Bynder API Compliance Scorecard

❌ Scorecard: `analytics-api`

Overall compliance: 51.4% — Non-Compliant
Spec: apis/analytics-api/openapi.yaml
Structural validity (OpenAPI 3.x): ✅ valid

Category summary

Category	Score	Status	Failing rules
Base URL & Versioning	66.7%	❌	1
Resource Naming Conventions	42.9%	❌	3
Custom (RPC-style) Methods	0.0%	❌	1
HTTP Methods & Status Codes	66.7%	❌	1
Pagination	0.0%	❌	2
Sorting	100.0%	✅	0

Rule results

Rule	Severity	Result	Findings	Kong recipe	Verdict
`bynder-server-https-api-prefix`	error	❌ fail	1	—	bynder-only
`bynder-major-version-in-path`	error	✅ pass	0	URL Versioning	conflicts
`bynder-no-semver-in-path`	error	✅ pass	0	URL Versioning	partial
`bynder-path-lowercase-hyphens`	error	❌ fail	3	OAS Recommended	bynder-only
`bynder-no-trailing-slash`	error	✅ pass	0	—	bynder-only
`bynder-no-file-extension`	error	❌ fail	3	—	bynder-only
`bynder-no-reserved-segments`	error	✅ pass	0	—	bynder-only
`bynder-no-verbs-in-resource-paths`	warn	❌ fail	2	—	bynder-only
`bynder-custom-method-uses-post`	warn	❌ fail	1	—	bynder-only
`bynder-post-has-201`	hint	✅ pass	0	Documentation	covered
`bynder-delete-has-204`	hint	✅ pass	0	Documentation	covered
`bynder-documents-400`	hint	❌ fail	26	Documentation	covered
`bynder-collection-pagination-params`	warn	❌ fail	22	—	bynder-only
`bynder-limit-has-default-and-max`	hint	❌ fail	24	—	bynder-only
`bynder-sort-param-is-string`	hint	✅ pass	0	—	bynder-only

Violation details

bynder-server-https-api-prefix (error)

"https://{your-bynder-domain}" must match the pattern "^https://^/+/api(/|$)"

bynder-path-lowercase-hyphens (error)

Path '/v7/analytics/api/v1/search/keyword.csv must use lowercase letters, digits and hyphens only in each segment (no uppercase, no underscores).
Path '/v7/analytics/api/v1/collection/views.csv must use lowercase letters, digits and hyphens only in each segment (no uppercase, no underscores).
Path '/v7/analytics/api/v1/historical/{year}.csv must use lowercase letters, digits and hyphens only in each segment (no uppercase, no underscores).

bynder-no-file-extension (error)

Path '/v7/analytics/api/v1/search/keyword.csv must not contain a file extension; rely on Content-Type negotiation.
Path '/v7/analytics/api/v1/collection/views.csv must not contain a file extension; rely on Content-Type negotiation.
Path '/v7/analytics/api/v1/historical/{year}.csv must not contain a file extension; rely on Content-Type negotiation.

bynder-no-verbs-in-resource-paths (warn)

Path '/v7/analytics/api/v1/asset/create appears to contain a verb segment. Resource paths should use nouns; intentional actions must follow the custom-method pattern.
Path '/v7/analytics/api/v1/asset/remove appears to contain a verb segment. Resource paths should use nouns; intentional actions must follow the custom-method pattern.

bynder-custom-method-uses-post (warn)

Custom-method path '/v7/analytics/api/v1/asset/archive should be exposed via POST (custom methods default to POST for mutations/side effects).

bynder-documents-400 (hint)

/v7/analytics/api/v2/asset/views (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/asset/downloads (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/asset/creations (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/asset/removes (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/asset/archives (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/asset/deletions (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/asset/view (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/asset/download (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/asset/v2/download (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/asset/create (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/asset/archive (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/asset/remove (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/asset/{assetId} (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/search/executions (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/search/keyword (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/search/keyword.csv (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/user/login (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/user/{userId} (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/user/logins (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/user/creations (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/collection/views (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/collection/views.csv (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v2/collection/views (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/report/asset (responses400) should document a 400 Bad Request response.
/v7/analytics/api/v1/report/asset/{assetId} (responses400) should document a 400 Bad Request response.
…and 1 more

bynder-collection-pagination-params (warn)

Collection GET /v7/analytics/api/v2/asset/views should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/asset/downloads should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/asset/creations should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/asset/removes should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/asset/archives should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/asset/deletions should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/asset/view should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/asset/download should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/asset/v2/download should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/asset/create should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/asset/archive should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/asset/remove should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/search/executions should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/search/keyword should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/search/keyword.csv should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/user/login should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/user/logins should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/user/creations should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/collection/views should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/collection/views.csv should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v2/collection/views should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
Collection GET /v7/analytics/api/v1/report/asset should expose optional 'start' and 'limit' query parameters for cursor-based pagination.

bynder-limit-has-default-and-max (hint)

The 'limit' parameter on /v7/analytics/api/v2/asset/views should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/asset/downloads should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/asset/creations should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/asset/removes should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/asset/archives should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/asset/deletions should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/asset/view should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/asset/download should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/asset/v2/download should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/asset/create should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/asset/archive should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/asset/remove should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/asset/{assetId} should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/search/executions should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/search/keyword should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/search/keyword.csv should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/user/login should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/user/{userId} should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/user/logins should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/user/creations should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/collection/views should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/collection/views.csv should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v2/collection/views should define both a schema.default and schema.maximum.
The 'limit' parameter on /v7/analytics/api/v1/report/asset should define both a schema.default and schema.maximum.

Other lint findings (outside Bynder ruleset)

info-contact: 1
info-description: 1
oas3-operation-security-defined: 2
oas3-schema: 4
oas3-server-variables: 1
oas3-valid-media-example: 19
oas3-valid-schema-example: 4
operation-description: 13
operation-operationId: 26

Kong scorecard configuration

Attach standards/bynder-api-standards.spectral.yaml as a custom ruleset on the Lint API Specs criterion. Recommended built-in recipes:

✅ Enable OWASP Top 10 — Security checks, fully complementary — no overlap or conflict.
✅ Enable Documentation — Reinforces the response-code and description hints.
❌ Do not enable URL Versioning — Its core rule (no-path-versioning) demands the version live in the server URL, which directly conflicts with the Bynder path-versioning standard (/api/1/...).

❌ Scorecard: analytics-api