Regulatory Posture

15% of the composite, when it applies 33 checks · 168 pointsconditional facet regulatory

For providers in a regulated industry ONLY: does the API publish the consent, security, legal, and standards-conformance posture its regime demands? Consent-scoped authorization (OAuth/OIDC scopes), a published security + vulnerability-disclosure posture, terms/privacy as legal basis, and evidence of conformance to the industry's data standard. Not applied to unregulated industries — see the composite math note below.

32,443providers scored on it

29,687score above zero

14.8mean sub-score

11.8median sub-score

0at 100

This facet is conditional. It is computed for every provider so its panel can render, but it enters the composite only where it applies — 32,443 of the 32,443 scored providers in the catalog. The counts on this page are over that population, not the whole catalog, and everyone else is neither measured against it nor penalised for it. The applicability rule and the composite arithmetic are on the rubric page.

How it is scored

33 checks worth 168 points, grouped by the artifact each one reads. A facet's sub-score is its awarded points normalized against the points that were actually applicable to that provider — a check needing an artifact the provider does not publish at all is N/A, and leaves both sides of the fraction.

Regulatory Posture · regulatory

Check	Rule	Points
Consent-scoped authorizationPublished OAuth/OIDC scopes — the machine-readable expression of least-privilege, consented access every data-sharing regime is built on. The single strongest regulatory signal.	`common[].type includes "OAuthScopes" OR a scopes artifact is present`	10
Authentication model documentedA documented authentication/authorization model (OIDC, mTLS, PAR). A regulated API that will not say how it authenticates cannot be trusted to hold the line the regime draws.	`common[].type includes "Authentication" or "OpenIDConnect"`	6
Security posture publishedA published security policy or domain-security posture. Regulated data demands a stated, verifiable security stance, not an assumed one.	`common[].type includes "Security" or "DomainSecurity"`	6
Vulnerability disclosure programA VDP / responsible-disclosure channel. For a regulated provider this is table stakes, and its absence is a conspicuous gap.	`common[].type includes "VulnerabilityDisclosure"`	6
Terms of service (legal basis)Machine-findable terms establishing the legal basis for access — the contract a regulator expects to exist and be discoverable.	`common[].type includes "TermsOfService"`	4
Privacy policy (data handling)A published privacy policy stating how personal/consumer data is handled — the disclosure most regulated regimes require.	`common[].type includes "PrivacyPolicy"`	4
Compliance / certification disclosurePublished compliance, certification, or trust-center content (SOC 2, ISO 27001, PCI, regime attestations) — evidence the provider holds itself to an external standard, not just its own word.	`common[].type includes "Compliance" or "TrustCenter" or "Trust"`	5
Data-standard conformanceEvidence the API conforms to the industry's data standard (a named standard, conformance artifact, or a published vocabulary/JSON-LD context). In a regulated space, speaking the mandated shape is the difference between interoperable and merely present.	`implements a recognized data standard — common[].type includes "Standard"/"Conformance", or a Vocabulary/JSON-LD context is published`	5
Conforms to the standard named for its regimeThe provider conforms to the standard RECOGNIZED FOR ITS REGIME, resolved against the standards catalog: OBIE, the DSB Consumer Data Standards, FDX or Berlin Group for open banking; US Core / USCDI for health; ACORD, CIECA or CSIO for insurance; CAMARA or TM Forum for telecom; Green Button / ESPI or cds-energy for energy.This supersedes the generic check above in strength for a reason the banking quartet made plain: a `Standard` tag credits an intention, while naming the instrument credits a fact. It is also the check the insurance quartet needed to state its emptiest finding honestly — ACORD is live inside a machine-readable contract at exactly one company worldwide.	conformance/ declares conformance to a standard listed under the matched regime`s `standards:` — not merely a generic Standard tag	8
FAPI / hardened authorization profileThe security profile CDR, UK Open Banking and PSD2 actually mandate, beyond generic OAuth: the FAPI profile, pushed authorization requests, private_key_jwt client authentication, mTLS-bound tokens. Generic OAuth is table stakes; this is the stack the regime specifies.	`conformance declares FAPI or FAPI 2.0, or auth artifacts document PAR, private_key_jwt or mTLS-bound tokens`	6
