# NCSC — API Agent Score

> Score: 65/100 (Grade: C) | Domain: ncsc.gov.uk | Rubric: 1.0.0 | Checked: October 28, 2026

NCSC scored 65/100 (C), classified "partially-ready".

[View full report](https://www.postman.com/ai/ai-ready-apis/company/ncsc)
[All organizations](https://www.postman.com/ai/ai-ready-apis/llms.txt)

## Summary

- Overall: 65/100 (C)
- Classification: partially-ready

## Category Scores

- API Design: 100/100 (A+)
- Developer Experience: 64/100 (C)
- Agent Discovery: 75/100 (B)
- Agent Understanding: 69/100 (C)
- Agent Usability: 40/100 (F)

## Check Results

### API Design

- [pass] Security & governance hygiene — Valid security.txt at https://ncsc.gov.uk/.well-known/security.txt with a Contact line and an unexpired Expires date. Investigated: wellknown 100%.
- [skip] Machine-readable, versioned contract — No surface produced evidence for this capability in this run.
- [skip] Schema coverage & depth — No surface produced evidence for this capability in this run.
- [skip] Auth declared & discoverable — No surface produced evidence for this capability in this run.
- [skip] Example coverage — No surface produced evidence for this capability in this run.

### Developer Experience

- [pass] Self-service developer portal — Signup page found at https://www.ncsc.gov.uk/register/subscribe, but no free tier or sandbox is documented in docs/pricing, so an agent may hit a paywall. Investigated: docs 100%.
- [fail] Quickstart present — No quickstart or getting-started page found at the conventional docs paths, so new developers and agents have no obvious first step. Investigated: docs 0%.
- [skip] Code samples in docs — No surface produced evidence for this capability in this run.
- [skip] Description completeness — No surface produced evidence for this capability in this run.
- [skip] Changelog published — No surface produced evidence for this capability in this run.

### Agent Discovery

- [pass] Docs reachable, not hard auth-gated — All 50 sampled pages are publicly accessible. Investigated: docs 100%.
- [pass] Registry & SDK presence — Indexed on Context7 (aws-samples/landing-zone-accelerator-on-aws-for-healthcare, 47 snippets). Investigated: docs 100%, sdk 50%, cli 0%.
- [pass] Crawlable / AEO — No robots.txt on the docs host, so AI crawlers are unrestricted and can read the docs. Investigated: wellknown 100%.
- [fail] llms.txt present, valid & comprehensive — No llms.txt found at any candidate location (https://www.ncsc.gov.uk/llms.txt, https://www.ncsc.gov.uk/docs/llms.txt). Investigated: docs 0%.

### Agent Understanding

- [warn] Agent-navigable, token-efficient docs — No sampled pages support .md URLs (0/50 tested). Investigated: docs 90%.
- [fail] Agent instructions file (AGENTS.md) — No AGENTS.md at the site root or /.well-known/, so coding agents have no ready-made setup and usage instructions. Investigated: wellknown 0%.
- [skip] Machine-readable errors (RFC 9457) — No surface produced evidence for this capability in this run.
- [skip] Operation purpose clarity — No surface produced evidence for this capability in this run.
- [skip] Docs structured data — No surface produced evidence for this capability in this run.
- [skip] Description consistency across surfaces — Only 0 surface description(s) with ≥6 tokens available; need at least 2 to compare.

### Agent Usability

- [fail] Runnable collection with test scripts — No public Postman workspace found for the org, so there's no runnable collection an agent can execute against. Investigated: platform 0%.
- [skip] Idempotency documented — No surface produced evidence for this capability in this run.
- [skip] Rate-limit signaling — No surface produced evidence for this capability in this run.
- [skip] Pagination documented & consistent — No surface produced evidence for this capability in this run.
- [skip] Sandbox separation — No surface produced evidence for this capability in this run.

## Executive Summary

NCSC's API program performs well in areas where it has established structure, but two critical gaps are holding back partner and agent adoption. Agents and partners cannot discover or navigate the API surface without a machine-readable entry point, and there is no runnable, executable context for agents to build against — meaning integrations stall before they begin. The immediate priority is establishing a discoverable front door with llms.txt and agent-ready metadata, followed closely by providing runnable collections and a clear onboarding path so partners can reach their first successful call without friction.