Auth0auth0.com
Auth0's API program is already strong on design clarity and developer experience, giving partners a solid foundation to evaluate and build against the platform. However, two gaps stand out as the most consequential for partner and agent success: AI agents lack a structured instructions file to understand how to interact with Auth0's APIs, and there are no runnable collections with test scripts to give partners and their coding agents verified, executable workflows.
API DesignA clean, typed, well-governed API contract agents can reason about2 pass1 warn0 fail96A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Schema coverage & depthvia sdk | 22.9/25 | 1 of 34 public signatures use loose types (anyTypeRatio=0.029). Investigated: sdk 92%. | Typed, complete request/response schemas are what make agent function-calling possible. |
| pass | Security & governance hygienevia wellknown | 15/15 | security.txt valid at https://auth0.com/.well-known/security.txt (Contact + unexpired Expires). Investigated: wellknown 100%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| pass | Example coveragevia sdk | 10/10 | README is present and includes a runnable quickstart. Investigated: sdk 100%. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
| na | Machine-readable, versioned contract | —/25 | No surface produced evidence for this capability in this run. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| na | Auth declared & discoverable | —/25 | No surface produced evidence for this capability in this run. | Agents can only authenticate when auth is declared, scoped, and discoverable. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples1 pass1 warn0 fail91A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Self-service developer portalvia docs | 29/29 | Self-service signup at https://auth0.com/signup; no free tier or sandbox language detected. Investigated: docs 100%. | Self-serve key/account creation is the fast first call for partners, with no sales gate. |
| warn | Description completenessvia sdk | 10.6/15 | 5/17 operations lack a description. Investigated: sdk 71%. | Complete descriptions are the context humans and agents need to use endpoints. |
| na | Quickstart present | —/25 | No surface produced evidence for this capability in this run. | A quickstart is the fastest path from landing page to first successful call. |
| na | Code samples in docs | —/18 | No surface produced evidence for this capability in this run. | Multi-language samples shorten time-to-first-call. |
| na | Changelog published | —/13 | No surface produced evidence for this capability in this run. | A published changelog lets partners track changes without surprise. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs2 pass1 warn0 fail92A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | llms.txt present, valid & comprehensivevia docs | 30/30 | llms-full.txt reachable at https://auth0.com/llms-full.txt. Investigated: docs 100%, sdk 0%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| pass | Registry & SDK presencevia docs | 28/28 | Indexed on Context7 (websites/auth0, 37739 snippets). Investigated: docs 100%, sdk 100%, cli 100%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| warn | Crawlable / AEOvia wellknown | 6/12 | Sitemap present (9 entries) but carries no lastmod values. Investigated: wellknown 50%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
| na | Docs reachable, not hard auth-gated | —/30 | No surface produced evidence for this capability in this run. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs1 pass0 warn1 fail78B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Machine-readable errors (RFC 9457)via sdk | 28/28 | Single base error "GenericError" with 8 subclasses. Investigated: sdk 100%. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| fail | Agent instructions file (AGENTS.md)via wellknown | 0/10 | No AGENTS.md at the site root or /.well-known/. Investigated: wellknown 0%. | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| na | Operation purpose clarity | —/25 | No surface produced evidence for this capability in this run. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| na | Agent-navigable, token-efficient docs | —/22 | No surface produced evidence for this capability in this run. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| na | Docs structured data | —/8 | No surface produced evidence for this capability in this run. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| na | Description consistency across surfaces | —/7 | Only 1 surface description(s) with ≥6 tokens available; need at least 2 to compare. | Every surface tells the same story about what the product is. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them1 pass1 warn1 fail72B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Idempotency documentedvia sdk | 27/27 | Built-in retry machinery is present (grep-derived). Investigated: sdk 100%. | Documented idempotency lets agents retry safely. |
| warn | Sandbox separationvia sdk | 10/20 | No test-mode flag or sandbox environment is exposed. Investigated: sdk 50%. | An isolated environment lets agents exercise destructive operations safely. |
| fail | Runnable collection with test scriptsvia platform | 0/9 | No public Postman workspace discovered for the org. Investigated: platform 0%. | A public, maintained collection with assertions is runnable truth agents validate against. |
| na | Rate-limit signaling | —/22 | No surface produced evidence for this capability in this run. | Machine-readable rate-limit headers let agents throttle adaptively. |
| na | Pagination documented & consistent | —/22 | No surface produced evidence for this capability in this run. | Consistent, documented pagination lets agents traverse collections. |
Resources Discovered
The public resources we found for Auth0 — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| Agent hints | Context7 (37,739) |
|---|