification claim is credited here only alongside `servers_resolvable`; a badge for a document the consumer cannot fetch is not conformance.	`a public, independently-issued certification is held and discoverable`	5
CAMARA / network-API conformanceConformance to the network-API standards the sector actually built: CAMARA commonalities, the canonical API definitions, CIBA (the backchannel authentication flow CAMARA specifies for network authorization, found in 3 of 19 standards repositories and absent from both specs of the one exposure platform with a callable endpoint), and TM Forum Open API conformance — held widely by carriers who publish no network API at all.	`an x-camara-commonalities version, /camara/ paths, CIBA support, or TM Forum Open API conformance`	6
Software bill of materialsAn SBOM. The CRA makes it a condition of placing a product on the EU market, and US federal procurement already asks for it. Machine-readable, cheap to publish, and almost absent across the catalog. Asked for by: EU Cyber Resilience Act; EO 14028 procurement. (roadmap#444)	`common[].type includes "SBOM"`	4
Declared support lifetimeA published support or security-update period. UK PSTI made this a condition of sale alongside a vulnerability-disclosure policy — mandated, cheap, machine-readable, and mostly missing, which is what a scored check should be aimed at. Asked for by: UK PSTI; CRA; Australia Cyber Security Act. (roadmap#444)	`common[].type includes "SupportLifetime"`	4
Accessibility conformance reportA conformance report (VPAT/ACR or equivalent). A provider shipping an embedded widget, hosted page or SDK component puts that artifact inside a customer's EAA/AODA compliance boundary; the report is standardised in form and almost never in developer documentation. Asked for by: European Accessibility Act; ADA Title III; AODA; Section 508. (roadmap#444)	`common[].type includes "AccessibilityConformance"`	4
Training-data summaryA public summary of training data. AB 2013 and the AI Act's GPAI duties both ask for one; it applies only where the provider declares an AI surface. Asked for by: California AB 2013; EU AI Act GPAI. (roadmap#444)	`common[].type includes "TrainingDataSummary"`	4
AI interaction disclosureA disclosure that the user is interacting with an AI system. Applies only where the provider declares an AI surface. Asked for by: EU AI Act Art. 50; Utah AI Policy Act. (roadmap#444)	`common[].type includes "AITransparency"`	4
Global Privacy Control honouredA statement that the GPC signal is honoured. Four US states now require a universal opt-out to be respected, and the signal is machine-readable by design. Asked for by: Colorado, California, Connecticut, Texas universal opt-out. (roadmap#444)	`common[].type includes "GlobalPrivacyControl"`	4
Data-subject request routeA documented route for access, deletion and portability requests. Required by GDPR and by twenty US state laws, and a route nobody can find is a route that does not exist. Asked for by: GDPR; UK GDPR; 20 US state privacy laws. (roadmap#444)	`common[].type includes "DataSubjectRequest"`	4
Subprocessor listA current subprocessor list. Art. 28 makes it a contractual duty and DORA and NIS2 both push it down the supply chain; it is the artifact a customer's own auditor asks for first. Asked for by: GDPR Art. 28; DORA; NIS2; DOJ bulk data rule. (roadmap#444)	`common[].type includes "Subprocessors"`	4
Data residency statementA statement of where data is stored and processed. The DOJ bulk-data rule made this a transfer question rather than a preference, and sovereign-cloud procurement asks it directly. Asked for by: DOJ bulk data rule; EU Data Act; sovereign cloud. (roadmap#444)	`common[].type includes "DataResidency"`	4
Incident notification commitmentA published incident-notification commitment with a timeframe. A customer subject to SEC Item 1.05, DORA or NIS2 inherits the obligation and cannot meet it without one from its vendor. Asked for by: SEC Item 1.05 flow-down; DORA; SOCI; NIS2. (roadmap#444)	`common[].type includes "IncidentNotification"`	4
Age assuranceAn age-assurance statement or mechanism. NOT YET GATED: the catalog has no derived consumer-surface signal, so this is scored only within an applicable regime rather than against every provider (see the applicability note beside NA_UNLESS_CHECK in score.rb). Asked for by: UK Online Safety Act; AU Social Media Minimum Age; app store accountability laws. (roadmap#444)	`common[].type includes "AgeAssurance"`	4
Notice-and-action mechanismA notice-and-action route for illegal content. NOT YET GATED, for the same reason as age assurance. Asked for by: EU Digital Services Act. (roadmap#444)	`common[].type includes "NoticeAndAction"`	4
Transparency reportA published transparency report. NOT YET GATED, for the same reason as age assurance. Asked for by: DSA; UK Online Safety Act. (roadmap#444)	`common[].type includes "TransparencyReport"`	4
Exit assistance / switching termsPublished switching and exit-assistance terms. The Data Act made egress and exit a regulated term of cloud contracts rather than a commercial courtesy. Asked for by: EU Data Act cloud switching. (roadmap#444)	`common[].type includes "ExitAssistance"`	4
Mandate implemented, not merely claimedTHE LARGEST UNMEASURED EFFECT IN THE CATALOG, and the reason it lands in 0.6 rather than waiting. Across 95 energy organizations scored on a deliberately ruthless mandate ladder, a VERIFIED mandate was worth about twelve points of composite — live-implemented 42.2 against not-applicable 36.6 — while a CLAIMED-but-unverifiable mandate scored 30.4, BELOW the 30.2 of organizations under no obligation at all.That second number is the finding. Self-declared compliance is not merely uninformative, it is NEGATIVE signal, and any assessment that reads compliance pages instead of calling endpoints will rank the field backwards at the top. Compare RESO in real estate at 2.0 points: same question, two sectors, a six-fold difference in effect, because one mandate came with a public register and conformant discovery endpoints and the other came with a badge.The failure mode is already live here: two Ontario utilities present as Green Button compliant and cannot be verified, one because its onboarding host returns HTTP 200 for every path including invented ones, being a single-page-app catch-all. Without a verification state that provider scores as compliant.	`the mandated surface is evidenced by a resolvable endpoint, register entry or conformant discovery document — not by a compliance page`	8

