Mastercardmastercard.com
Mastercard's API program shows genuine strengths in contract quality, schema design, and documentation reachability — a solid technical foundation. However, two areas demand immediate attention: partners and their AI agents cannot safely integrate without a clearly separated sandbox environment, and the program lacks the machine-readable context files and structured signals that modern agents depend on to discover and act on your APIs without human intervention.
API DesignA clean, typed, well-governed API contract agents can reason about1 pass4 warn0 fail72B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Machine-readable, versioned contractvia spec | 18.8/25 | info.version="1.0.0" set but no versioning scheme (URL / header / media type) detected. Investigated: spec 75%, docs 50%. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| warn | Schema coverage & depthvia spec | 16.7/25 | Only 0% of operations have documented schemas. Investigated: spec 67%, sdk 0%. | Typed, complete request/response schemas are what make agent function-calling possible. |
| warn | Security & governance hygienevia spec | 13.5/15 | 10 credential-shaped strings detected in spec: bearer-jwt (×10). Investigated: spec 90%, wellknown 0%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| pass | Example coveragevia spec | 10/10 | 100% example coverage across params + responses. Investigated: spec 100%, docs 100%, sdk 0%. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
| warn | Auth declared & discoverablevia docs | 6.3/25 | No securitySchemes declared. Investigated: docs 25%, spec 13%. | Agents can only authenticate when auth is declared, scoped, and discoverable. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples3 pass0 warn2 fail59D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Code samples in docsvia docs | 18/18 | Code samples in 8 language(s) across docs (top: java, javascript, csharp); 1/20 pages have ≥ 2 languages on the same page. Investigated: docs 100%. | Multi-language samples shorten time-to-first-call. |
| pass | Description completenessvia spec | 15/15 | 54% description completeness. Investigated: spec 100%. | Complete descriptions are the context humans and agents need to use endpoints. |
| pass | Changelog publishedvia sdk | 13/13 | Newest official SDK activity 7 day(s) ago. Investigated: sdk 100%, spec 0%, docs 0%. | A published changelog lets partners track changes without surprise. |
| fail | Self-service developer portalvia docs | 0/29 | No signup page detected across conventional paths (/signup, /sign-up, /register, /get-started, /console/signup, /dashboard/signup, /try, /try-free, /free, /free-trial, /start, /start-free). Investigated: docs 0%. | Self-serve key/account creation is the fast first call for partners, with no sales gate. |
| fail | Quickstart presentvia docs | 0/25 | No quickstart/getting-started page found at the conventional paths. Investigated: docs 0%. | A quickstart is the fastest path from landing page to first successful call. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs1 pass3 warn0 fail69C
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Registry & SDK presencevia docs | 28/28 | Indexed on Context7 (websites/ap-gateway_mastercard_api_integrationguidelines, 5851 snippets). Investigated: docs 100%, sdk 100%, cli 0%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| warn | Docs reachable, not hard auth-gatedvia docs | 15/30 | 47 of 50 sampled pages return 200 for non-existent URLs (soft 404). Investigated: docs 50%. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
| warn | llms.txt present, valid & comprehensivevia docs | 9.4/30 | No llms.txt directive found in HTML of any of 50 sampled pages. Investigated: docs 31%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| warn | Crawlable / AEOvia wellknown | 9/12 | Sitemap lastmod coverage 0% or newest entry older than 90 days. Investigated: wellknown 75%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs1 pass2 warn2 fail80A
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Machine-readable errors (RFC 9457)via docs | 28/28 | No 4xx/5xx response codes (or default error response) documented anywhere in the spec. Investigated: docs 100%, spec 50%. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| warn | Operation purpose clarityvia spec | 23.8/25 | 87% of operations are agent-inferable (target 90%+). Investigated: spec 95%. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| warn | Agent-navigable, token-efficient docsvia docs | 18.7/22 | 50 of 50 sampled pages have content starting past 50% (worst 105%). Investigated: docs 85%. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| fail | Agent instructions file (AGENTS.md)via wellknown | 0/10 | No AGENTS.md at the site root or /.well-known/. Investigated: wellknown 0%. | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| fail | Docs structured datavia docs | 0/8 | Neither JSON-LD nor OpenGraph/meta tags detected across 20 sampled pages — likely a CSR-only docs site. Investigated: docs 0%. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| na | Description consistency across surfaces | —/7 | Only 1 surface description(s) with ≥6 tokens available; need at least 2 to compare. | Every surface tells the same story about what the product is. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them0 pass3 warn2 fail45F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Pagination documented & consistentvia spec | 12.6/22 | 2 list endpoint(s) exist but no pagination params found. Investigated: spec 57%, docs 57%. | Consistent, documented pagination lets agents traverse collections. |
| warn | Runnable collection with test scriptsvia platform | 4.5/9 | No test scripts found in the workspace's collections. Investigated: platform 50%. | A public, maintained collection with assertions is runnable truth agents validate against. |
| warn | Idempotency documentedvia spec | 1.4/27 | 0% of mutating operations document idempotency. Investigated: spec 5%, docs 5%. | Documented idempotency lets agents retry safely. |
| fail | Rate-limit signalingvia spec | 0/22 | No rate-limit response headers documented. Investigated: spec 0%, docs 0%. | Machine-readable rate-limit headers let agents throttle adaptively. |
| fail | Sandbox separationvia spec | 0/20 | No sandbox/test server declared across 2 server entries; no test-key prefixes documented. Investigated: spec 0%, docs 0%. | An isolated environment lets agents exercise destructive operations safely. |
Resources Discovered
The public resources we found for Mastercard — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| Agent hints | Context7 (5,851) |
|---|---|
| APIs analyzed | 10 — 🇺🇸 Mastercard Open Finance US APIs, 🇦🇺 Mastercard Open Finance AU APIs, Mastercard Business Payment Controls API, Mastercard MasterCom, Mastercard Cross Border Services Pins API, Mastercard Merchant Self Services API, Mastercard Id For Trust Providers API, Mastercard Open Finance Accept Payment APIs, Mastercard Gateway API, Mastercard Donate API |