Usbankusbank.com

ScoredNov 6, 2026, 06:00 PM

US Bank's API program shows strength in agent discoverability — crawlability and registry presence are holding up — but two areas are putting partner momentum at risk. First, there are no code samples anywhere in the documentation, meaning partners and their coding agents have nothing concrete to build against and must guess at integration patterns from scratch.

API DesignA clean, typed, well-governed API contract agents can reason about0 pass0 warn2 fail40F

Signal	Points	Findings	Rationale
Security & governance hygienevia wellknown	0/15	No security.txt found at /.well-known/security.txt or /security.txt, so there's no machine-readable security contact for agents or researchers. Investigated: wellknown 0%. Fix: Publish an RFC 9116 security.txt with a Contact line and a future Expires date.	No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel.
Example coveragevia docs	0/10	No code samples detected across 1 sampled docs pages, so a coding agent gets no ready-to-use examples. Investigated: docs 0%. Fix: Add copy-pasteable code samples to API reference and quickstart pages.	Examples carry shape semantics schemas under-specify — for humans and agents alike.
Machine-readable, versioned contract	—/25	No surface produced evidence for this capability in this run.	A current OpenAPI version with a declared versioning scheme lets agents reason about the contract.
Schema coverage & depth	—/25	No surface produced evidence for this capability in this run.	Typed, complete request/response schemas are what make agent function-calling possible.
Auth declared & discoverable	—/25	No surface produced evidence for this capability in this run.	Agents can only call an API when they can determine its auth posture — a declared scheme, or an explicit statement that none is required.

Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples1 pass1 warn1 fail66C

Signal	Points	Findings	Rationale
Self-service developer portalvia docs	29/29	Self-service signup available at https://mortgageapply.usbank.com/, with a free tier or sandbox documented — an agent can onboard without contacting sales. Investigated: docs 100%.	A first call without a human in the loop — self-serve credentials, a free tier, or an API that needs none.
Quickstart presentvia docs	12.5/25	Quickstart page is reachable at https://developer.usbank.com/quickstart (18 variants scanned) but has no runnable code sample in its HTML or .md variant, so there's nothing to copy and run. Investigated: docs 50%. Fix: Add a copy-pasteable curl or SDK call, with the expected response, to the quickstart page (or its .md variant).	A quickstart is the fastest path from landing page to first successful call.
Code samples in docsvia docs	0/18	No code samples detected across 1 sampled docs pages, so a coding agent gets no ready-to-use examples. Investigated: docs 0%. Fix: Add copy-pasteable code samples to API reference and quickstart pages.	Multi-language samples shorten time-to-first-call.
Description completeness	—/15	No surface produced evidence for this capability in this run.	Complete descriptions are the context humans and agents need to use endpoints.
Changelog published	—/13	No surface produced evidence for this capability in this run.	A published changelog lets partners track changes without surprise.

Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs1 pass3 warn0 fail74B

Signal	Points	Findings	Rationale
Docs reachable, not hard auth-gatedvia docs	30/30	All 1 pages are publicly accessible. Investigated: docs 100%.	Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics.
llms.txt present, valid & comprehensivevia docs	15/30	No llms.txt found at any candidate location (https://developer.usbank.com/llms.txt, https://developer.usbank.com/docs/llms.txt). Investigated: docs 50%.	A valid, comprehensive llms.txt is the machine-readable entry point for agents.
Registry & SDK presencevia sdk	14/28	Official SDKs found in only 1 language(s); at least 3 is the target for broad agent coverage. Investigated: sdk 50%, docs 0%, cli 0%. Fix: Publish official SDKs for at least three of: JavaScript/TypeScript, Python, Go, Ruby, Java.	Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look.
Crawlable / AEOvia wellknown	9/12	Sitemap has 0 entries but no lastmod values, so crawlers can't tell what changed recently. Investigated: wellknown 75%. Fix: Add accurate <lastmod> values to sitemap entries — AI-powered search uses them to prioritize crawling.	Bots allowed plus a fresh sitemap make docs findable by agent crawlers.

Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs1 pass0 warn2 fail64C

Signal	Points	Findings	Rationale
Agent-navigable, token-efficient docsvia docs	22/22	No tabbed content found; header quality check not applicable. Investigated: docs 100%.	Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly.
Agent instructions file (AGENTS.md)via wellknown	0/10	No AGENTS.md at the site root or /.well-known/, so coding agents have no ready-made setup and usage instructions. Investigated: wellknown 0%. Fix: Publish an AGENTS.md with setup, auth, and usage instructions a coding agent can follow.	An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index.
Docs structured datavia docs	0/8	No JSON-LD or OpenGraph/meta tags found across 1 assessed pages (1 JS-rendered), so answer engines have nothing to cite. Investigated: docs 0%. Fix: Server-render structured data (JSON-LD) so AI answer engines can cite your docs.	Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed.
Machine-readable errors (RFC 9457)	—/28	No surface produced evidence for this capability in this run.	RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens.
Operation purpose clarity	—/25	No surface produced evidence for this capability in this run.	Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice.
Description consistency across surfaces	—/7	Only 0 surface description(s) with ≥6 tokens available; need at least 2 to compare.	Every surface tells the same story about what the product is.

Agent UsabilityAgents have the context to use your APIs reliably, not just find them0 pass0 warn1 fail40F

Signal	Points	Findings	Rationale
Runnable collection with test scriptsvia platform	0/9	No public Postman workspace found for the org, so there's no runnable collection an agent can execute against. Investigated: platform 0%. Fix: Publish at least one public Postman workspace and link it from your developer portal so agents can use Run-in-Postman.	A public, maintained collection with assertions is runnable truth agents validate against.
Idempotency documented	—/27	No surface produced evidence for this capability in this run.	Documented idempotency lets agents retry safely.
Rate-limit signaling	—/22	No surface produced evidence for this capability in this run.	Machine-readable rate-limit headers let agents throttle adaptively.
Pagination documented & consistent	—/22	No surface produced evidence for this capability in this run.	Consistent, documented pagination lets agents traverse collections.
Sandbox separation	—/20	No surface produced evidence for this capability in this run.	An isolated environment lets agents exercise destructive operations safely.

Want to improve your results?