How the catalog distributes on it

Every one of the 29,770 providers this facet is scored on, bucketed by sub-score.

90-1000 · 0.0%

75-89.90 · 0.0%

50-74.962 · 0.2%

25-49.95,373 · 18.0%

0.1-24.921,633 · 72.7%

02,702 · 9.1%

Top providers

The top 500 of 27,068 providers scoring above zero on this facet, ranked by facet sub-score, ties broken by composite.

1 Infobip72.5 84.9exemplar 2 Twilio70.8 89.3exemplar 3 GatiFlow69.1 75.1exemplar 4 Whisper Security63.7 59.3strong 5 ModMed62.5 51.9developing 6 Reliance Jio60.0 50.5developing 7 GitDealFlow59.8 68.6exemplar 8 Triodos Bank UK59.1 41.2developing 9 Medplum57.8 79.1exemplar 10 Elation Health57.8 78.0exemplar 11 Plaid57.5 80.2exemplar 12 Co-Legal57.3 42.3developing 13 Airwallex57.1 85.3exemplar 14 Nylas56.9 93.9exemplar 15 drchrono56.3 76.8exemplar 16 FeedOracle Technologies55.9 70.0exemplar 17 Relm55.9 65.0strong 18 Citi55.9 58.0strong 19 Barclays55.9 57.2strong 20 Vinkius55.9 48.7developing 21 RenooLab55.9 46.3developing 22 ForceDream55.4 74.5exemplar 23 Citizens Financial Group55.1 62.1strong 24 Up55.1 50.5developing 25 Algbra55.1 50.4developing 26 Agoragentic54.9 80.3exemplar 27 Memo Bank54.3 61.6strong 28 Slash54.3 61.0strong 29 Newcastle Permanent Building Society54.3 39.2thin 30 CMS Energy54.1 56.9strong 31 Tebra53.9 58.9strong 32 Stripe53.6 82.1exemplar 33 Mollie53.6 59.6strong 34 Flywire53.6 55.0strong 35 CrowdStrike52.9 67.1exemplar 36 ADP52.9 45.3developing 37 Fourth52.9 37.4thin 38 Sparrow52.9 27.4thin 39 Moneyhub52.8 57.1strong 40 St.George Bank52.8 50.3developing 41 Deutsche Bank52.8 49.7developing 42 BCU Bank52.8 38.8thin 43 Iniciador52.8 33.0thin 44 eClinicalWorks52.3 69.7exemplar 45 Health Gorilla52.3 63.3strong 46 Trisotech52.3 58.4strong 47 Optum52.3 56.9strong 48 Emboss52.0 66.5exemplar 49 Virix Labs52.0 65.7strong 50 athenahealth51.6 69.6exemplar 51 NextGen Healthcare51.6 67.2exemplar 52 Canvas Medical51.6 62.5strong 53 Commure51.6 47.1developing 54 Oracle Health (Cerner)51.6 46.0developing 55 Buoy Health51.6 45.4developing 56 Athelas51.5 47.4developing 57 Danske Bank (UK)51.2 42.4developing 58 Canopy Connect50.9 68.0exemplar 59 CME Group50.9 42.0developing 60 BB&T Corp (Truist)50.4 55.0strong 61 MandateShield50.0 75.2exemplar 62 Pacific Gas and Electric50.0 55.5strong 63 Cumbuca49.6 27.6thin 64 Innovaccer49.3 30.4thin 65 Zoom Phone49.2 67.9exemplar 66 Verizon49.2 58.3strong 67 ETSI49.2 50.7developing 68 Telia Company49.2 46.8developing 69 Bharti Airtel49.2 45.4developing 70 Visier49.1 65.0strong 71 TaskHawk Systems49.0 69.9exemplar 72 Klarna48.8 71.8exemplar 73 Allica Bank48.8 50.6developing 74 first direct48.8 49.0developing 75 Virgin Money UK48.8 45.3developing 76 Australia and New Zealand Banking Group (ANZ)48.8 39.5developing 77 TSB Bank48.8 36.7thin 78 Recognise Bank48.8 35.4thin 79 Epic