Published consent modelA consent surface a machine can read. This is the structural gap the whole series found and the reason it is weighted where it is: in market after market whose entire premise is consumer consent, machine-readable consent ran in the single digits. A FHIR Consent resource is exposed by essentially nobody; insurance ran at 2.5% in the US and zero among every market's leaders, in the most personally-invasive data business in the economy.Weighted heaviest in insurance and telecom precisely BECAUSE no rule compels it there — where consent is unmandated its presence is a genuine differentiator rather than a compliance artifact.	`a machine-readable consent surface — consent scopes, a FHIR Consent resource, a CDR consent artifact, or a documented consent/authorization model`	7
Action / write surfaceThe regime is actionable, not read-only. An agent that can move money on an account is a different animal from one that can only read it, and the score should say so: the UK — which mandated payment initiation — scored 87% on idempotency, where read-only Australia scored 0%.	`the contract exposes payment initiation, VRP, or another mutating regulated operation`	4
SMART-on-FHIR configuration servedA served `.well-known/smart-configuration` with published SMART-on-FHIR scopes. The structural finding across all four healthcare markets: the security scopes often exist, but the smart-configuration is served almost nowhere — so the check has to weight a DISCOVERABLE, consent-legible surface rather than the mere presence of scopes somewhere in prose.	`a .well-known/smart-configuration is served, or SMART scopes are published`	6
PCI scope and strong customer authenticationPCI-DSS attestation or scope disclosure together with strong customer authentication (3-D Secure, PSD2 SCA). The two disclosures every payments regime is built on, and the ones a merchant's own auditor will ask for first.	`PCI-DSS attestation or scope disclosure, plus 3-D Secure / SCA support`	6
Machine-readable entitlement and redistribution termsEntitlement and redistribution terms in machine-readable form, plus MiFID II or exchange data-licensing disclosure. In market data the licence IS the product boundary, and a consumer who cannot read it programmatically cannot build against it safely.	`redistribution / entitlement / data-licensing terms published as machine-readable data`	6
Third-party certificationA certification issued and published by somebody other than the provider. Canada runs the only public, tiered insurance API certification programme in the world (CSIO) and it was invisible to the score — its own table lists the country's largest P&C insurer as Not Yet Rated while smaller competitors hold higher tiers, which is exactly the published signal a rubric should read.THE CAUTION THIS CHECK CARRIES, learned from real estate: RESO certification is real, independently tested and industry-mandated, and it is worth 2.0 points of measured difference — because all three certified organizations return 401 on the very contract they are certified against. A certification claim is credited here only alongside `servers_resolvable`; a badge for a document the consumer cannot fetch is not conformance.	`a public, independently-issued certification is held and discoverable`	5
CAMARA / network-API conformanceConformance to the network-API standards the sector actually built: CAMARA commonalities, the canonical API definitions, CIBA (the backchannel authentication flow CAMARA specifies for network authorization, found in 3 of 19 standards repositories and absent from both specs of the one exposure platform with a callable endpoint), and TM Forum Open API conformance — held widely by carriers who publish no network API at all.	`an x-camara-commonalities version, /camara/ paths, CIBA support, or TM Forum Open API conformance`	6
Software bill of materialsAn SBOM. The CRA makes it a condition of placing a product on the EU market, and US federal procurement already asks for it. Machine-readable, cheap to publish, and almost absent across the catalog. Asked for by: EU Cyber Resilience Act; EO 14028 procurement. (roadmap#444)	`common[].type includes "SBOM"`	4
Declared support lifetimeA published support or security-update period. UK PSTI made this a condition of sale alongside a vulnerability-disclosure policy — mandated, cheap, machine-readable, and mostly missing, which is what a scored check should be aimed at. Asked for by: UK PSTI; CRA; Australia Cyber Security Act. (roadmap#444)	`common[].type includes "SupportLifetime"`	4
Accessibility conformance reportA conformance report (VPAT/ACR or equivalent). A provider shipping an embedded widget, hosted page or SDK component puts that artifact inside a customer's EAA/AODA compliance boundary; the report is standardised in form and almost never in developer documentation. Asked for by: European Accessibility Act; ADA Title III; AODA; Section 508. (roadmap#444)	`common[].type includes "AccessibilityConformance"`	4
Training-data summaryA public summary of training data. AB 2013 and the AI Act's GPAI duties both ask for one; it applies only where the provider declares an AI surface. Asked for by: California AB 2013; EU AI Act GPAI. (roadmap#444)	`common[].type includes "TrainingDataSummary"`	4
