◎ Discry Score
enable banking.com
payments · API
D
0 / 100
DISCOVERY0
COMPREHENSION0
Category leader: 94 (A)
Discry your API →
PAYMENTS · RANK #19 OF 25

Enable Banking is Poor to agents.

Discry independently scored how well an AI agent can discover and understand the Enable Banking API from what’s public — not whether it’s usable. Below: every signal we checked, what’s costing the score, and what to change.

Discry your API — freeView the docs ↗

SCORED UNDER RUBRIC 1.2 · A full re-launch under Discry Score 2.5 — a new behavioral instrument, not comparable to these scores — is in progress.

Discovery

45% of score · 24/100
OpenAPI specA machine-readable OpenAPI/Swagger spec agents can parse.Partial
llms.txtAn llms.txt index that points agents to the docs that matter.Fail
llms.txt qualityThe llms.txt is focused, current, and well under the size budget.Fail
llms-full.txtA full-text bundle agents can load in one request.Fail
AGENTS.mdAn AGENTS.md that tells coding agents how to build on the API.Fail
.well-known/mcp.jsonA discoverable MCP manifest at a well-known path.Fail
MCP registryThe API is listed in a public MCP registry.Partial
robots.txt AI directivesrobots.txt allows (or explicitly guides) AI crawlers.Fail
SitemapA sitemap so agents can enumerate the docs surface.Pass

Comprehension

55% of score · 85/100
Task-oriented descriptionsEndpoints described by what they accomplish, not just their shape.Pass
Realistic examplesRunnable, real-world request/response examples.Pass
Multi-step workflowsDocs that chain calls into complete jobs an agent can follow.Pass
Error-recovery guidanceDocumented failure modes and how to recover from them.Partial
Answer-first formatThe answer leads; preamble does not bury it.Pass
Capability boundariesClear limits — what the API can and cannot do.Pass
Naming consistencyConsistent, predictable naming across endpoints.Pass
Heading hierarchyClean heading structure agents can navigate.Pass
Markdown docsDocs available as clean markdown, not JS-rendered HTML only.Partial
Token efficiencyDocs are concise enough to fit an agent context window.Partial

What we found

  • An agent trying to DISCOVER this API programmatically hits a wall: there is no robots.txt (HTTP 404), no llms.txt, no llms-full.txt, no .well-known/mcp.json, and no AGENTS.md in the GitHub org — none of the machine-readable discovery surfaces an agent would probe first exist.
  • Once an agent REACHES the docs, comprehension is strong: the reference is a cleanly structured single page (H1 sections -> H2 endpoints -> H3 Parameters/Responses) where every endpoint leads with its method and path, uses consistent snake_case, and documents a standardized ErrorResponse JSON with named, described error codes.
  • The Quick Start reads like an agent runbook: it chains the full account-information flow (list ASPSPs -> start auth -> authorize session -> fetch balances -> fetch transactions) and the full payment flow end-to-end, with realistic, copy-pasteable Python AND JavaScript examples using plausible IBANs, amounts, and dates.
  • No downloadable OpenAPI/Swagger spec is exposed for the main aggregation API (api.enablebanking.com) — the reference is HTML-rendered from an underlying spec but an agent cannot fetch openapi.json/yaml. A separate eidas_broker microservice repo publishes an openapi.json, and a Jentic auto-import issue exists, but neither gives an agent the core API contract as structured data.
  • Capability boundaries are unusually well documented for this category: a dedicated Limitations section (Mock ASPSP has no payment initiation; transactions batch in 10s; sandbox filtering unsupported except Nordea/Handelsbanken) plus explicit rate-limit and sandbox-instability caveats mean an agent learns key constraints from docs rather than by failing.

What to change

Prioritized by impact on discoverability. You (or your docs platform) deploy these — Discry never touches your API.

  1. 01Add an llms.txt at the domain root pointing to the Quick Start, API reference, sandbox, and error-code sections — this is the single highest-leverage discovery fix and would let agents orient in under 5,000 tokens instead of parsing a 196KB HTML reference.
  2. 02Publish a downloadable OpenAPI 3.x spec (openapi.json / openapi.yaml) for the main aggregation API at a stable, linked path in the reference — the doc is already spec-generated, so exposing the source contract turns openApiSpec from partial to pass and unlocks automatic client/tool generation.
  3. 03Add a robots.txt that explicitly allows GPTBot, ClaudeBot, Google-Extended, and CCBot (and re-list the docs sitemap) — right now the 404 gives crawling agents no signal at all.
  4. 04Upgrade error documentation from 'what went wrong' to 'what to do next': add Retry-After / rate-limit-header names and per-error recovery guidance (e.g. what to do on EXPIRED_SESSION, DATE_FROM_IN_FUTURE, ASPSP_RATE_LIMIT_EXCEEDED) so an agent can self-correct instead of stalling.
  5. 05Add an AGENTS.md to the enablebanking-api-samples repo summarizing the auth model, base URL, core flows, and gotchas, and publish or endorse a first-party MCP server so the API appears in Glama/Smithery/PulseMCP under its own name rather than only inside a third-party wrapper.

Execution coverage · INFORMATIONAL, UNSCORED

Whether an agent can actually complete a call and recover from errors is the deeper Audit layer — documented here, but not part of the Discry Score.

JWT (RS256, application private key)OAuth 2.0 (end-user PSU authorisation / redirect flow) Error format documented Rate limits documented Pagination documented Idempotency documented

Auth is a two-layer model: the application signs every request with an RS256 JWT built from a per-app private key, and end-user access is granted through an OAuth 2.0 redirect flow to the ASPSP. Errors are returned in a documented, machine-parseable ErrorResponse JSON (message, numeric code = HTTP status, text error code from a named ErrorCode enum, and a detail field), with per-endpoint status tables (400/401/403/404/408/422/429/500) and a rich named error-code table with human-readable descriptions. Rate limiting is acknowledged (429 Too Many Requests documented; ASPSP_RATE_LIMIT_EXCEEDED error code) though no numeric limits or Retry-After header names are specified. Transaction listing is paginated via an opaque continuation_key. Idempotency keys are not documented. An agent could parse errors reliably but would not know retry timing or how to make payment creation idempotent without live testing.

See your own Discry Score.

Drop your API docs URL. See what an agent sees — in 60 seconds, free.

Discry your API — free