Systems48.4 62.5strong 80 AdvancedMD48.4 51.6developing 81 Elevance Health48.4 45.8developing 82 Leadping48.3 75.4exemplar 83 Braze48.3 75.1exemplar 84 SAP Emarsys48.3 66.5exemplar 85 GSMA48.3 54.4strong 86 Lightspeed Commerce48.2 79.3exemplar 87 AlgoVoi48.2 67.7exemplar 88 Fodda (PSFK)48.2 67.6exemplar 89 Unit48.2 65.0strong 90 GoFundMe48.2 64.7strong 91 Gr4vy48.2 62.4strong 92 Ziina48.2 60.0strong 93 Astrada48.2 54.7strong 94 Coinflow48.2 53.5developing 95 Mesh Payments48.2 47.3developing 96 Upstox48.1 74.9exemplar 97 Uphold48.1 71.1exemplar 98 Gemini Trust Company48.1 67.5exemplar 99 cogDepot48.0 66.4strong 100 The Colony48.0 64.8strong 101 Lili48.0 60.8strong 102 FIS Global48.0 58.6strong 103 Delft University of Technology48.0 57.3strong 104 LVL LTD CO48.0 56.8strong 105 University of Warwick48.0 52.6developing 106 University of Twente48.0 50.7developing 107 Bank First48.0 42.2developing 108 C. Hoare & Co.48.0 41.6developing 109 IMB Bank48.0 40.0developing 110 Qudos Bank48.0 39.7developing 111 Commonwealth Bank48.0 39.3developing 112 Bank of Queensland48.0 39.3developing 113 Coventry Building Society48.0 38.2thin 114 Hampden & Co48.0 38.1thin 115 Monument Bank48.0 36.5thin 116 Australian Military Bank48.0 33.6thin 117 1upHealth47.7 71.7exemplar 118 Flexpa47.7 67.8exemplar 119 Jefferson Health47.7 64.9strong 120 Independence Blue Cross47.7 62.5strong 121 Jane47.7 58.2strong 122 Redox47.7 57.7strong 123 Temple Health47.7 56.0strong 124 Photon47.7 52.7developing 125 MEDITECH47.7 43.6developing 126 TailorMed47.7 41.8developing 127 Cohere Health47.7 29.5thin 128 zopa47.6 35.1thin 129 EDF Energy47.5 62.7strong 130 TypeSafe AI47.3 52.1developing 131 Cymetica47.2 63.6strong 132 MolTrust47.1 63.8strong 133 KPN47.1 62.5strong 134 Global Database47.1 54.5strong 135 Accela47.1 51.1developing 136 Yello47.1 32.7thin 137 Swisscom46.9 59.1strong 138 Stedi46.5 78.8exemplar 139 Qonto46.5 68.1exemplar 140 Guidewire46.5 65.2strong 141 Levitate46.5 57.1strong 142 Agicap46.5 50.2developing 143 Sygnum46.5 49.8developing 144 hi.health46.5 48.7developing 145 SavvyMoney46.5 37.9thin 146 PSC Insurance46.5 32.6thin 147 Artificial Labs46.5 28.6thin 148 SCVD General Store46.4 72.1exemplar 149 Zai46.4 56.4strong 150 Autopay46.4 52.1developing 151 Kraken46.3 68.0exemplar 152 aicomglobal46.1 62.1strong 153 Dant346.1 61.2strong 154 Minds46.1 58.4strong 155 Practice Fusion46.1 57.4strong 156 Datavant46.1 57.0strong 157 b.well46.1 52.2developing 158 Moxe Health46.1 43.5developing 159 Suncorp Bank46.1 40.1developing 160 Anlora46.1 36.8thin 161 HotDoc46.1 36.1thin 162 Express Scripts Holding46.1 28.9thin 163 Enphase Energy45.9 64.3strong 164 Electricity North West45.9 59.3strong 165 Northern Powergrid45.9 55.3strong 166 Hydro-Québec45.9 52.3developing 167 The Co-operative Bank45.7 42.7developing 168 BankSA45.7 