AI interaction disclosureA disclosure that the user is interacting with an AI system. Applies only where the provider declares an AI surface. Asked for by: EU AI Act Art. 50; Utah AI Policy Act. (roadmap#444)	`common[].type includes "AITransparency"`	4
Biometric retention and destruction policyA public, written policy giving the retention schedule and destruction guidelines for biometric identifiers, and how consent is obtained before capture. Applies only where the provider declares a biometric surface (`applies_when_tags`), in whatever regime it sits: the obligation follows the data, not the sector. Asked for by: BIPA 740 ILCS 14/15(a)-(b); Texas CUBI s.503.001(c); RCW 19.375.020; GDPR Art. 9. (roadmap#797)	`common[].type includes "BiometricDataPolicy"`	4
Global Privacy Control honouredA statement that the GPC signal is honoured. Four US states now require a universal opt-out to be respected, and the signal is machine-readable by design. Asked for by: Colorado, California, Connecticut, Texas universal opt-out. (roadmap#444)	`common[].type includes "GlobalPrivacyControl"`	4
Data-subject request routeA documented route for access, deletion and portability requests. Required by GDPR and by twenty US state laws, and a route nobody can find is a route that does not exist. Asked for by: GDPR; UK GDPR; 20 US state privacy laws. (roadmap#444)	`common[].type includes "DataSubjectRequest"`	4
Subprocessor listA current subprocessor list. Art. 28 makes it a contractual duty and DORA and NIS2 both push it down the supply chain; it is the artifact a customer's own auditor asks for first. Asked for by: GDPR Art. 28; DORA; NIS2; DOJ bulk data rule. (roadmap#444)	`common[].type includes "Subprocessors"`	4
Data residency statementA statement of where data is stored and processed. The DOJ bulk-data rule made this a transfer question rather than a preference, and sovereign-cloud procurement asks it directly. Asked for by: DOJ bulk data rule; EU Data Act; sovereign cloud. (roadmap#444)	`common[].type includes "DataResidency"`	4
Incident notification commitmentA published incident-notification commitment with a timeframe. A customer subject to SEC Item 1.05, DORA or NIS2 inherits the obligation and cannot meet it without one from its vendor. Asked for by: SEC Item 1.05 flow-down; DORA; SOCI; NIS2. (roadmap#444)	`common[].type includes "IncidentNotification"`	4
Age assuranceAn age-assurance statement or mechanism. NOT YET GATED: the catalog has no derived consumer-surface signal, so this is scored only within an applicable regime rather than against every provider (see the applicability note beside NA_UNLESS_CHECK in score.rb). Asked for by: UK Online Safety Act; AU Social Media Minimum Age; app store accountability laws. (roadmap#444)	`common[].type includes "AgeAssurance"`	4
Notice-and-action mechanismA notice-and-action route for illegal content. NOT YET GATED, for the same reason as age assurance. Asked for by: EU Digital Services Act. (roadmap#444)	`common[].type includes "NoticeAndAction"`	4
Transparency reportA published transparency report. NOT YET GATED, for the same reason as age assurance. Asked for by: DSA; UK Online Safety Act. (roadmap#444)	`common[].type includes "TransparencyReport"`	4
Exit assistance / switching termsPublished switching and exit-assistance terms. The Data Act made egress and exit a regulated term of cloud contracts rather than a commercial courtesy. Asked for by: EU Data Act cloud switching. (roadmap#444)	`common[].type includes "ExitAssistance"`	4
Mandate implemented, not merely claimedTHE LARGEST UNMEASURED EFFECT IN THE CATALOG, and the reason it lands in 0.6 rather than waiting. Across 95 energy organizations scored on a deliberately ruthless mandate ladder, a VERIFIED mandate was worth about twelve points of composite — live-implemented 42.2 against not-applicable 36.6 — while a CLAIMED-but-unverifiable mandate scored 30.4, BELOW the 30.2 of organizations under no obligation at all.That second number is the finding. Self-declared compliance is not merely uninformative, it is NEGATIVE signal, and any assessment that reads compliance pages instead of calling endpoints will rank the field backwards at the top. Compare RESO in real estate at 2.0 points: same question, two sectors, a six-fold difference in effect, because one mandate came with a public register and conformant discovery endpoints and the other came with a badge.The failure mode is already live here: two Ontario utilities present as Green Button compliant and cannot be verified, one because its onboarding host returns HTTP 200 for every path including invented ones, being a single-page-app catch-all. Without a verification state that provider scores as compliant.	`the mandated surface is evidenced by a resolvable endpoint, register entry or conformant discovery document — not by a compliance page`	8

