Mastercardmastercard.com
Mastercard's API program shows strong fundamentals in agent understanding and API design, but two areas put partner momentum at risk: developer experience and agent usability. Partners currently have no self-service path to get started, no code samples to accelerate integration, no published changelog to manage change safely, and no documented rate-limit signals to prevent their agents from hitting throttle walls unexpectedly.
API DesignA clean, typed, well-governed API contract agents can reason about2 pass3 warn0 fail78B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Schema coverage & depthvia sdk | 21.4/25 | 0/1 (0%) enum-like params are realized as constrained types (not bare strings). Investigated: sdk 86%, spec 70%. | Typed, complete request/response schemas are what make agent function-calling possible. |
| warn | Machine-readable, versioned contractvia spec | 21.3/25 | The API sets a version ("1.0.0") but exposes no versioning scheme in the URL, a header, or the media type, so an agent can't pin to a specific version. Investigated: spec 85%, docs 70%. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| pass | Security & governance hygienevia sdk | 15/15 | Code is formatter-clean with zero linter errors and zero style warnings. Investigated: sdk 100%, spec 80%, wellknown 0%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| pass | Example coveragevia spec | 10/10 | 100% of parameters and responses (922 of 922) include example values, grounding an agent in real payload shapes. Investigated: spec 100%, sdk 100%, docs 0%. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
| warn | Auth declared & discoverablevia docs | 6.3/25 | The spec declares no authentication scheme, so an agent can't tell how to authenticate a request. Investigated: docs 25%, spec 13%. | Agents can only authenticate when auth is declared, scoped, and discoverable. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples2 pass0 warn3 fail55D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Quickstart presentvia docs | 25/25 | Quickstart at https://developer.mastercard.com/community-pass-payment-apis/documentation/code-and-formats/index has a runnable code sample in its plain-text .md variant (https://developer.mastercard.com/community-pass-payment-apis/documentation/code-and-formats/index.md). Investigated: docs 100%. | A quickstart is the fastest path from landing page to first successful call. |
| pass | Description completenessvia spec | 15/15 | Only 54% of operations and parameters have descriptions (116 of 142 ops, 103 of 386 params), leaving an agent to guess what most endpoints do. Investigated: spec 100%, sdk 96%. | Complete descriptions are the context humans and agents need to use endpoints. |
| fail | Self-service developer portalvia docs | 0/29 | No self-service signup detected — no signup link on the homepage or docs, and no conventional signup path (/signup, /sign-up, /register, /get-started, /console/signup, /dashboard/signup, /try, /try-free, /free, /free-trial, /start, /start-free, /join, /create-account, /account/signup, /auth/signup, /users/sign_up) resolved — so an agent can't onboard on its own. Investigated: docs 0%. | Self-serve key/account creation is the fast first call for partners, with no sales gate. |
| fail | Code samples in docsvia docs | 0/18 | No code samples detected across 20 sampled docs pages, so a coding agent gets no ready-to-use examples. Investigated: docs 0%. | Multi-language samples shorten time-to-first-call. |
| fail | Changelog publishedvia spec | 0/13 | No changelog link or mention appears in the spec, so an agent can't tell what changed before something breaks. Investigated: spec 0%, docs 0%. | A published changelog lets partners track changes without surprise. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs1 pass3 warn0 fail69C
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Registry & SDK presencevia docs | 28/28 | Indexed on Context7 (websites/developer_mastercard, 93077 snippets). Investigated: docs 100%, sdk 67%, cli 0%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| warn | Docs reachable, not hard auth-gatedvia docs | 15/30 | 48 of 50 sampled pages return 200 for non-existent URLs (soft 404). Investigated: docs 50%. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
| warn | llms.txt present, valid & comprehensivevia docs | 9.4/30 | No llms.txt directive found in HTML of any of 50 sampled pages. Investigated: docs 31%, sdk 0%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| warn | Crawlable / AEOvia wellknown | 9/12 | Sitemap has lastmod on only 0% of entries, or its newest entry is over 90 days old. Investigated: wellknown 75%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs2 pass2 warn1 fail86A
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Machine-readable errors (RFC 9457)via docs | 28/28 | Documents 4 distinct 4xx/5xx error response codes, so an agent can branch on specific failures instead of guessing. Investigated: docs 100%, spec 50%, sdk 0%. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| pass | Operation purpose clarityvia spec | 25/25 | 100% of operations (24 of 24) have both a clear summary and a descriptive name, so an agent can pick the right endpoint. Investigated: spec 100%, sdk 98%. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| warn | Agent-navigable, token-efficient docsvia docs | 19.8/22 | 50 of 50 sampled pages have content starting past 50% (worst 105%). Investigated: docs 90%. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| warn | Agent instructions file (AGENTS.md)via sdk | 5/10 | No agents.md or skill.md context file found (nice-to-have for agent operation). Investigated: sdk 50%, wellknown 0%. | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| fail | Docs structured datavia docs | 0/8 | No JSON-LD or OpenGraph/meta tags found across 20 sampled pages — likely a client-rendered docs site, so answer engines have nothing to cite. Investigated: docs 0%. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| na | Description consistency across surfaces | —/7 | Only 1 surface description(s) with ≥6 tokens available; need at least 2 to compare. | Every surface tells the same story about what the product is. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them2 pass2 warn1 fail57D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Sandbox separationvia sdk | 20/20 | Sandbox environments are exposed (sandbox). Investigated: sdk 100%, spec 0%, docs 0%. | An isolated environment lets agents exercise destructive operations safely. |
| warn | Pagination documented & consistentvia spec | 12.6/22 | List endpoints offer no pagination, so an agent can't page through large collections. Investigated: spec 57%, docs 57%. | Consistent, documented pagination lets agents traverse collections. |
| pass | Runnable collection with test scriptsvia sdk | 9/9 | README is present and includes a runnable quickstart. Investigated: sdk 100%, platform 50%. | A public, maintained collection with assertions is runnable truth agents validate against. |
| warn | Idempotency documentedvia spec | 1.4/27 | Only 0% of mutating operations (0 of 82) document idempotency, so an agent's retries can create duplicate writes. Investigated: spec 5%, docs 5%, sdk 0%. | Documented idempotency lets agents retry safely. |
| fail | Rate-limit signalingvia spec | 0/22 | No rate-limit response headers are documented, so an agent can't tell when it is approaching a limit and will get throttled. Investigated: spec 0%, docs 0%. | Machine-readable rate-limit headers let agents throttle adaptively. |
Resources Discovered
The public resources we found for Mastercard — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| Agent hints | Context7 (93,077) |
|---|---|
| APIs analyzed | 10 — 🇺🇸 Mastercard Open Finance US APIs, 🇦🇺 Mastercard Open Finance AU APIs, Mastercard Business Payment Controls API, Mastercard MasterCom, Mastercard Id For Trust Providers API, Mastercard Open Finance Accept Payment APIs, Mastercard Donate API, Mastercard Open Finance Data APIs, Mastercard Cross-border Service APIs, Mastercard Id Verification API |