$HEADLESS SYSTEMS
03 / Scorecard / Auth & Identity

FusionAuth

C
Headless Index
51/100
JAIRF
71.7/100
AI-Aware
Verified
MAY 21, 2026
Methodology v1 · JAIRF v1.0.0

Powered by JAIRF v1.0.0 by Jentic · open methodology at /the-headless-index/methodology

Editorial verdict
FusionAuth is partially headless and partly UI-led. The Headless Index thesis-fit score of 51/100 puts it mid-table on the index, and JAIRF v1.0.0 puts it at 71.7/100 (Level 2, AI-Aware). In practice, vendors at this tier are partly machine-consumable: the core flows are reachable through code but several adjacent surfaces still expect a human at a dashboard, and the rest of this verdict explains where FusionAuth lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. FusionAuth is an open-source identity product with a self-hostable Java backend and a comprehensive REST API covering every administrative surface. SDKs in Java, .NET, Python, Node, Go, Ruby, and PHP are all maintained. The OpenAPI specification is published in the documentation, which puts FusionAuth ahead of most identity vendors on machine discoverability.[1] Schema observability is the related test: can an agent introspect the contract from cold, or does it have to read prose documentation to do so? A public OpenAPI specification is published at fusionauth.io and used to generate the SDKs across languages. This makes FusionAuth one of the more agent-introspectable identity vendors in the index.[2] An agent can drive parts of this product, but not all of it: integrators should plan for human-in-the-loop checkpoints where the headless surface stops short. On headless operability: Every action in the FusionAuth admin UI is available through the API: user CRUD, application registration, tenant configuration, identity provider setup, lambda authoring, family unit management, audit log access. Kickstart YAML provides config-as-code for bootstrapping deployments. Reference-class operability for self-hosted identity.[3] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: No official FusionAuth MCP server has been published. The product positioning is self-hostable IdP rather than agent integration; community wrappers cover the protocol layer where needed.[4] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Webhook subscriptions cover user, registration, application, tenant, family, JWT, audit, MFA, and lambda lifecycle events with HMAC signing options. The catalog is among the most comprehensive in the identity category, reflecting FusionAuth's API-first orientation. Net assessment: integrators can build agent flows against FusionAuth, but the rough edge to plan around is MCP posture[5]. Expect to wrap missing pieces in bespoke glue or accept human-in-the-loop checkpoints. Workable but requires scaffolding.
Verdict by Headless Index pipeline (auto)
// AI-drafted from the evidence layer. Editorial review pending.
Scores

Scorecard detail

Headless Index · 5 sub-criteria
API-first design intent15/20
scored

FusionAuth is an open-source identity product with a self-hostable Java backend and a comprehensive REST API covering every administrative surface. SDKs in Java, .NET, Python, Node, Go, Ruby, and PHP are all maintained. The OpenAPI specification is published in the documentation, which puts FusionAuth ahead of most identity vendors on machine discoverability.

signals (6)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • +OpenAPI specPublished, 0 operations
  • −GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
  • +SDKs maintained16 (dotnet, go, java, javascript, php, python, ruby, typescript); top by stars: FusionAuth/fusionauth-typescript-client (71 stars)
  • +SDK recency13 of 16 SDK repos pushed within 30 days (most recent SDK commit: 2026-05-18)
  • +npm weekly downloads12.6M across published packages; top: npm @ 12.6M/week
cite (5)
  • openapi.probes_tried@2026-05-19
  • graphql.probes_tried@2026-05-19
  • github.sdks@2026-05-19
  • freshness.most_recent_sdk_commit@2026-05-19
  • github.sdks@2026-05-19
Headless operation12/20
scored

Every action in the FusionAuth admin UI is available through the API: user CRUD, application registration, tenant configuration, identity provider setup, lambda authoring, family unit management, audit log access. Kickstart YAML provides config-as-code for bootstrapping deployments. Reference-class operability for self-hosted identity.

signals (9)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −API operations exposedOpenAPI present but operations could not be counted
  • ·Docs pages crawled0 pages (crawler: none)
  • ·Auth schemes documentedAuth documentation page not reached by crawler
  • ·Setup / quickstart docsNot reached by crawler
  • ·Billing docsNot reached by crawler
  • ·Teams / org docsNot reached by crawler
  • ·CLI docsNot reached by crawler
  • ·Schema / data model docsNot reached by crawler
cite (1)
  • ai_review_browser.topics_found@2026-05-20
MCP & agent posture4/20
scored

No official FusionAuth MCP server has been published. The product positioning is self-hostable IdP rather than agent integration; community wrappers cover the protocol layer where needed.

signals (4)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −Official MCP serverNone found in vendor's GitHub org or the official MCP registry
  • −Community MCP serversNone found
  • +Agent-friendly SDKs2 TS/JS SDKs available; top: fusionauth-typescript-client (3/week downloads)
cite (1)
  • ai_review_browser.pages_fetched@2026-05-20
Schema observability16/20
scored

A public OpenAPI specification is published at fusionauth.io and used to generate the SDKs across languages. This makes FusionAuth one of the more agent-introspectable identity vendors in the index.

signals (3)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • +OpenAPIPublished at https://raw.githubusercontent.com/FusionAuth/fusionauth-openapi/main/openapi.yaml (OpenAPI undefined, 0 operations)
  • −GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)
cite (1)
  • ai_review_browser.schema@2026-05-20
Webhooks & events4/20
scored

Webhook subscriptions cover user, registration, application, tenant, family, JWT, audit, MFA, and lambda lifecycle events with HMAC signing options. The catalog is among the most comprehensive in the identity category, reflecting FusionAuth's API-first orientation.

signals (2)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • ·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.
cite (1)
  • ai_review_browser.pages_fetched@2026-05-20
JAIRF · 6 dimensions
FCFoundational Compliance
100/100

Structural validity, standards conformance, and parsability of the OpenAPI specification.

DXJDeveloper Experience & Tooling Compatibility
59.2/100

Documentation clarity, example coverage, response completeness, and ingestion health.

ARAXAI-Readiness & Agent Experience
49/100

Semantic clarity, intent expression, datatype specificity, and error standardization.

AUAgent Usability
90/100

Operational composability, complexity comfort, navigation affordances, and safety patterns.

SECSecurity
60/100

Authentication strength, transport security, secret hygiene, and OWASP risk posture.

AIDAI Discoverability
60/100

Descriptive richness, intent phrasing, workflow context, and registry signals.

Band rationale:C band: scores 40-75 range

04 / Embed

Show FusionAuth's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

FusionAuth mini badge preview
Get embed code
Calibration

How THI compares to external scorers

SourceScoreMeasuresLast checked
Fern Agent Score70 · CDocumentation completeness and SDK shape (~22 checks)April 8, 2026
CLIRank Agent Friendlinessnot foundCLI readiness, docs quality, and overall agent affordances—
Cloudflare Is It Agent Ready?blockedCloudflare's manual agent-readiness heuristic per vendor URL—
Jentic Scorecardn aJAIRF-based scorecard requiring a public OpenAPI specification—
THI 51 vs external median 70, delta -19

THI display 51 vs external median 70 (delta -19). Within calibration band.

Peers in Auth & Identity
StytchC
Headless Index 52/100
LogtoC
Headless Index 50/100
HankoC
Headless Index 50/100
See full Auth & Identity ranking →