How the catalog distributes on it

Every one of the 32,443 providers this facet is scored on, bucketed by sub-score.

90-1000 · 0.0%

75-89.91 · 0.0%

50-74.965 · 0.2%

25-49.95,704 · 17.6%

0.1-24.923,917 · 73.7%

02,756 · 8.5%

Top providers

The top 500 of 29,687 providers scoring above zero on this facet, ranked by facet sub-score, ties broken by composite.

1 SMKlog76.5 94.0exemplar 2 Infobip72.5 84.9exemplar 3 Twilio70.8 91.6exemplar 4 GatiFlow69.1 95.3exemplar 5 Whisper Security63.7 59.3strong 6 ModMed62.5 52.0developing 7 Reliance Jio60.0 50.5developing 8 GitDealFlow59.8 68.2exemplar 9 Revolut59.1 70.0exemplar 10 Triodos Bank UK59.1 41.2developing 11 Elation Health57.8 79.4exemplar 12 Medplum57.8 71.7exemplar 13 Plaid57.5 84.6exemplar 14 Co-Legal57.3 42.4developing 15 Airwallex57.1 83.8exemplar 16 Nylas56.9 87.4exemplar 17 drchrono56.3 77.0exemplar 18 FeedOracle Technologies55.9 70.1exemplar 19 Relm55.9 64.6strong 20 Citi55.9 61.4strong 21 Barclays55.9 57.9strong 22 Vinkius55.9 48.8developing 23 RenooLab55.9 46.4developing 24 ForceDream55.4 72.4exemplar 25 Up55.1 60.1strong 26 Citizens Financial Group55.1 59.0strong 27 Algbra55.1 48.7developing 28 Agoragentic54.9 80.4exemplar 29 Slash54.3 69.5exemplar 30 Memo Bank54.3 68.8exemplar 31 Newcastle Permanent Building Society54.3 39.2thin 32 CMS Energy54.1 55.3strong 33 Tebra53.9 51.9developing 34 Stripe53.6 81.1exemplar 35 Mollie53.6 59.6strong 36 Flywire53.6 55.1strong 37 CrowdStrike52.9 65.6strong 38 ADP52.9 43.8developing 39 Fourth52.9 37.4thin 40 Sparrow52.9 27.4thin 41 Moneyhub52.8 67.8exemplar 42 St.George Bank52.8 50.4developing 43 Deutsche Bank52.8 48.2developing 44 BCU Bank52.8 38.9thin 45 Iniciador52.8 33.1thin 46 Health Gorilla52.3 71.6exemplar 47 eClinicalWorks52.3 67.5exemplar 48 Trisotech52.3 58.4strong 49 Optum52.3 57.0strong 50 Emboss52.0 68.2exemplar 51 Virix Labs52.0 66.1strong 52 athenahealth51.6 67.0exemplar 53 NextGen Healthcare51.6 66.6exemplar 54 Canvas Medical51.6 64.6strong 55 Commure51.6 47.2developing 56 Buoy Health51.6 45.5developing 57 Oracle Health (Cerner)51.6 44.7developing 58 Athelas51.5 47.7developing 59 Danske Bank (UK)51.2 42.4developing 60 Canopy Connect50.9 65.9strong 61 hi.health50.9 65.3strong 62 CME Group50.9 40.5developing 63 BB&T Corp (Truist)50.4 51.2developing 64 Cashplus Bank50.4 38.0thin 65 MandateShield50.0 74.7exemplar 66 Pacific Gas and Electric50.0 55.5strong 67 Cumbuca49.6 27.6thin 68 Innovaccer49.3 30.5thin 69 Zoom Phone49.2 67.9exemplar 70 Verizon49.2 56.9strong 71 ETSI49.2 53.7developing 72 Telia Company49.2 46.8developing 73 Bharti Airtel49.2 46.7developing 74 Visier49.1 65.0strong 75 TaskHawk Systems49.0 69.4exemplar 76 Klarna48.8 73.6exemplar 77 Allica Bank48.8 50.1developing 78 first direct48.8 49.0developing 79 Virgin Money UK48.8 45.4developing 80 Australia and New Zealand Banking Group (ANZ)48.8 39.5developing 81 TSB Bank48.8 36.7thin 82 Recognise Bank48.8 35.5thin 83 Epic Systems48.4 62.5strong 84 AdvancedMD48.4 51.6developing 85 Elevance Health48.4 44.3developing 86 Leadping48.3 75.4exemplar 87 Braze48.3 73.5exemplar 88 SAP Emarsys48.3 66.5exemplar 89 GSMA48.3 54.3strong 90 Lightspeed Commerce48.2 83.9exemplar 91 AlgoVoi48.2 67.7exemplar 92 Fodda (PSFK)48.2 67.1exemplar 93 GoFundMe48.2 64.8strong 94 Unit48.2 64.7strong 95 Gr4vy48.2 62.4strong 96 Astrada48.2 54.7strong 97 Ziina48.2 54.0developing 98 