Isbankisbank.com.tr
Isbank's API program has a solid machine-readable contract as its foundation, but two critical gaps are blocking partner and agent adoption at scale. The developer experience is severely undermined by missing descriptions, no changelog, and no self-service onboarding path — partners cannot evaluate or integrate without direct engagement.
API DesignA clean, typed, well-governed API contract agents can reason about2 pass2 warn1 fail79B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Auth declared & discoverablevia spec | 25/25 | Authentication is required across the API (declared globally or on every operation), so an agent knows credentials are needed. Investigated: spec 100%, docs 100%. | Agents can only call an API when they can determine its auth posture — a declared scheme, or an explicit statement that none is required. |
| warn | Machine-readable, versioned contractvia spec | 18.8/25 | The API sets a version ("4.1.3") but exposes no versioning scheme in the URL, a header, or the media type, so an agent can't pin to a specific version. Investigated: spec 75%, docs 50%. Fix: Pick a versioning scheme (URL path /v1/, Accept: application/vnd.x+json, or a version header) and apply it consistently. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| warn | Schema coverage & depthvia spec | 16.7/25 | Only 86% of the 77 operations document both request and response schemas (target 95%+), so an agent can't reliably call the rest. Investigated: spec 67%. Fix: Document request body and 2xx response schemas for every non-deprecated operation. | Typed, complete request/response schemas are what make agent function-calling possible. |
| pass | Security & governance hygienevia spec | 15/15 | No credential-shaped strings detected in spec. Investigated: spec 100%, wellknown 0%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| fail | Example coveragevia spec | 0/10 | Only 0% of parameters and responses (0 of 1179) include example values, so an agent has little grounding in real payload shapes. Investigated: spec 0%, docs 0%. Fix: Add example values to parameters and response schemas — examples carry shape semantics schemas under-specify. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples0 pass1 warn4 fail43F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Quickstart presentvia docs | 12.5/25 | Quickstart page is reachable at https://developer.sandbox.isbank.com.tr/tr/all-apis/quickstart (24 variants scanned) but has no runnable code sample in its HTML or .md variant, so there's nothing to copy and run. Investigated: docs 50%. Fix: Add a copy-pasteable curl or SDK call, with the expected response, to the quickstart page (or its .md variant). | A quickstart is the fastest path from landing page to first successful call. |
| fail | Self-service developer portalvia docs | 0/29 | No self-service signup detected — no signup link on the homepage or docs, and no conventional signup path (/signup, /sign-up, /register, /get-started, /console/signup, /dashboard/signup, /try, /try-free, /free, /free-trial, /start, /start-free, /join, /create-account, /account/signup, /auth/signup, /users/sign_up) resolved — so an agent can't onboard on its own. Investigated: docs 0%. Fix: Publish a public signup endpoint and link it from your homepage/docs to compress time-to-first-call. | A first call without a human in the loop — self-serve credentials, a free tier, or an API that needs none. |
| fail | Code samples in docsvia docs | 0/18 | No code samples detected across 20 sampled docs pages, so a coding agent gets no ready-to-use examples. Investigated: docs 0%. Fix: Add copy-pasteable code samples to API reference and quickstart pages. | Multi-language samples shorten time-to-first-call. |
| fail | Description completenessvia spec | 0/15 | Only 45% of operations and parameters have descriptions (0 of 77 ops, 385 of 431 params), leaving an agent to guess what most endpoints do. Investigated: spec 0%. Fix: Descriptions are the primary semantic signal agents use for tool selection. Each operation should explain what it does and reference its parameters; each parameter needs a real description. | Complete descriptions are the context humans and agents need to use endpoints. |
| fail | Changelog publishedvia spec | 0/13 | No changelog link or mention appears in the spec, so an agent can't tell what changed before something breaks. Investigated: spec 0%, docs 0%. Fix: Publish a structured changelog (e.g., /changelog.json or releases.atom) and reference it in info or externalDocs. | A published changelog lets partners track changes without surprise. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs1 pass2 warn1 fail54D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Docs reachable, not hard auth-gatedvia docs | 15/30 | 50 of 50 sampled pages return 200 for non-existent URLs (soft 404). Investigated: docs 50%. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
