Deloittedeloitte.com
Deloitte's API program shows strength in basic docs reachability and crawlability, but has critical gaps in two areas that directly undermine partner success: the API contract itself lacks the schema depth, security definitions, and realistic examples that partners and their AI agents need to build confidently, and the overall developer experience — from self-service onboarding to runnable, agent-parseable documentation — is nearly absent. Closing these gaps should be the immediate priority, followed by making APIs discoverable and actionable for the AI agents that partners increasingly rely on to accelerate integration work.
API DesignA clean, typed, well-governed API contract agents can reason about0 pass0 warn3 fail40F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| fail | Schema coverage & depthvia sdk | 0/25 | no .d.ts found. Investigated: sdk 0%. | Typed, complete request/response schemas are what make agent function-calling possible. |
| fail | Security & governance hygienevia wellknown | 0/15 | No security.txt at /.well-known/security.txt or /security.txt. Investigated: wellknown 0%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| fail | Example coveragevia docs | 0/10 | No detectable code samples across 1 sampled docs pages. Investigated: docs 0%, sdk 0%. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
| na | Machine-readable, versioned contract | —/25 | No surface produced evidence for this capability in this run. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| na | Auth declared & discoverable | —/25 | No surface produced evidence for this capability in this run. | Agents can only authenticate when auth is declared, scoped, and discoverable. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples0 pass1 warn2 fail44F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Quickstart presentvia docs | 12.5/25 | Quickstart page reachable (12 variants scanned starting at https://login.microsoftonline.com/36da45f1-dd2c-4d1f-af13-5abe46b99921/oauth2/v2.0/authorize?response_type=code&client_id=0d544493-b626-4196-bf78-3381c7422537&redirect_uri=https%3A%2F%2Fdeveloper.deloitte.com%2F_auth%2Foidc&scope=openid%20email%20profile&state=eyJyZWRpcmVjdFRvIjoiaHR0cHM6Ly9kZXZlbG9wZXIuZGVsb2l0dGUuY29tL3F1aWNrc3RhcnQiLCJub25jZSI6IjMwY2EzYmJkNzgwMzE4MDdlMzkxNjI2ZjMxYWExMTc3ZGYzNThkNzgifQ%3D%3D&login_hint=&audience=&nonce=dbcc183f-19ce-44ea-93b9-3674a57cd7e5) but no runnable code sample detected in HTML or .md variant. Investigated: docs 50%. | A quickstart is the fastest path from landing page to first successful call. |
| fail | Self-service developer portalvia docs | 0/29 | No self-service signup detected: no signup link found on the homepage or docs, and no conventional signup path (/signup, /sign-up, /register, /get-started, /console/signup, /dashboard/signup, /try, /try-free, /free, /free-trial, /start, /start-free, /join, /create-account, /account/signup, /auth/signup, /users/sign_up) resolved. Investigated: docs 0%. | Self-serve key/account creation is the fast first call for partners, with no sales gate. |
| fail | Code samples in docsvia docs | 0/18 | No detectable code samples across 1 sampled docs pages. Investigated: docs 0%. | Multi-language samples shorten time-to-first-call. |
| na | Description completeness | —/15 | No surface produced evidence for this capability in this run. | Complete descriptions are the context humans and agents need to use endpoints. |
| na | Changelog published | —/13 | No surface produced evidence for this capability in this run. | A published changelog lets partners track changes without surprise. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs0 pass4 warn0 fail53D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Registry & SDK presencevia sdk | 14/28 | No official SDKs discovered via npm, PyPI, or GitHub. Investigated: sdk 50%, docs 0%, cli 0%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| warn | llms.txt present, valid & comprehensivevia docs | 10/30 | No llms.txt found at any candidate location (https://developer.deloitte.com/llms.txt, https://developer.deloitte.com/docs/llms.txt); candidates redirected cross-host to https://login.microsoftonline.com (agents can't follow cross-host redirects). Investigated: docs 33%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| warn | Crawlable / AEOvia wellknown | 9/12 | Sitemap present (0 entries) but carries no lastmod values. Investigated: wellknown 75%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
| warn | Docs reachable, not hard auth-gatedvia docs | 3/30 | All 1 pages require authentication. Investigated: docs 10%. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs0 pass1 warn2 fail55D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Agent-navigable, token-efficient docsvia docs | 15.7/22 | No pages support .md URLs (0/1 tested). Investigated: docs 71%. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| fail | Agent instructions file (AGENTS.md)via wellknown | 0/10 | No AGENTS.md at the site root or /.well-known/. Investigated: wellknown 0%. | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| fail | Docs structured datavia docs | 0/8 | Neither JSON-LD nor OpenGraph/meta tags detected across 1 assessed pages (1 JS-rendered). Investigated: docs 0%. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| na | Machine-readable errors (RFC 9457) | —/28 | No surface produced evidence for this capability in this run. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| na | Operation purpose clarity | —/25 | No surface produced evidence for this capability in this run. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| na | Description consistency across surfaces | —/7 | Only 1 surface description(s) with ≥6 tokens available; need at least 2 to compare. | Every surface tells the same story about what the product is. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them0 pass0 warn1 fail40F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| fail | Runnable collection with test scriptsvia platform | 0/9 | No public Postman workspace discovered for the org. Investigated: platform 0%. | A public, maintained collection with assertions is runnable truth agents validate against. |
| na | Idempotency documented | —/27 | No surface produced evidence for this capability in this run. | Documented idempotency lets agents retry safely. |
| na | Rate-limit signaling | —/22 | No surface produced evidence for this capability in this run. | Machine-readable rate-limit headers let agents throttle adaptively. |
| na | Pagination documented & consistent | —/22 | No surface produced evidence for this capability in this run. | Consistent, documented pagination lets agents traverse collections. |
| na | Sandbox separation | —/20 | No surface produced evidence for this capability in this run. | An isolated environment lets agents exercise destructive operations safely. |