Coinflow48.2 53.5developing 99 Mesh Payments48.2 47.3developing 100 Uphold48.1 79.6exemplar 101 Upstox48.1 74.9exemplar 102 Gemini Trust Company48.1 67.6exemplar 103 The Colony48.0 74.8exemplar 104 Lili48.0 68.7exemplar 105 cogDepot48.0 65.9strong 106 Westpac48.0 62.3strong 107 FIS Global48.0 60.6strong 108 LVL LTD CO48.0 56.4strong 109 Bank of Queensland48.0 52.1developing 110 University of Warwick48.0 47.9developing 111 Delft University of Technology48.0 47.6developing 112 Bank First48.0 42.2developing 113 C. Hoare & Co.48.0 41.6developing 114 University of Twente48.0 41.5developing 115 IMB Bank48.0 40.0developing 116 Qudos Bank48.0 39.8developing 117 Commonwealth Bank48.0 39.4developing 118 Coventry Building Society48.0 38.3thin 119 Hampden & Co48.0 38.1thin 120 Monument Bank48.0 36.6thin 121 Australian Military Bank48.0 33.6thin 122 Flexpa47.7 72.2exemplar 123 1upHealth47.7 70.6exemplar 124 Jefferson Health47.7 59.2strong 125 Jane47.7 58.2strong 126 Redox47.7 57.8strong 127 Temple Health47.7 54.5strong 128 Independence Blue Cross47.7 54.0developing 129 Photon47.7 52.8developing 130 MEDITECH47.7 43.6developing 131 TailorMed47.7 41.8developing 132 Cohere Health47.7 29.5thin 133 zopa47.6 35.1thin 134 EDF Energy47.5 62.2strong 135 Xylem47.5 44.7developing 136 TypeSafe AI47.3 51.6developing 137 Cymetica47.2 63.6strong 138 Culture Amp47.1 66.6exemplar 139 MolTrust47.1 63.8strong 140 KPN47.1 62.4strong 141 Global Database47.1 54.0developing 142 Accela47.1 51.1developing 143 Yello47.1 32.7thin 144 Swisscom46.9 59.0strong 145 Stedi46.5 77.3exemplar 146 Qonto46.5 72.3exemplar 147 Guidewire46.5 63.6strong 148 IVANS46.5 58.4strong 149 Levitate46.5 57.1strong 150 Agicap46.5 50.2developing 151 Sygnum46.5 49.8developing 152 SavvyMoney46.5 37.9thin 153 PSC Insurance46.5 32.6thin 154 Artificial Labs46.5 28.6thin 155 SCVD General Store46.4 72.2exemplar 156 Zai46.4 56.4strong 157 Autopay46.4 50.6developing 158 Kraken46.3 64.4strong 159 Kontakt.io46.1 71.4exemplar 160 aicomglobal46.1 62.2strong 161 Dant346.1 61.3strong 162 Minds46.1 58.4strong 163 Practice Fusion46.1 57.4strong 164 Datavant46.1 56.5strong 165 b.well46.1 52.3developing 166 Moxe Health46.1 43.6developing 167 Suncorp Bank46.1 40.1developing 168 Anlora46.1 36.5thin 169 HotDoc46.1 36.2thin 170 Express Scripts Holding46.1 28.9thin 171 Enphase Energy45.9 65.2strong 172 Electricity North West45.9 59.6strong 173 Northern Powergrid45.9 54.8strong 174 Hydro-Québec45.9 51.8developing 175 The Co-operative Bank45.7 43.1developing 176 BankSA45.7 42.1developing 177 8x845.4 71.3exemplar 178 Didit45.3 62.6strong 179 Doximity45.3 50.6developing 180 Centene45.3 40.0developing 181 HubSpot45.1 93.2exemplar 182 Harness45.1 89.2exemplar 183 Tray.ai45.1 87.8exemplar 184 ZoomInfo45.1 86.6exemplar 185 SendGrid45.1 85.9exemplar 186 Eventwren45.1 85.6exemplar 187 Confluent45.1 85.3exemplar 188 Dynatrace45.1 84.5exemplar 189 Zoho CRM45.1 84.4exemplar 190 Hagglebee45.1 84.3exemplar 191 Yarnhen45.1 84.3exemplar 192 Yawplet45.1 84.3exemplar 193 WSO245.1 83.0exemplar 194 Xquik45.1 82.9exemplar 195 AhaSend45.1 82.8exemplar 196 Kinde45.1 82.4exemplar 197 Appwrite45.1 82.3exemplar 198 Acronis45.1 82.1exemplar 199 Microsoft Entra ID (formerly Azure AD)45.1 81.8exemplar 200 Optimizely45.1 81.3exemplar 201 Algolia45.1 81.3exemplar 202 GitHub Actions45.1 81.3exemplar 203 GitLab45.1 81.0exemplar 204 Datadog APM45.1 