name: Loughborough University
description: Loughborough University public developer/API footprint review for APIs.json cataloging.
url: https://raw.githubusercontent.com/api-evangelist/loughborough/refs/heads/main/review.yml
created: '2026-06-03'
modified: '2026-08-30'
reviews:
- date: '2026-06-03'
  rating: 2
  summary: 'Loughborough University publishes no first-party developer portal or open-data API. Verified
    live: the official website (200), the figshare institution-scoped REST endpoint (200), the figshare
    OAI-PMH endpoint (200), and the GitHub org (200, but zero public repositories). The Shibboleth/SAML
    IdP metadata URL is referenced in documentation but returned a 500 on probe and is federation-gated,
    not a general developer resource. No endpoints were fabricated; the programmatic surface is effectively
    third-party (figshare) plus federated identity.'
  endpoints:
  - url: https://www.lboro.ac.uk/
    status: 200
    note: Official university website, resolves cleanly.
  - url: https://repository.lboro.ac.uk/
    status: 202
    note: Loughborough Research Repository, powered by figshare.
  - url: https://api.figshare.com/v2/articles?institution=2
    status: 200
    note: figshare REST API scoped to Loughborough institution; returns research outputs.
  - url: https://api.figshare.com/v2/oai?verb=Identify
    status: 200
    note: figshare OAI-PMH endpoint; Loughborough scoped via set=portal_2.
  - url: https://idp.lboro.ac.uk/simplesaml/saml2/idp/metadata.php
    status: 500
    note: Shibboleth/SAML IdP metadata; referenced in docs but errored on probe, federation-gated.
  - url: https://github.com/LoughboroughUniversity
    status: 200
    note: Official GitHub org exists but lists zero public repositories.
- date: '2026-08-30'
  rating: 3
  summary: 'University-pipeline re-profile. The June 2026 review credited Loughborough with the figshare
    institution-scoped REST API as its programmatic surface; 22 vendor surfaces on api.figshare.com had
    been saved into this repo as 10 per-tag OpenAPIs and 11 apis[] entries, with a full derived artifact
    set beneath them. All of it was removed and the repository is now recorded as ONE tenant relationship.
    In its place, seven live surfaces were found by probing lboro.ac.uk hosts
    directly: a Koha ILS REST API serving a live Swagger 2.0 description and keyless /public endpoints
    returning Loughborough''s own library records; a self-hosted Moodle running as an LTI 1.3 Advantage
    platform with a public JWKS; a VuFind Search API that is deployed but returns Permission denied; and
    a SimpleSAMLphp SAML 2.0 IdP registered in the UK Access Management Federation. The IdP metadata URL
    that errored 500 in June is live — the machine-readable copy is the federation aggregate, not the
    direct URL. Loughborough is also a DataCite member in its own right (JHAH, prefixes 10.17028 / 10.26174).
    Net effect on the composite score is expected to be DOWN: contract volume falls to zero stored specs,
    while the surfaces that remain are real.'
  endpoints:
  - url: https://koha.lboro.ac.uk/api/v1/
    status: 200
    note: Koha REST API live Swagger 2.0 description; host koha.lboro.ac.uk, 249 paths. Institution-operated.
  - url: https://koha.lboro.ac.uk/api/v1/public/libraries
    status: 200
    note: Keyless. Returns Loughborough's own branch records (London Library at Here East, ILL Service,
      library@lboro.ac.uk).
  - url: https://learn.lboro.ac.uk/mod/lti/certs.php
    status: 200
    note: Public JWKS from the self-hosted Moodle acting as an LTI 1.3 platform. One RSA RS256 key.
  - url: https://learn.lboro.ac.uk/webservice/rest/server.php
    status: 200
    note: Moodle Web Services; returns a structured moodle_exception invalidtoken without a token.
  - url: https://vufind.lboro.ac.uk/api/v1/search?lookfor=test&limit=1
    status: 403
    note: 'VuFind Search API deployed but closed: {"status":"ERROR","statusMessage":"Permission denied"}.'
  - url: https://idp.lboro.ac.uk/simplesaml/saml2/idp/SSOService.php
    status: 400
    note: SAML 2.0 SSO endpoint live; 400 is the expected response with no SAMLRequest.
  - url: http://metadata.ukfederation.org.uk/ukfederation-metadata.xml
    status: 200
    note: UK Access Management Federation aggregate carries the Loughborough IdP entity, scope lboro.ac.uk,
      and the MEGS VLE SP.
  - url: https://api.datacite.org/clients/bl.lboro
    status: 200
    note: DataCite repository client BL.LBORO under member JHAH; prefixes 10.17028 and 10.26174.
  - url: https://api.figshare.com/v2/oai?verb=ListIdentifiers&metadataPrefix=oai_dc&set=portal_2
    status: 200
    note: OAI-PMH scoped to Loughborough via set=portal_2 (confirmed by DOI prefix 10.17028), but Identify
      names repositoryName figshare. Tenant, not institution.
  - url: https://koha.lboro.ac.uk/cgi-bin/koha/oai.pl?verb=Identify
    status: 200
    note: Anubis bot-challenge interstitial returned instead of OAI-PMH XML. Blocked to us, not absent.
  - url: https://api.lboro.ac.uk/
    status: 0
    note: NXDOMAIN. No central API host exists.
  - url: https://data.lboro.ac.uk/
    status: 0
    note: NXDOMAIN. No open-data portal exists.