---
title: "Bynder API Compliance Scorecard"
url: "https://earlyaccess.developers.bynder.com/apis/analytics-api/docs/compliance-scorecard"
image: "https://earlyaccess.developers.bynder.com/_og/d/c_Ocean.takumi,title_Bynder+API+Compliance+Scorecard,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMxMjZERkUifX19,p_Ii9hcGlzL2FuYWx5dGljcy1hcGkvZG9jcy9jb21wbGlhbmNlLXNjb3JlY2FyZCI,s_tyXPmuc3BLXmWI-D.png"
---

## [❌ Scorecard: `analytics-api`](#scorecard-analytics-api)

**Overall compliance:** 51.4% — **Non-Compliant**  
**Spec:** `apis/analytics-api/openapi.yaml`  
**Structural validity (OpenAPI 3.x):** ✅ valid

### [Category summary](#category-summary)

| Category                    | Score  | Status | Failing rules |
| :-------------------------- | :----- | :----- | :------------ |
| Base URL & Versioning       | 66.7%  | ❌      | 1             |
| Resource Naming Conventions | 42.9%  | ❌      | 3             |
| Custom (RPC-style) Methods  | 0.0%   | ❌      | 1             |
| HTTP Methods & Status Codes | 66.7%  | ❌      | 1             |
| Pagination                  | 0.0%   | ❌      | 2             |
| Sorting                     | 100.0% | ✅      | 0             |

### [Rule results](#rule-results)

| Rule                                | Severity | Result | Findings | Kong recipe     | Verdict     |
| :---------------------------------- | :------- | :----- | :------- | :-------------- | :---------- |
| bynder-server-https-api-prefix      | error    | ❌ fail | 1        | —               | bynder-only |
| bynder-major-version-in-path        | error    | ✅ pass | 0        | URL Versioning  | conflicts   |
| bynder-no-semver-in-path            | error    | ✅ pass | 0        | URL Versioning  | partial     |
| bynder-path-lowercase-hyphens       | error    | ❌ fail | 3        | OAS Recommended | bynder-only |
| bynder-no-trailing-slash            | error    | ✅ pass | 0        | —               | bynder-only |
| bynder-no-file-extension            | error    | ❌ fail | 3        | —               | bynder-only |
| bynder-no-reserved-segments         | error    | ✅ pass | 0        | —               | bynder-only |
| bynder-no-verbs-in-resource-paths   | warn     | ❌ fail | 2        | —               | bynder-only |
| bynder-custom-method-uses-post      | warn     | ❌ fail | 1        | —               | bynder-only |
| bynder-post-has-201                 | hint     | ✅ pass | 0        | Documentation   | covered     |
| bynder-delete-has-204               | hint     | ✅ pass | 0        | Documentation   | covered     |
| bynder-documents-400                | hint     | ❌ fail | 26       | Documentation   | covered     |
| bynder-collection-pagination-params | warn     | ❌ fail | 22       | —               | bynder-only |
| bynder-limit-has-default-and-max    | hint     | ❌ fail | 24       | —               | bynder-only |
| bynder-sort-param-is-string         | hint     | ✅ pass | 0        | —               | bynder-only |

### [Violation details](#violation-details)

**`bynder-server-https-api-prefix`** (error)

-   "https://{your-bynder-domain}" must match the pattern "^https://^/+/api(/|$)"

**`bynder-path-lowercase-hyphens`** (error)

-   Path '/v7/analytics/api/v1/search/keyword.csv must use lowercase letters, digits and hyphens only in each segment (no uppercase, no underscores).
-   Path '/v7/analytics/api/v1/collection/views.csv must use lowercase letters, digits and hyphens only in each segment (no uppercase, no underscores).
-   Path '/v7/analytics/api/v1/historical/{year}.csv must use lowercase letters, digits and hyphens only in each segment (no uppercase, no underscores).