80.4exemplar 205 LaunchDarkly45.1 79.7exemplar 206 Outreach45.1 79.3exemplar 207 Snyk45.1 79.1exemplar 208 Sentry45.1 79.0exemplar 209 OpenMercantil45.1 79.0exemplar 210 Datadog45.1 77.6exemplar 211 Cvent Registration45.1 77.2exemplar 212 Cvent45.1 77.1exemplar 213 Flagsmith45.1 77.0exemplar 214 RudderStack45.1 77.0exemplar 215 Bugsnag45.1 76.9exemplar 216 MongoDB45.1 76.9exemplar 217 Microsoft Azure45.1 76.5exemplar 218 Confluent | the Data Streaming Platform45.1 76.3exemplar 219 ThousandEyes45.1 75.6exemplar 220 Acquia45.1 75.5exemplar 221 LinkedIn45.1 74.8exemplar 222 Canonical45.1 74.8exemplar 223 Automation Anywhere45.1 74.6exemplar 224 Surfe45.1 74.1exemplar 225 Oracle Hospitality45.1 74.0exemplar 226 Adobe Launch45.1 73.9exemplar 227 Okta45.1 73.8exemplar 228 KnoxCall45.1 73.7exemplar 229 Microsoft Azure Cache For Redis45.1 73.6exemplar 230 lemlist45.1 72.8exemplar 231 Checkly45.1 72.5exemplar 232 Sigma Computing45.1 72.4exemplar 233 ClickHouse45.1 72.0exemplar 234 Prisma45.1 71.7exemplar 235 Vaquill AI45.1 71.6exemplar 236 Microsoft Azure API Management45.1 71.4exemplar 237 Microsoft Azure Cdn45.1 71.3exemplar 238 Zendesk45.1 71.2exemplar 239 Lusha45.1 71.2exemplar 240 Meltwater45.1 71.2exemplar 241 Taboola45.1 71.0exemplar 242 Vendasta45.1 70.9exemplar 243 Clickup45.1 70.9exemplar 244 Microsoft Dynamics 365 Sales45.1 70.8exemplar 245 Netlify45.1 70.6exemplar 246 Bitly45.1 70.5exemplar 247 Azure Data Factory45.1 70.5exemplar 248 Khoros45.1 70.4exemplar 249 Impact45.1 70.4exemplar 250 Adobe Workfront45.1 70.4exemplar 251 Salesforce Service Cloud APIs45.1 70.4exemplar 252 UserGems45.1 70.2exemplar 253 Leadspace45.1 70.1exemplar 254 Losant45.1 70.0exemplar 255 Cracked API45.1 69.9exemplar 256 Cogny45.1 69.8exemplar 257 Laravel45.1 69.6exemplar 258 Canva45.1 69.3exemplar 259 Malwarebytes45.1 69.1exemplar 260 Airbyte45.1 69.1exemplar 261 Matomo45.1 69.0exemplar 262 Drata45.1 69.0exemplar 263 G245.1 69.0exemplar 264 Canvas45.1 68.9exemplar 265 Esri45.1 68.9exemplar 266 Oracle Siebel45.1 68.9exemplar 267 Conga45.1 68.6exemplar 268 Tricentis45.1 68.6exemplar 269 Unbounce45.1 68.6exemplar 270 Strivacity45.1 68.5exemplar 271 Lucid45.1 68.5exemplar 272 Cohesity45.1 68.4exemplar 273 Cisco XDR45.1 68.3exemplar 274 Archbee45.1 68.2exemplar 275 Agorapulse45.1 68.2exemplar 276 Asana45.1 67.8exemplar 277 Microsoft45.1 67.7exemplar 278 TranscriptFetch45.1 67.7exemplar 279 Adobe Analytics45.1 67.6exemplar 280 Azure Cost Management45.1 67.5exemplar 281 BlueConic45.1 67.4exemplar 282 Encharge45.1 67.3exemplar 283 Better Stack45.1 67.0exemplar 284 Improvado45.1 67.0exemplar 285 Slack45.1 66.9exemplar 286 CloudBees45.1 66.7exemplar 287 Rybbit45.1 66.7exemplar 288 Eliq45.1 66.5exemplar 289 Embrace45.1 66.4strong 290 Statable Stats API45.1 66.4strong 291 Remote45.1 66.3strong 292 Seismic45.1 66.2strong 293 Chili Piper45.1 66.1strong 294 Grafana Loki45.1 66.1strong 295 Google Cloud Logging45.1 66.1strong 296 Infer by Flow745.1 65.9strong 297 Microsoft Outlook45.1 65.9strong 298 Pluralsight45.1 65.8strong 299 Common Room45.1 65.7strong 300 Snapchat45.1 65.7strong 301 Kiteworks45.1 65.5strong 302 Nuix45.1 65.5strong 303 Buffer45.1 65.5strong 304 JuriSign45.1 65.3strong 305 Red Hat Ansible Automation Platform45.1 65.0strong 306 Calico45.1 64.9strong 307 Semrush45.1 64.9strong 308 Simon Data45.1 64.8strong 309 Newscred45.1 64.8strong 310 