--- name: University of Barcelona description: University of Barcelona public developer/API footprint review for APIs.json cataloging. url: https://raw.githubusercontent.com/api-evangelist/university-of-barcelona/refs/heads/main/review.yml created: '2026-06-03' modified: '2026-09-01' reviews: - date: '2026-09-01' rating: 3 summary: >- Re-profiled under the university pipeline, which settles WHO OPERATES each surface before saving anything. UB still has no developer portal, no public API program, no OpenAPI or AsyncAPI anywhere, and no confirmed organization-wide GitHub account — and its central web estate now sits behind a Cloudflare bot challenge that returns 403 to a full browser User-Agent, so the transparency open-data pages could not be read. What the June review missed is that UB operates three real, machine-readable, institution-run surfaces that are simply not marketed as APIs. Its SAML 2.0 identity provider is published as signed metadata through RedIRIS SIR into eduGAIN (entityID https://www.rediris.es/sir/ubidp, shibmd:Scope ub.edu) — the strongest surface it has. Its self-hosted Moodle at campusvirtual.ub.edu is a live LTI 1.3 Advantage tool platform with a working JWKS and token endpoint, plus an enabled token-gated Web Services REST API. Its OJS journal platform at revistes.ub.edu answers OAI-PMH 2.0 over 100 sets. The university press is a Crossref member (17854, prefixes 10.1344 / 10.32869, 10,561 DOIs). Against the Kin Score `education` regime that is five of twelve domain standards evidenced by live probe: lti, saml, shibboleth, oai-pmh, crossref. Two corrections in the other direction: the whole diposit.ub.edu host — DSpace REST and OAI-PMH, both HTTP 200 in June — returned 503 on every probe and is now marked degraded; and the research-data repository and library discovery layer, previously unlabelled, are tenancies on CSUC's Dataverse and Ex Libris' Primo VE and are recorded as relationships, not as UB contracts. No spec was generated. Nothing was fabricated. endpoints: - url: https://www.rediris.es/sir/ubidp status: 200 note: >- UB SAML 2.0 IdP metadata via RedIRIS SIR / eduGAIN; text/xml, 10,980 bytes, IDPSSODescriptor, shibmd:Scope ub.edu, validUntil 2026-10-01. - url: https://campusvirtual.ub.edu/mod/lti/certs.php status: 200 note: Moodle LTI 1.3 platform JWKS; live RS256 key set. - url: https://campusvirtual.ub.edu/mod/lti/token.php status: 400 note: LTI Advantage OAuth2 token endpoint; live, returns invalid_request to empty body. - url: https://campusvirtual.ub.edu/webservice/rest/server.php status: 200 note: Moodle Web Services REST enabled; returns invalidtoken exception, not service-disabled. - url: https://campusvirtual.ub.edu/ status: 200 note: Campus Virtual UB (Moodle) front page. - url: https://revistes.ub.edu/index.php/index/oai?verb=Identify status: 200 note: OJS OAI-PMH 2.0; "Revistes Científiques de la Universitat de Barcelona". - url: https://revistes.ub.edu/index.php/index/oai?verb=ListSets status: 200 note: 100 OAI sets (journals). - url: https://revistes.ub.edu/index.php/Ausa/api/v1/issues status: 403 note: OJS REST API v1 present but key-gated (api.403.unauthorized). - url: https://sso.ub.edu/SAML2/SSOService.php status: 200 note: UB centralized SSO SAML2 service endpoint; gated to registered apps. - url: https://sso.ub.edu/simplesaml/saml2/idp/metadata.php status: 403 note: No IdP metadata exposed on UB's own host; the descriptor lives in RedIRIS SIR. - url: https://api.crossref.org/members/17854 status: 200 note: >- Crossref member "Edicions de la Universitat de Barcelona"; prefixes 10.32869 and 10.1344; 10,561 DOIs. - url: https://api.ror.org/v2/organizations/021018s57 status: 200 note: ROR record for Universitat de Barcelona; links to https://web.ub.edu. - url: https://api.datacite.org/clients?query=barcelona status: 200 note: Zero results — UB has no DataCite client of its own. Not claimed. - url: https://dataverse.csuc.cat/dataverse/UB status: 200 note: >- CORA RDR UB collection (Dataverse 6.10.1, CSUC-operated). /api/dataverses/ub returned the UB collection JSON (id 6, contact crai-recerca@ub.edu) early in the run, then began 302-redirecting to a CSUC Google Sites page under load. - url: https://cercabib.ub.edu/discovery/search?vid=34CSUC_UB:VU1 status: 200 note: CRAI Cercabib on Ex Libris Primo VE; UB view within the CSUC tenancy. - url: https://diposit.ub.edu/server/api status: 503 note: >- DSpace 7.6.6 REST API. Apache "Service Unavailable" on six probes over both HTTP and HTTPS. Was 200 on 2026-06-03. Marked degraded, not deleted. - url: https://diposit.ub.edu/server/oai/request?verb=Identify status: 503 note: DSpace OAI-PMH; same host-wide outage. - url: https://www.ub.edu/ status: 403 note: >- Cloudflare bot challenge (cf-mitigated: challenge) on a full browser User-Agent; redirects to web.ub.edu. Live, not dead. - url: https://web.ub.edu/en/web/transparencia/open-data status: 403 note: Transparency open-data page behind the same Cloudflare challenge; unreadable. - url: https://www.ub.edu/llms.txt status: 404 note: No llms.txt; soft-404 HTML body returned. - url: https://www.ub.edu/.well-known/security.txt status: 404 note: No security.txt; soft-404 HTML body returned. - url: https://github.com/universitat-barcelona status: 404 note: No organization-wide GitHub account found under any tried name. - url: https://identitat.ub.edu/ status: 0 note: Does not resolve; identity is served via sso.ub.edu and RedIRIS SIR. - url: https://api.ub.edu/ status: 0 note: Does not resolve. No central API host. - url: https://data.ub.edu/ status: 0 note: Does not resolve. No institution-operated open data portal host. - date: '2026-06-03' rating: 2 summary: >- No central branded developer portal and no confirmed official organization-wide GitHub account were found for the University of Barcelona; only course/research repos exist. The confirmed public API footprint is library/scholarly infrastructure: the Dipòsit Digital institutional repository on DSpace 7.6.6 exposes a live REST API and a live OAI-PMH endpoint. Centralized SSO (SAML 2.0 / CAS) is live but gated to registered institutional applications. The transparency open-data page returned 403 to automated fetching. All listed endpoints were probed live; nothing was fabricated. (Superseded 2026-09-01: this review carried no operator attribution and missed the eduGAIN IdP, the LTI platform and the OJS OAI-PMH provider.) endpoints: - url: https://diposit.ub.edu/server/api status: 200 note: DSpace 7.6.6 REST API root; returns repository version metadata and HAL links. - url: https://diposit.ub.edu/server/oai/request?verb=Identify status: 200 note: OAI-PMH Identify returns repository name and protocol metadata. - url: https://diposit.ub.edu/ status: 200 note: Dipòsit Digital repository web UI. - url: https://sso.ub.edu/SAML2/SSOService.php status: 200 note: Centralized SSO SAML2 service endpoint; gated to registered apps. - url: https://www.ub.edu/ status: 200 note: Official university website. - url: https://web.ub.edu/en/web/transparencia/open-data status: 403 note: Transparency open-data page; blocks automated fetching, exists in browser. - url: https://identitat.ub.edu/ status: 0 note: Does not resolve; identity is served via sso.ub.edu instead.