--- name: Cardiff University description: Cardiff University public developer/API footprint review for APIs.json cataloging. url: https://raw.githubusercontent.com/api-evangelist/cardiff/refs/heads/main/review.yml created: '2026-06-03' modified: '2026-08-30' reviews: - date: '2026-06-03' rating: 3 summary: >- Cardiff University runs a real, public WSO2 API Manager developer portal at data.cardiff.ac.uk/devportal. The portal's anonymous devportal API (/api/am/devportal/v2/apis) returned a live catalog of five published APIs: Courses, Modules, Lookups, Publications and EchoTest, all served from the gateway at api.data.cardiff.ac.uk. Endpoints are OAuth2-secured (a direct call to /courses/v1 returned HTTP 401), and external developer access is granted on request via integration@cardiff.ac.uk. The marketing landing page (data.cardiff.ac.uk root) and several institutional sites (www.cardiff.ac.uk, orca.cardiff.ac.uk) bot-block automated requests with 403 but are reachable in a browser. No endpoints were fabricated; only the five APIs confirmed live in the portal catalog are cataloged. endpoints: - url: https://data.cardiff.ac.uk/devportal/ status: 200 note: Public WSO2 API Manager developer portal (SPA). - url: https://data.cardiff.ac.uk/api/am/devportal/v2/apis?limit=50 status: 200 note: Anonymous portal catalog; returned count=5 with full API metadata. - url: https://data.cardiff.ac.uk/devportal/apis/1353914a-a34a-4fb5-85ac-ef06dda0bf2b status: 200 note: Courses API portal page. - url: https://data.cardiff.ac.uk/devportal/apis/32d23956-5638-423f-8be2-01f583c407a3 status: 200 note: Publications API portal page. - url: https://api.data.cardiff.ac.uk/courses/v1/ status: 401 note: Gateway requires OAuth2 token; confirms APIs are gated, not open. - url: https://data.cardiff.ac.uk/ status: 403 note: Open Data landing page bot-blocks curl; reachable in browser. - url: https://www.cardiff.ac.uk/ status: 403 note: Official website bot-blocks automated requests; reachable in browser. - url: https://orca.cardiff.ac.uk/ status: 403 note: ORCA EPrints institutional repository; bot-blocked, OAI-PMH not verifiable via automated probe. - url: https://research-data.cardiff.ac.uk/ status: 202 note: Figshare-backed research data repository (challenge/redirect response). - date: '2026-08-30' rating: 3 summary: >- Re-review under the API Evangelist university pipeline, whose first question is not "is there a spec" but "who operates the thing the spec describes". Cardiff passes that test: all five source contracts are authored by the University and served from api.data.cardiff.ac.uk, its own WSO2 gateway on its own registrable domain, so nothing in this repo is a vendor's contract wearing Cardiff's name. Two things changed since the June review. First, the gateway and the developer portal are DOWN from outside - every path on data.cardiff.ac.uk and api.data.cardiff.ac.uk now 302-redirects to the University service-unavailable page at outage.cf.ac.uk, where in June the portal answered 200 and the gateway answered a correct 401. The IT status page carries no incident for either service, so we cannot tell maintenance from decommission and have graded every devportal pointer dead while keeping it, rather than deleting Cardiff's only documentation on one probe. Second, three institution-operated surfaces the June review did not reach were confirmed from third-party registries rather than from Cardiff's bot-blocked estate: a Shibboleth IdP registered in the UK Access Management Federation, ORCA's OAI-PMH interface registered in ROAR since 2005, and a DataCite repository client with DOI prefix 10.17035. Sixteen refined OpenAPIs that had been welded onto the wrong base path by our own refine-openapis split were re-based from their true parent contracts; that is our defect, not Cardiff's. endpoints: - url: https://api.data.cardiff.ac.uk/lookups/v1/schools status: 302 note: Redirects to http://outage.cf.ac.uk/default/ - gateway unreachable (was 401 in June). - url: https://data.cardiff.ac.uk/devportal/ status: 302 note: Redirects to the University service-unavailable page (was 200 in June). - url: http://outage.cf.ac.uk/default/ status: 200 note: Cardiff "Service unavailable" page, bilingual EN/CY, refers users to status.cardiff.ac.uk. - url: https://status.cardiff.ac.uk/api/v2/summary.json status: 200 note: Atlassian Statuspage v2 API, 40 Cardiff service components; no incident open for the gateway. - url: https://idp.cardiff.ac.uk/idp/shibboleth status: 200 note: >- Shibboleth IdP metadata endpoint, entityID https://idp.cardiff.ac.uk/shibboleth, shibmd:Scope cardiff.ac.uk. Serves the stock template text, so the curated entity is the federation aggregate's, not this endpoint's. - url: http://metadata.ukfederation.org.uk/ukfederation-metadata.xml status: 200 note: Cardiff University registered as one production IdP, one preprod IdP and four SPs. - url: https://api.datacite.org/clients/bl.cardiff status: 200 note: >- DataCite repository client "Cardiff University", prefix 10.17035, created 2015; its declared domains independently confirm both the Figshare and the Converis tenancy. - url: https://api.crossref.org/members?query=cardiff&rows=10 status: 200 note: Cardiff University Press (member 7948, prefix 10.18573) and Wales Centre for Public Policy (32732). - url: https://roar.eprints.org/957/ status: 200 note: ROAR record for ORCA - Cardiff University, EPrints, OAI-PMH base orca.cf.ac.uk/cgi/oai2. - url: https://orca.cardiff.ac.uk/cgi/oai2?verb=Identify status: 403 note: Cloudflare bot challenge. Live, not dead - robots.txt on the same host returns 200. - url: https://librarysearch.cardiff.ac.uk/ status: 200 note: Ex Libris Primo VE, vid=44WHELF_CAR:CAR - tenant, not Cardiff's engineering. - url: https://research.cardiff.ac.uk/ status: 403 note: CNAME cu.converis.clarivate.com - Clarivate Converis research portal, tenant. - url: https://research-data.cardiff.ac.uk/ status: 202 note: >- CNAME proxy-eu-01.figshare.com - Figshare for Institutions, tenant. The 202 is an AWS WAF challenge and proves nothing on its own; a non-existent .figshare.com tenant returns 202 as well, so the CNAME is the evidence. - url: https://api.github.com/orgs/ARCCA status: 200 note: Advanced Research Computing @ Cardiff University, 43 public repos - institution-operated.