Tradeshift45.1 64.8strong 311 Visma45.1 64.7strong 312 Hootsuite45.1 64.3strong 313 StackAdapt45.1 64.3strong 314 1Lookup45.1 64.3strong 315 Amber Electric45.1 64.2strong 316 Buf45.1 63.9strong 317 Cisco Catalyst SD-WAN45.1 63.8strong 318 Acceldata45.1 63.5strong 319 Dash045.1 63.5strong 320 Knak45.1 63.4strong 321 Microsoft Azure Private Link45.1 62.8strong 322 Crossbeam45.1 62.8strong 323 Cisco Umbrella45.1 62.7strong 324 RocketReach45.1 62.7strong 325 Google Cloud Platform45.1 62.3strong 326 HookLogic (Criteo)45.1 62.3strong 327 Microsoft Azure Batch45.1 62.2strong 328 GoHarbor45.1 62.1strong 329 Syft Data45.1 62.1strong 330 Cvent Social Tables45.1 62.0strong 331 Optoro45.1 61.9strong 332 Microsoft Word45.1 61.8strong 333 Microsoft Office 36545.1 61.8strong 334 Octopus Deploy45.1 61.8strong 335 LeanData45.1 61.7strong 336 Google AdMob45.1 61.5strong 337 GoToWebinar45.1 61.4strong 338 Microsoft SQL Server45.1 61.3strong 339 Social Fetch45.1 61.3strong 340 University of Waterloo45.1 61.3strong 341 Microsoft Azure Quantum45.1 61.2strong 342 Shortcut Software45.1 61.2strong 343 Bynder45.1 61.1strong 344 Entergram45.1 61.1strong 345 Google Vault45.1 61.1strong 346 Employment Hero45.1 60.9strong 347 Navattic45.1 60.8strong 348 Webflow45.1 60.7strong 349 Dun & Bradstreet45.1 60.7strong 350 FullEnrich45.1 60.7strong 351 Upsun45.1 60.6strong 352 Zendesk Sell45.1 60.6strong 353 Dropbox Sign (HelloSign)45.1 60.5strong 354 Rose Rocket45.1 60.5strong 355 Mention45.1 60.4strong 356 Autodesk45.1 60.3strong 357 Cisco Intersight45.1 60.3strong 358 Skai (Kenshoo)45.1 60.3strong 359 Smart Pension45.1 60.3strong 360 NextRoll45.1 59.7strong 361 Youtube45.1 59.6strong 362 Figma45.1 59.6strong 363 CybelAngel45.1 59.5strong 364 Deployxa45.1 59.5strong 365 Zype45.1 59.3strong 366 Criteo45.1 59.2strong 367 Salesforce Marketing Cloud Account Engagement (Pardot)45.1 59.2strong 368 LiveRamp45.1 59.1strong 369 Salsify45.1 59.1strong 370 JFrog Container Registry45.1 59.1strong 371 Warmly45.1 58.8strong 372 Contensis45.1 58.7strong 373 Sendoso45.1 58.1strong 374 Eightfold AI45.1 58.1strong 375 Platform.sh45.1 57.9strong 376 Cisco PSIRT openVuln API45.1 57.9strong 377 Supermetrics45.1 57.3strong 378 Dreamdata45.1 57.2strong 379 Experian45.1 57.0strong 380 Leadpages45.1 57.0strong 381 Microsoft Teams45.1 56.2strong 382 Webflow API and Documentation45.1 56.1strong 383 Tigera45.1 56.0strong 384 Filen45.1 55.8strong 385 Snap45.1 55.8strong 386 Truora45.1 55.8strong 387 The Trade Desk45.1 55.1strong 388 Harmonic.ai45.1 55.1strong 389 Forsta45.1 54.8strong 390 LVT45.1 54.8strong 391 Microsoft Office45.1 54.7strong 392 Usersnap45.1 54.6strong 393 Automattic45.1 54.5strong 394 Huntress45.1 54.2developing 395 PEXA45.1 53.9developing 396 Elium45.1 53.9developing 397 Adverity45.1 53.8developing 398 RELEX Solutions45.1 53.4developing 399 Assignar45.1 53.1developing 400 involve.me45.1 52.9developing 401 Linktree45.1 52.8developing 402 Clozd45.1 52.6developing 403 Qwilr45.1 52.6developing 404 Jebbit45.1 52.4developing 405 AdRoll45.1 52.2developing 406 Brandwatch45.1 52.1developing 407 Jam45.1 52.1developing 408 Microsoft Excel45.1 51.9developing 409 Enigma Analytics45.1 51.9developing 410 UserTesting45.1 51.5developing 411 Microsoft SharePoint45.1 51.4developing 412 Google Sites45.1 51.3developing 413 Workday Benefits45.1 51.0developing 414 Habu45.1 50.8developing 415 