**`bynder-no-file-extension`** (error)

-   Path '/v7/analytics/api/v1/search/keyword.csv must not contain a file extension; rely on Content-Type negotiation.
-   Path '/v7/analytics/api/v1/collection/views.csv must not contain a file extension; rely on Content-Type negotiation.
-   Path '/v7/analytics/api/v1/historical/{year}.csv must not contain a file extension; rely on Content-Type negotiation.

**`bynder-no-verbs-in-resource-paths`** (warn)

-   Path '/v7/analytics/api/v1/asset/create appears to contain a verb segment. Resource paths should use nouns; intentional actions must follow the custom-method pattern.
-   Path '/v7/analytics/api/v1/asset/remove appears to contain a verb segment. Resource paths should use nouns; intentional actions must follow the custom-method pattern.

**`bynder-custom-method-uses-post`** (warn)

-   Custom-method path '/v7/analytics/api/v1/asset/archive should be exposed via POST (custom methods default to POST for mutations/side effects).

**`bynder-documents-400`** (hint)

-   /v7/analytics/api/v2/asset/views (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/asset/downloads (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/asset/creations (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/asset/removes (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/asset/archives (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/asset/deletions (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/asset/view (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/asset/download (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/asset/v2/download (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/asset/create (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/asset/archive (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/asset/remove (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/asset/{assetId} (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/search/executions (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/search/keyword (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/search/keyword.csv (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/user/login (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/user/{userId} (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/user/logins (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/user/creations (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/collection/views (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/collection/views.csv (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v2/collection/views (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/report/asset (responses400) should document a 400 Bad Request response.
-   /v7/analytics/api/v1/report/asset/{assetId} (responses400) should document a 400 Bad Request response.
-   …and 1 more

**`bynder-collection-pagination-params`** (warn)

-   Collection GET /v7/analytics/api/v2/asset/views should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/asset/downloads should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/asset/creations should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/asset/removes should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/asset/archives should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/asset/deletions should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/asset/view should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/asset/download should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/asset/v2/download should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/asset/create should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/asset/archive should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/asset/remove should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/search/executions should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/search/keyword should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/search/keyword.csv should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/user/login should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/user/logins should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/user/creations should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/collection/views should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/collection/views.csv should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v2/collection/views should expose optional 'start' and 'limit' query parameters for cursor-based pagination.
-   Collection GET /v7/analytics/api/v1/report/asset should expose optional 'start' and 'limit' query parameters for cursor-based pagination.

**`bynder-limit-has-default-and-max`** (hint)

-   The 'limit' parameter on /v7/analytics/api/v2/asset/views should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/asset/downloads should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/asset/creations should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/asset/removes should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/asset/archives should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/asset/deletions should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/asset/view should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/asset/download should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/asset/v2/download should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/asset/create should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/asset/archive should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/asset/remove should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/asset/{assetId} should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/search/executions should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/search/keyword should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/search/keyword.csv should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/user/login should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/user/{userId} should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/user/logins should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/user/creations should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/collection/views should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/collection/views.csv should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v2/collection/views should define both a schema.default and schema.maximum.
-   The 'limit' parameter on /v7/analytics/api/v1/report/asset should define both a schema.default and schema.maximum.

### [Other lint findings (outside Bynder ruleset)](#other-lint-findings-outside-bynder-ruleset)

-   `info-contact`: 1
-   `info-description`: 1
-   `oas3-operation-security-defined`: 2
-   `oas3-schema`: 4
-   `oas3-server-variables`: 1
-   `oas3-valid-media-example`: 19
-   `oas3-valid-schema-example`: 4
-   `operation-description`: 13
-   `operation-operationId`: 26

### [Kong scorecard configuration](#kong-scorecard-configuration)

Attach `standards/bynder-api-standards.spectral.yaml` as a custom ruleset on the **Lint API Specs** criterion. Recommended built-in recipes:

-   ✅ **Enable OWASP Top 10** — Security checks, fully complementary — no overlap or conflict.
-   ✅ **Enable Documentation** — Reinforces the response-code and description hints.
-   ❌ **Do not enable URL Versioning** — Its core rule (no-path-versioning) demands the version live in the server URL, which directly conflicts with the Bynder path-versioning standard (/api/1/...).