42.0developing 169 8x845.4 70.8exemplar 170 Doximity45.3 50.5developing 171 Centene45.3 41.5developing 172 Confluent45.1 93.4exemplar 173 Harness45.1 93.0exemplar 174 HubSpot45.1 91.6exemplar 175 Tray.ai45.1 89.3exemplar 176 Xquik45.1 88.7exemplar 177 Kinde45.1 88.5exemplar 178 ZoomInfo45.1 87.8exemplar 179 Algolia45.1 86.6exemplar 180 Dynatrace45.1 86.3exemplar 181 MongoDB45.1 86.2exemplar 182 Snyk45.1 86.0exemplar 183 Eventwren45.1 85.8exemplar 184 Hagglebee45.1 85.1exemplar 185 Yarnhen45.1 85.1exemplar 186 Yawplet45.1 85.1exemplar 187 Acronis45.1 84.4exemplar 188 AhaSend45.1 84.3exemplar 189 Appwrite45.1 83.6exemplar 190 Microsoft Entra ID (formerly Azure AD)45.1 83.3exemplar 191 WSO245.1 83.1exemplar 192 Losant45.1 83.1exemplar 193 SendGrid45.1 82.9exemplar 194 GitHub Actions45.1 82.8exemplar 195 Datadog APM45.1 81.9exemplar 196 Canonical45.1 81.8exemplar 197 GitLab45.1 81.8exemplar 198 Optimizely45.1 81.3exemplar 199 LaunchDarkly45.1 80.8exemplar 200 OpenMercantil45.1 80.6exemplar 201 Sentry45.1 80.5exemplar 202 Datadog45.1 79.8exemplar 203 Zoho CRM45.1 78.6exemplar 204 Cvent45.1 78.6exemplar 205 Flagsmith45.1 78.5exemplar 206 RudderStack45.1 78.5exemplar 207 Bugsnag45.1 78.4exemplar 208 Confluent | the Data Streaming Platform45.1 78.3exemplar 209 Outreach45.1 76.9exemplar 210 Acquia45.1 76.8exemplar 211 Microsoft Azure45.1 76.7exemplar 212 LinkedIn45.1 76.3exemplar 213 Automation Anywhere45.1 76.1exemplar 214 Okta45.1 76.1exemplar 215 Surfe45.1 75.6exemplar 216 ThousandEyes45.1 75.5exemplar 217 Adobe Launch45.1 75.4exemplar 218 Microsoft Azure Cache For Redis45.1 75.1exemplar 219 Oracle Hospitality45.1 74.0exemplar 220 CloudBees45.1 74.0exemplar 221 Checkly45.1 74.0exemplar 222 Remote45.1 73.7exemplar 223 Microsoft Azure API Management45.1 73.6exemplar 224 ClickHouse45.1 73.5exemplar 225 Prisma45.1 73.2exemplar 226 Lusha45.1 73.2exemplar 227 lemlist45.1 73.2exemplar 228 Meltwater45.1 73.2exemplar 229 Microsoft Azure Cdn45.1 72.8exemplar 230 Zendesk45.1 72.7exemplar 231 Microsoft45.1 72.7exemplar 232 Clickup45.1 72.4exemplar 233 Sigma Computing45.1 72.4exemplar 234 Netlify45.1 72.4exemplar 235 Azure Data Factory45.1 72.0exemplar 236 Impact45.1 71.9exemplar 237 Salesforce Service Cloud APIs45.1 71.9exemplar 238 Archbee45.1 70.9exemplar 239 Taboola45.1 70.9exemplar 240 Canva45.1 70.9exemplar 241 Vendasta45.1 70.8exemplar 242 Vaquill AI45.1 70.8exemplar 243 Drata45.1 70.7exemplar 244 Microsoft Dynamics 365 Sales45.1 70.7exemplar 245 Matomo45.1 70.5exemplar 246 Bitly45.1 70.4exemplar 247 Esri45.1 70.4exemplar 248 Oracle Siebel45.1 70.4exemplar 249 Canvas45.1 70.3exemplar 250 Adobe Workfront45.1 70.3exemplar 251 Cracked API45.1 70.3exemplar 252 Airbyte45.1 70.3exemplar 253 Asana45.1 70.2exemplar 254 UserGems45.1 70.1exemplar 255 Cohesity45.1 70.0exemplar 256 Leadspace45.1 