Enable Banking is Poor to agents.
Discry independently scored how well an AI agent can discover and understand the Enable Banking API from what’s public — not whether it’s usable. Below: every signal we checked, what’s costing the score, and what to change.
SCORED UNDER RUBRIC 1.2 · A full re-launch under Discry Score 2.5 — a new behavioral instrument, not comparable to these scores — is in progress.
Discovery
45% of score · 24/100Comprehension
55% of score · 85/100What we found
- An agent trying to DISCOVER this API programmatically hits a wall: there is no robots.txt (HTTP 404), no llms.txt, no llms-full.txt, no .well-known/mcp.json, and no AGENTS.md in the GitHub org — none of the machine-readable discovery surfaces an agent would probe first exist.
- Once an agent REACHES the docs, comprehension is strong: the reference is a cleanly structured single page (H1 sections -> H2 endpoints -> H3 Parameters/Responses) where every endpoint leads with its method and path, uses consistent snake_case, and documents a standardized ErrorResponse JSON with named, described error codes.
- The Quick Start reads like an agent runbook: it chains the full account-information flow (list ASPSPs -> start auth -> authorize session -> fetch balances -> fetch transactions) and the full payment flow end-to-end, with realistic, copy-pasteable Python AND JavaScript examples using plausible IBANs, amounts, and dates.
- No downloadable OpenAPI/Swagger spec is exposed for the main aggregation API (api.enablebanking.com) — the reference is HTML-rendered from an underlying spec but an agent cannot fetch openapi.json/yaml. A separate eidas_broker microservice repo publishes an openapi.json, and a Jentic auto-import issue exists, but neither gives an agent the core API contract as structured data.
- Capability boundaries are unusually well documented for this category: a dedicated Limitations section (Mock ASPSP has no payment initiation; transactions batch in 10s; sandbox filtering unsupported except Nordea/Handelsbanken) plus explicit rate-limit and sandbox-instability caveats mean an agent learns key constraints from docs rather than by failing.
What to change
Prioritized by impact on discoverability. You (or your docs platform) deploy these — Discry never touches your API.
- 01Add an llms.txt at the domain root pointing to the Quick Start, API reference, sandbox, and error-code sections — this is the single highest-leverage discovery fix and would let agents orient in under 5,000 tokens instead of parsing a 196KB HTML reference.
- 02Publish a downloadable OpenAPI 3.x spec (openapi.json / openapi.yaml) for the main aggregation API at a stable, linked path in the reference — the doc is already spec-generated, so exposing the source contract turns openApiSpec from partial to pass and unlocks automatic client/tool generation.
- 03Add a robots.txt that explicitly allows GPTBot, ClaudeBot, Google-Extended, and CCBot (and re-list the docs sitemap) — right now the 404 gives crawling agents no signal at all.
- 04Upgrade error documentation from 'what went wrong' to 'what to do next': add Retry-After / rate-limit-header names and per-error recovery guidance (e.g. what to do on EXPIRED_SESSION, DATE_FROM_IN_FUTURE, ASPSP_RATE_LIMIT_EXCEEDED) so an agent can self-correct instead of stalling.
- 05Add an AGENTS.md to the enablebanking-api-samples repo summarizing the auth model, base URL, core flows, and gotchas, and publish or endorse a first-party MCP server so the API appears in Glama/Smithery/PulseMCP under its own name rather than only inside a third-party wrapper.
Execution coverage · INFORMATIONAL, UNSCORED
Whether an agent can actually complete a call and recover from errors is the deeper Audit layer — documented here, but not part of the Discry Score.
Auth is a two-layer model: the application signs every request with an RS256 JWT built from a per-app private key, and end-user access is granted through an OAuth 2.0 redirect flow to the ASPSP. Errors are returned in a documented, machine-parseable ErrorResponse JSON (message, numeric code = HTTP status, text error code from a named ErrorCode enum, and a detail field), with per-endpoint status tables (400/401/403/404/408/422/429/500) and a rich named error-code table with human-readable descriptions. Rate limiting is acknowledged (429 Too Many Requests documented; ASPSP_RATE_LIMIT_EXCEEDED error code) though no numeric limits or Retry-After header names are specified. Transaction listing is paginated via an opaque continuation_key. Idempotency keys are not documented. An agent could parse errors reliably but would not know retry timing or how to make payment creation idempotent without live testing.