---
title: "Bynder API Compliance Scorecard"
url: "https://earlyaccess.developers.bynder.com/apis/webhooks-api/docs/compliance-scorecard"
image: "https://earlyaccess.developers.bynder.com/_og/d/c_Ocean.takumi,title_Bynder+API+Compliance+Scorecard,props_eyJ0aGVtZSI6eyJtb2RlIjoibGlnaHQiLCJjb2xvcnMiOnsicHJpbWFyeSI6IiMxMjZERkUifX19,p_Ii9hcGlzL3dlYmhvb2tzLWFwaS9kb2NzL2NvbXBsaWFuY2Utc2NvcmVjYXJkIg,s_l_j-AY69fmrUgXcf.png"
---

## [⚠️ Scorecard: `webhooks-api`](#️-scorecard-webhooks-api)

**Overall compliance:** 80.0% — **Needs Improvement**  
**Spec:** `docs/openapi.yaml`  
**Structural validity (OpenAPI 3.x):** ✅ valid

### [Category summary](#category-summary)

| Category                    | Score  | Status | Failing rules |
| :-------------------------- | :----- | :----- | :------------ |
| Base URL & Versioning       | 66.7%  | ❌      | 1             |
| Resource Naming Conventions | 85.7%  | ⚠️     | 1             |
| Custom (RPC-style) Methods  | 100.0% | ✅      | 0             |
| HTTP Methods & Status Codes | 33.3%  | ❌      | 2             |
| Pagination                  | 100.0% | ✅      | 0             |
| Sorting                     | 100.0% | ✅      | 0             |

### [Rule results](#rule-results)

| Rule                                | Severity | Result | Findings | Kong recipe     | Verdict     |
| :---------------------------------- | :------- | :----- | :------- | :-------------- | :---------- |
| bynder-server-https-api-prefix      | error    | ❌ fail | 1        | —               | bynder-only |
| bynder-major-version-in-path        | error    | ✅ pass | 0        | URL Versioning  | conflicts   |
| bynder-no-semver-in-path            | error    | ✅ pass | 0        | URL Versioning  | partial     |
| bynder-path-lowercase-hyphens       | error    | ✅ pass | 0        | OAS Recommended | bynder-only |
| bynder-no-trailing-slash            | error    | ✅ pass | 0        | —               | bynder-only |
| bynder-no-file-extension            | error    | ✅ pass | 0        | —               | bynder-only |
| bynder-no-reserved-segments         | error    | ✅ pass | 0        | —               | bynder-only |
| bynder-no-verbs-in-resource-paths   | warn     | ❌ fail | 1        | —               | bynder-only |
| bynder-custom-method-uses-post      | warn     | ✅ pass | 0        | —               | bynder-only |
| bynder-post-has-201                 | hint     | ❌ fail | 1        | Documentation   | covered     |
| bynder-delete-has-204               | hint     | ❌ fail | 1        | Documentation   | covered     |
| bynder-documents-400                | hint     | ✅ pass | 0        | Documentation   | covered     |
| bynder-collection-pagination-params | warn     | ✅ pass | 0        | —               | bynder-only |
| bynder-limit-has-default-and-max    | hint     | ✅ pass | 0        | —               | bynder-only |
| bynder-sort-param-is-string         | hint     | ✅ pass | 0        | —               | bynder-only |

### [Violation details](#violation-details)

**`bynder-server-https-api-prefix`** (error)

-   "[http://0.0.0.0:8081](http://0.0.0.0:8081)" must match the pattern "^https://^/+/api(/|$)"

**`bynder-no-verbs-in-resource-paths`** (warn)

-   Path '/webhooks/api/subscriptions/list appears to contain a verb segment. Resource paths should use nouns; intentional actions must follow the custom-method pattern.

**`bynder-post-has-201`** (hint)

-   POST /webhooks/api/subscriptions should document a 201 Created response.

**`bynder-delete-has-204`** (hint)

-   DELETE /webhooks/api/subscriptions/{configId} should document a 204 No Content response.

### [Other lint findings (outside Bynder ruleset)](#other-lint-findings-outside-bynder-ruleset)

-   `info-contact`: 1
-   `info-description`: 1
-   `oas3-unused-component`: 4
-   `operation-tags`: 6

### [Kong scorecard configuration](#kong-scorecard-configuration)

Attach `standards/bynder-api-standards.spectral.yaml` as a custom ruleset on the **Lint API Specs** criterion. Recommended built-in recipes:

-   ✅ **Enable OWASP Top 10** — Security checks, fully complementary — no overlap or conflict.
-   ✅ **Enable Documentation** — Reinforces the response-code and description hints.
-   ❌ **Do not enable URL Versioning** — Its core rule (no-path-versioning) demands the version live in the server URL, which directly conflicts with the Bynder path-versioning standard (/api/1/...).