70.0exemplar 257 Cogny45.1 69.7exemplar 258 Agorapulse45.1 69.5exemplar 259 Laravel45.1 69.5exemplar 260 G245.1 69.1exemplar 261 Adobe Analytics45.1 69.0exemplar 262 Azure Cost Management45.1 69.0exemplar 263 BlueConic45.1 68.9exemplar 264 Conga45.1 68.5exemplar 265 Tricentis45.1 68.5exemplar 266 Better Stack45.1 68.5exemplar 267 Unbounce45.1 68.5exemplar 268 Slack45.1 68.4exemplar 269 Strivacity45.1 68.4exemplar 270 Lucid45.1 68.4exemplar 271 Rybbit45.1 68.2exemplar 272 Microsoft Azure Quantum45.1 68.1exemplar 273 Khoros45.1 67.7exemplar 274 TranscriptFetch45.1 67.6exemplar 275 Google Cloud Logging45.1 67.4exemplar 276 Pluralsight45.1 67.3exemplar 277 Common Room45.1 67.2exemplar 278 Encharge45.1 67.2exemplar 279 Snapchat45.1 67.2exemplar 280 GoToWebinar45.1 67.1exemplar 281 Buffer45.1 67.0exemplar 282 Red Hat Ansible Automation Platform45.1 66.5exemplar 283 Seismic45.1 66.4strong 284 Semrush45.1 66.4strong 285 Dun & Bradstreet45.1 66.4strong 286 Simon Data45.1 66.3strong 287 Calico45.1 66.3strong 288 Statable Stats API45.1 66.3strong 289 Cisco XDR45.1 66.1strong 290 Grafana Loki45.1 66.1strong 291 Chili Piper45.1 66.0strong 292 Microsoft Outlook45.1 66.0strong 293 StackAdapt45.1 65.8strong 294 Infer by Flow745.1 65.7strong 295 Kiteworks45.1 65.4strong 296 Improvado45.1 65.4strong 297 Buf45.1 65.3strong 298 JuriSign45.1 65.3strong 299 Tradeshift45.1 65.2strong 300 Acceldata45.1 65.0strong 301 Embrace45.1 65.0strong 302 Octopus Deploy45.1 64.8strong 303 Visma45.1 64.7strong 304 Newscred45.1 64.7strong 305 Microsoft Azure Private Link45.1 64.3strong 306 1Lookup45.1 64.2strong 307 Hootsuite45.1 63.8strong 308 Cisco Catalyst SD-WAN45.1 63.7strong 309 Microsoft Azure Batch45.1 63.7strong 310 Cvent Social Tables45.1 63.5strong 311 Google Cloud Platform45.1 63.4strong 312 Microsoft Word45.1 63.2strong 313 Dash045.1 63.1strong 314 Truora45.1 63.1strong 315 Google AdMob45.1 63.0strong 316 Microsoft SQL Server45.1 62.7strong 317 Eliq45.1 62.7strong 318 Crossbeam45.1 62.7strong 319 Cisco Umbrella45.1 62.6strong 320 RocketReach45.1 62.6strong 321 Google Vault45.1 62.6strong 322 Knak45.1 62.4strong 323 Navattic45.1 62.3strong 324 FullEnrich45.1 62.2strong 325 Syft Data45.1 62.0strong 326 Mention45.1 61.9strong 327 Microsoft Office 36545.1 61.9strong 328 Optoro45.1 61.8strong 329 LeanData45.1 61.7strong 330 HookLogic (Criteo)45.1 61.6strong 331 Social Fetch45.1 61.2strong 332 Shortcut Software45.1 61.1strong 333 Bynder45.1 61.0strong 334 Figma45.1 61.0strong 335 Entergram45.1 61.0strong 336 University of Waterloo45.1 60.9strong 337 Zype45.1 60.8strong 338 Criteo45.1 60.7strong 339 Webflow45.1 60.6strong 340 LiveRamp45.1 60.6strong 341 JFrog Container Registry45.1 60.6strong 342 Upsun45.1 60.6strong 343 Rose Rocket45.1 60.5strong 344 Zendesk Sell45.1 60.5strong 345 Autodesk45.1 60.4strong 