Blue Prism45.1 50.7developing 416 Choreo45.1 50.2developing 417 Parabol45.1 50.2developing 418 NinjaOne45.1 50.0developing 419 Coupa45.1 49.9developing 420 Horizon3.ai45.1 49.8developing 421 Ping Identity45.1 49.5developing 422 TourRadar45.1 49.2developing 423 Plotly45.1 49.1developing 424 DocSend45.1 48.5developing 425 May Mobility45.1 48.1developing 426 AutoCAD45.1 47.7developing 427 WakaTime45.1 47.6developing 428 Google Android45.1 47.6developing 429 Codesignal45.1 47.0developing 430 Enboarder45.1 46.8developing 431 Nexthink45.1 46.6developing 432 Precisely APIs45.1 46.6developing 433 Virtual Peaker45.1 46.4developing 434 Happyrobot45.1 46.2developing 435 Trestle45.1 45.9developing 436 Demandware45.1 45.9developing 437 Equifax45.1 45.8developing 438 Grin45.1 45.1developing 439 Simpplr45.1 45.0developing 440 Red Hat Enterprise Linux45.1 44.8developing 441 Stagwell45.1 43.3developing 442 OnPay45.1 42.2developing 443 Cequence Security45.1 41.2developing 444 Balbix45.1 39.9developing 445 ZenHR45.1 39.8developing 446 NIFT45.1 39.5developing 447 Wyze45.1 39.2thin 448 Cyera45.1 39.1thin 449 Retail Zipline45.1 37.7thin 450 Articulate45.1 35.2thin 451 Nucleus Security45.1 35.1thin 452 Spate45.1 35.1thin 453 Klue45.1 34.7thin 454 LIQID Investments45.1 34.6thin 455 SkyKick45.1 34.4thin 456 Ivalua45.1 34.3thin 457 Exabeam45.1 34.2thin 458 Connect The Dots45.1 33.3thin 459 RainFocus45.1 32.7thin 460 Wellfound45.1 32.3thin 461 DoubleVerify45.1 30.4thin 462 Deepwatch45.1 30.2thin 463 Flockjay45.1 29.4thin 464 Cleveland-Cliffs45.1 29.2thin 465 Actively45.1 28.4thin 466 NoRedInk45.1 27.0thin 467 TELUS45.0 50.4developing 468 Aduna45.0 32.3thin 469 Nopan44.9 44.9developing 470 Bank of Ireland (UK)44.9 37.1thin 471 Gateway Bank44.9 34.4thin 472 Ambience Healthcare44.9 30.5thin 473 Factiva44.8 52.7developing 474 PAY.JP44.6 63.8strong 475 Finix44.6 61.9strong 476 Bolt Financial44.6 60.7strong 477 PayTabs44.6 58.9strong 478 Peach Payments44.6 58.3strong 479 PayMongo44.6 57.7strong 480 ProcessOut44.6 50.8developing 481 Payrails44.6 48.7developing 482 GetPaid44.6 48.6developing 483 Solaris44.6 46.1developing 484 Aidbox44.5 57.8strong 485 Aetna44.5 45.1developing 486 Curana Health44.5 33.3thin 487 Dow Jones44.4 63.2strong 488 Customer.io44.2 84.0exemplar 489 AfterShip44.2 82.6exemplar 490 Brevo44.2 80.8exemplar 491 Kit44.2 79.7exemplar 492 Salesforce Marketing Cloud44.2 79.1exemplar 493 Close44.2 73.7exemplar 494 Listrak44.2 72.7exemplar 495 Klaviyo44.2 72.0exemplar 496 Attentive44.2 71.9exemplar 497 Adobe Campaign44.2 70.7exemplar 498 AWeber44.2 69.0exemplar 499 MoEngage44.2 68.9exemplar 500 SendPulse44.2 68.4exemplar

Move this number. Every provider in the catalog is profiled into a public record at artifacts.apis.io/<provider>/, and each check above names the exact artifact it reads. Publish the artifact, open an issue on github.com/api-evangelist/<provider> pointing at it, and the next scoring run picks it up — no gatekeeping and no fee. The full rubric is at apis.io/rating/, and the Influence plan is the fast lane if you would rather work your own listing through the API — remediation, projections and re-check requests.

Scored on rubric v0.25.0 across 32,443 providers · lists rebuilt 2026-10-29 · capped at the top 500 per page.

Regulatory Posture

How it is scored

How the catalog distributes on it

Top providers

The other 8 facets