--- name: University of Waikato description: University of Waikato public developer/API footprint review for APIs.json cataloging. url: https://raw.githubusercontent.com/api-evangelist/university-of-waikato/refs/heads/main/review.yml created: '2026-06-03' modified: '2026-09-01' reviews: - date: '2026-09-01' rating: 3 summary: >- Re-profiled under the API Evangelist university pipeline, which puts operator attribution ahead of artifact volume. No vendor contract was ever attributed to this institution, so nothing had to be removed; the correction here is one of completeness, not of provenance. Five new surfaces were found and four of them are tenancies that a hostname-based verdict could not see: profiles.waikato.ac.nz CNAMEs to waikato.discovery.symplectic.org (Symplectic Discovery), libraryguides.waikato.ac.nz CNAMEs to region-au.libguides.com (Springshare), waikato.primo.exlibrisgroup.com carries the named Primo VE view 64WAIKATO_INST, and waikato.figshare.com answers 202 behind a bot challenge. All four are recorded as relationships with x-operator tenant; none of their contracts is saved here. The genuine finds are institution-operated: the uowidp OpenID Connect provider publishes a live discovery document and JWKS on api.svc.waikato.ac.nz and is consumed by the university's own timetable and student portal, and it is now the one contract in this repo; eLearn Moodle acts as an LTI 1.3 platform with live platform keys; a Shibboleth SP publishes metadata on the repository host; the Shibboleth IdP entity is registered in Tuakiri since 2012 with REFEDS R&S and Sirtfi and exported to eduGAIN, running on REANNZ's Tuakiri Hosted IdP; the Microsoft Entra ID tenant 220f5dc3-9452-48e5-9b4f-888df42f7a2d is the live SAML issuer for eLearn; and www.waikato.ac.nz publishes an llms.txt with explicit attribution and generative-model terms. Registry memberships verified: Crossref member 6347 (prefix 10.15663) and ROR 013fsnh78; DataCite returns zero matches and is recorded as a negative probe. endpoints: - url: https://api.svc.waikato.ac.nz/uowidp/v1/.well-known/openid-configuration status: 200 note: OpenID Provider metadata; issuer https://api.svc.waikato.ac.nz/uowidp/v1, RS256, client_secret_post. - url: https://api.svc.waikato.ac.nz/uowidp/v1/oidc/keys status: 200 note: Live JWKS, one RSA signing key. - url: https://elearn.waikato.ac.nz/mod/lti/certs.php status: 200 note: Moodle LTI 1.3 platform JWKS; alg RS256, kid 9b45a1370943b0323a6b. - url: https://researchcommons.waikato.ac.nz/Shibboleth.sso/Metadata status: 200 note: Shibboleth SP metadata, entityID https://researchcommons.waikato.ac.nz/shibboleth (auto-generated, not in the Tuakiri aggregate). - url: https://directory.tuakiri.ac.nz/metadata/tuakiri-metadata-signed.xml status: 200 note: Signed Tuakiri aggregate contains entityID https://idp.waikato.ac.nz/idp/shibboleth; SSO endpoints hosted at hosted-login.tuakiri.ac.nz. - url: https://www.waikato.ac.nz/llms.txt status: 200 note: Institution-published llms.txt with attribution and generative-model usage terms. - url: https://timetable.waikato.ac.nz/appsettings.json status: 200 note: ITS-built Blazor timetable declares OIDC authority api.svc.waikato.ac.nz/uowidp/v1, client_id timetable-prod. - url: https://profiles.waikato.ac.nz/ status: 200 note: TENANT — CNAME waikato.discovery.symplectic.org; /api returns the SPA shell, not an API. - url: https://libraryguides.waikato.ac.nz/genaiguide status: 200 note: TENANT — CNAME region-au.libguides.com (Springshare LibGuides). - url: https://waikato.figshare.com/ status: 202 note: TENANT — live but bot-challenged; the Figshare API v2 contract is Figshare's and is not saved here. - url: https://api.datacite.org/repositories?query=Waikato status: 200 note: meta.total 0 — no DataCite repository; negative probe recorded so it is not re-derived. - url: https://www.waikato.ac.nz/.well-known/security.txt status: 404 note: No security.txt published. - date: '2026-06-03' rating: 3 summary: >- Verified a real, multi-service developer footprint rather than a single consolidated API program. Live and confirmed: the Research Commons DSpace 7.6.5 REST API and its OAI-PMH 2.0 Identify endpoint (repositoryName "Research Commons"), the IT Services One-Time Secret (OTS) API docs, the UFDL deep learning framework API docs, and the uowidp identity/SSO login endpoint. The GitHub org github.com/Waikato (Computing and Mathematical Sciences, 30 repos) exists. No fabricated endpoints; OTS and identity are account-gated, and the originally probed legacy OAI path returned 404 (the working path is /server/oai/request). No single unified developer portal was found. endpoints: - url: https://www.waikato.ac.nz/ status: 200 note: Official institutional website resolved. - url: https://researchcommons.waikato.ac.nz/server/api status: 200 note: DSpace 7.6.5 REST API root; reports dspaceName "Research Commons". - url: https://researchcommons.waikato.ac.nz/server/oai/request?verb=Identify status: 200 note: OAI-PMH 2.0 Identify; repositoryName "Research Commons", earliest 1972. - url: https://researchcommons.waikato.ac.nz/oai/request?verb=Identify status: 404 note: Legacy DSpace 6 OAI path not present on DSpace 7; superseded by /server. - url: https://otis.its.waikato.ac.nz/docs/api status: 200 note: One-Time Secret API docs; JSON over HTTPS, HTTP Basic auth (Stella token). - url: https://ufdl.cms.waikato.ac.nz/ status: 200 note: UFDL framework host; API docs at /ufdl-api/, work in progress. - url: https://api.svc.waikato.ac.nz/uowidp/v1/login status: 200 note: Identity provider / SSO sign-in endpoint; account-gated. - url: https://github.com/Waikato status: 200 note: Official Computing and Mathematical Sciences GitHub org, 30 repositories. - url: https://www.linkedin.com/school/universityofwaikato/ status: 999 note: LinkedIn school page; 999 is LinkedIn bot-block, page exists.