346 Smart Pension45.1 60.3strong 347 Contensis45.1 60.3strong 348 Cisco Intersight45.1 60.2strong 349 Skai (Kenshoo)45.1 60.2strong 350 Youtube45.1 59.8strong 351 NextRoll45.1 59.7strong 352 Malwarebytes45.1 59.6strong 353 Dropbox Sign (HelloSign)45.1 59.6strong 354 CybelAngel45.1 59.4strong 355 Deployxa45.1 59.4strong 356 Salesforce Marketing Cloud Account Engagement (Pardot)45.1 59.1strong 357 Salsify45.1 59.0strong 358 Warmly45.1 58.8strong 359 GoHarbor45.1 58.5strong 360 Platform.sh45.1 58.4strong 361 Sendoso45.1 58.0strong 362 Cisco PSIRT openVuln API45.1 57.8strong 363 Ping Identity45.1 57.8strong 364 Unico45.1 57.7strong 365 Dreamdata45.1 57.2strong 366 Supermetrics45.1 57.2strong 367 Experian45.1 57.0strong 368 Leadpages45.1 56.9strong 369 Microsoft Teams45.1 56.4strong 370 Forsta45.1 56.3strong 371 Snap45.1 56.3strong 372 Webflow API and Documentation45.1 56.0strong 373 Tigera45.1 55.9strong 374 The Trade Desk45.1 55.6strong 375 Harmonic.ai45.1 55.0strong 376 Microsoft Office45.1 54.9strong 377 LVT45.1 54.7strong 378 WakaTime45.1 54.5strong 379 Usersnap45.1 54.5strong 380 Automattic45.1 54.4strong 381 Brandwatch45.1 54.2developing 382 Huntress45.1 54.1developing 383 Coupa45.1 54.0developing 384 Elium45.1 53.9developing 385 Adverity45.1 53.7developing 386 PEXA45.1 53.5developing 387 RELEX Solutions45.1 53.3developing 388 Assignar45.1 53.0developing 389 Google Sites45.1 52.8developing 390 involve.me45.1 52.8developing 391 Workday Benefits45.1 52.6developing 392 Qwilr45.1 52.6developing 393 Precisely APIs45.1 52.4developing 394 Jebbit45.1 52.3developing 395 Blue Prism45.1 52.2developing 396 AdRoll45.1 52.1developing 397 Microsoft Excel45.1 52.0developing 398 Jam45.1 52.0developing 399 Enigma Analytics45.1 51.9developing 400 Microsoft SharePoint45.1 51.5developing 401 UserTesting45.1 51.4developing 402 Clozd45.1 51.1developing 403 Habu45.1 50.7developing 404 Choreo45.1 50.3developing 405 Parabol45.1 50.1developing 406 Linktree45.1 50.0developing 407 NinjaOne45.1 49.9developing 408 ClearSlide45.1 49.8developing 409 Horizon3.ai45.1 49.7developing 410 Amber Electric45.1 49.4developing 411 Plotly45.1 49.0developing 412 DocSend45.1 48.5developing 413 May Mobility45.1 48.1developing 414 AutoCAD45.1 47.8developing 415 Google Android45.1 47.8developing 416 Equifax45.1 47.3developing 417 Codesignal45.1 47.0developing 418 Enboarder45.1 46.8developing 419 Happyrobot45.1 46.6developing 420 Nexthink45.1 46.5developing 421 Virtual Peaker45.1 46.4developing 422 Trestle45.1 45.9developing 423 Demandware45.1 45.8developing 424 Grin45.1 45.0developing 425 Red Hat Enterprise Linux45.1 44.7developing 426 Stagwell45.1 43.2developing 427 Cequence Security45.1 42.7developing 428 OnPay45.1 42.2developing 429 Balbix45.1 39.8developing 430 ZenHR45.1 39.8developing 431 NIFT45.1 39.4developing 