| pass | Crawlable / AEOvia wellknown | 12/12 | robots.txt lets all monitored AI crawlers reach the docs paths. Investigated: wellknown 100%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
| warn | llms.txt present, valid & comprehensivevia docs | 10/30 | No llms.txt found at any candidate location (https://developer.sandbox.isbank.com.tr/tr/all-apis/llms.txt, https://developer.sandbox.isbank.com.tr/llms.txt, https://developer.sandbox.isbank.com.tr/docs/llms.txt). Investigated: docs 33%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| fail | Registry & SDK presencevia docs | 0/28 | Not indexed on Context7 — agents can't pull this API's docs on demand via Context7. Investigated: docs 0%, sdk 0%, cli 0%. Fix: Submit the docs to context7.com so coding agents can retrieve up-to-date docs on demand. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs1 pass2 warn2 fail62C
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Machine-readable errors (RFC 9457)via docs | 28/28 | Documents 8 distinct 4xx/5xx error response codes, so an agent can branch on specific failures instead of guessing. Investigated: docs 100%, spec 50%. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| warn | Agent-navigable, token-efficient docsvia docs | 15.7/22 | No sampled pages support .md URLs (0/50 tested). Investigated: docs 71%. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| warn | Docs structured datavia docs | 4/8 | Only OpenGraph/meta tags across 3 assessed pages — no JSON-LD for AI answer engines to cite. Investigated: docs 50%. Fix: Emit JSON-LD with Article/TechArticle @type and dateModified in the rendered docs head. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| fail | Operation purpose clarityvia spec | 0/25 | Only 0% of operations (0 of 77) have a clear summary plus descriptive name, so an agent must guess purpose from the URL path for most. Investigated: spec 0%. Fix: Operations without a summary or operationId force agents to guess purpose from the path. Add a concise summary + descriptive operationId to each. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| fail | Agent instructions file (AGENTS.md)via wellknown | 0/10 | No AGENTS.md at the site root or /.well-known/, so coding agents have no ready-made setup and usage instructions. Investigated: wellknown 0%. Fix: Publish an AGENTS.md with setup, auth, and usage instructions a coding agent can follow. | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| na | Description consistency across surfaces | —/7 | Only 1 surface description(s) with ≥6 tokens available; need at least 2 to compare. | Every surface tells the same story about what the product is. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them1 pass0 warn3 fail48F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Sandbox separationvia spec | 20/20 | sandbox is documented on the docs site at https://developer.sandbox.isbank.com.tr/tr/all-apis/sandbox, even though it isn't declared in the API spec. Investigated: spec 100%, docs 100%. | An isolated environment lets agents exercise destructive operations safely. |
| fail | Idempotency documentedvia spec | 0/27 | Only 0% of mutating operations (0 of 45) document idempotency, so an agent's retries can create duplicate writes. Investigated: spec 0%, docs 0%. Fix: Agents retry on failure; without idempotency, retries create duplicates. Document Idempotency-Key on every POST/PUT/PATCH/DELETE. | Documented idempotency lets agents retry safely. |
| fail | Rate-limit signalingvia spec | 0/22 | No rate-limit response headers are documented, so an agent can't tell when it is approaching a limit and will get throttled. Investigated: spec 0%, docs 0%. Fix: Add x-ratelimit-* response headers and document retry-after semantics. | Machine-readable rate-limit headers let agents throttle adaptively. |
| fail | Runnable collection with test scriptsvia platform | 0/9 | No public Postman workspace found for the org, so there's no runnable collection an agent can execute against. Investigated: platform 0%. Fix: Publish at least one public Postman workspace and link it from your developer portal so agents can use Run-in-Postman. | A public, maintained collection with assertions is runnable truth agents validate against. |
| na | Pagination documented & consistent | —/22 | No surface produced evidence for this capability in this run. | Consistent, documented pagination lets agents traverse collections. |
Resources Discovered
The public resources we found for Isbank — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| APIs analyzed | 1 — ApiDeveloperPortalBFF API |
|---|