432 Wyze45.1 39.1thin 433 Cyera45.1 39.1thin 434 Retail Zipline45.1 37.6thin 435 Articulate45.1 35.1thin 436 Nucleus Security45.1 35.0thin 437 Spate45.1 35.0thin 438 Klue45.1 34.6thin 439 LIQID Investments45.1 34.5thin 440 SkyKick45.1 34.3thin 441 Exabeam45.1 34.2thin 442 Connect The Dots45.1 33.2thin 443 RainFocus45.1 32.6thin 444 Wellfound45.1 32.3thin 445 Deepwatch45.1 30.2thin 446 Flockjay45.1 29.3thin 447 Cleveland-Cliffs45.1 29.1thin 448 DoubleVerify45.1 29.0thin 449 Actively45.1 28.4thin 450 NoRedInk45.1 26.9thin 451 TELUS45.0 50.4developing 452 Aduna45.0 32.3thin 453 Nopan44.9 44.8developing 454 Bank of Ireland (UK)44.9 37.1thin 455 Gateway Bank44.9 34.4thin 456 Ambience Healthcare44.9 30.5thin 457 Factiva44.8 54.2developing 458 PAY.JP44.6 70.8exemplar 459 PayMongo44.6 65.2strong 460 Bolt Financial44.6 65.0strong 461 PayTabs44.6 64.9strong 462 Peach Payments44.6 64.4strong 463 Finix44.6 61.9strong 464 ProcessOut44.6 50.8developing 465 Payrails44.6 48.7developing 466 GetPaid44.6 47.3developing 467 Solaris44.6 45.5developing 468 Aidbox44.5 57.7strong 469 Aetna44.5 46.2developing 470 Curana Health44.5 33.2thin 471 Dow Jones44.4 63.2strong 472 Customer.io44.2 84.3exemplar 473 Brevo44.2 81.7exemplar 474 AfterShip44.2 78.6exemplar 475 Kit44.2 78.5exemplar 476 Salesforce Marketing Cloud44.2 77.3exemplar 477 Close44.2 75.8exemplar 478 Listrak44.2 74.3exemplar 479 Klaviyo44.2 73.6exemplar 480 Adobe Campaign44.2 72.0exemplar 481 Attentive44.2 72.0exemplar 482 SendPulse44.2 70.0exemplar 483 MoEngage44.2 69.0exemplar 484 AWeber44.2 67.7exemplar 485 Campaign Monitor44.2 66.1strong 486 Zoho Campaigns44.2 65.0strong 487 Aeris44.2 62.0strong 488 Bluecore44.2 48.8developing 489 Live Direct Marketing44.1 68.6exemplar 490 Trulioo44.1 57.7strong 491 SMKlog44.1 54.7strong 492 University of Helsinki44.1 49.4developing 493 Yorkshire Building Society44.1 44.7developing 494 LendKey44.1 44.5developing 495 BMO44.1 42.1developing 496 Regional Australia Bank44.1 40.2developing 497 HSBC Bank Australia44.1 38.7thin 498 Vanquis Banking Group44.1 38.2thin 499 Mettle44.1 37.5thin 500 Cashplus Bank44.1 37.1thin

Move this number. Every provider in the catalog is profiled from a public repository at github.com/api-evangelist/<provider>, and each check above names the exact artifact it reads. Publish the artifact, open a pull request, and the next scoring run picks it up — no gatekeeping and no fee. The full rubric is at apis.io/rating/, and the Influence plan is the fast lane if you would rather work your own listing through the API — remediation, projections and re-check requests.

Scored on rubric v0.23.0 across 29,770 providers · lists rebuilt 2026-10-09 · capped at the top 500 per page.

Regulatory Posture

How it is scored

How the catalog distributes on it

Top providers

The other 8 facets