Is OneLogin agent-ready?

OneLogin scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is headless operation; its weakest is schema observability.

Does OneLogin publish an OpenAPI spec?

No published OpenAPI specification was found when OneLogin was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.

What is OneLogin's Headless Index score?

OneLogin scores 64/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Auth & Identity

OneLogin

Headless Index

64/100

JAIRF

N/A

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

OneLogin earns Band B in the Auth & Identity category of The Headless Index, with a thesis-fit score of 64/100. Its strongest dimension is headless operation (16/20); its weakest scored dimension is schema observability (10/20). No public OpenAPI specification was found when OneLogin was scored, which limits how far an agent can go without human integration work.

Editorial verdict

OneLogin is solidly built for programmatic consumption. The Headless Index thesis-fit score of 64/100 lands it in the upper-middle of the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier ship most of the primitives agents need, with one or two surfaces still leaning on documentation rather than discovery, and the rest of this verdict explains where OneLogin lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. OneLogin ships two live API generations at once (v1 and v2 on api.us.onelogin.com) and never retired the first. Client coverage stays broad for a product in maintenance: @onelogin/sdk pulls just over 21,000 weekly npm downloads, and Python, Go, Java, Ruby, PHP and .NET repos all sit under the one org. Versioning discipline is the weak part here. An agent can drive this product across most practical workflows, with a handful of edges where documentation reading still beats schema discovery. On headless operability: The Terraform provider is the surprise here (onelogin/onelogin, partner tier, 1.6M registry downloads), so apps, users, roles and mappings stay declarative. Smart Hooks go further; pre-authentication and user-migration functions are created, versioned and given environment variables entirely through the API. Branding and several policy screens still require the admin console, and nothing replaces it.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: An MCP server does exist under the vendor org (github.com/onelogin/onelogin-mcp, last touched July 2026), which puts OneLogin ahead of most legacy IDaaS. It stops there. Five stars, no entry in the public MCP registry, no agent-facing page on developers.onelogin.com, no toolkit package. An agent finds it by luck rather than by any published discovery path.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Event delivery is a firehose, not a catalogue. The Event Broadcaster posts every account event to one endpoint (JSON Array format is the recommended setting), with no per-type subscription and no documented signing header. The pull path is better: GET /api/1/events exposes numeric event type IDs and filtering. Retry and replay semantics are not stated. Net assessment: OneLogin can be operated by agents for the majority of practical workflows. The closest thing to a gap is schema observability^[3], which integrators should sanity-check against their own use case before committing. Strong fit for agent-driven use cases.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent14/20

scored

OneLogin ships two live API generations at once (v1 and v2 on api.us.onelogin.com) and never retired the first. Client coverage stays broad for a product in maintenance: @onelogin/sdk pulls just over 21,000 weekly npm downloads, and Python, Go, Java, Ruby, PHP and .NET repos all sit under the one org. Versioning discipline is the weak part here.

signals (6)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPI specNot found across 34 probe paths
·GraphQL endpointDiscovered at https://www.onelogin.com/graphql, introspection disabled or scoped
+SDKs maintained10 (dotnet, go, java, javascript, kotlin, php, python, ruby); top by stars: onelogin/onelogin-python-sdk (40 stars)
+SDK recency2 of 10 SDK repos pushed within 30 days (most recent SDK commit: 2026-08-07)
+npm weekly downloads21.4k across published packages; top: @onelogin/sdk @ 21.4k/week

cite (1)

ai_review_browser.auth@2026-08-19

Headless operation16/20

scored

The Terraform provider is the surprise here (onelogin/onelogin, partner tier, 1.6M registry downloads), so apps, users, roles and mappings stay declarative. Smart Hooks go further; pre-authentication and user-migration functions are created, versioned and given environment variables entirely through the API. Branding and several policy screens still require the admin console, and nothing replaces it.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
−API operations exposedNo OpenAPI spec; operations count unknown
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

ai_review_browser.topics_found@2026-08-19

MCP & agent posture12/20

scored

An MCP server does exist under the vendor org (github.com/onelogin/onelogin-mcp, last touched July 2026), which puts OneLogin ahead of most legacy IDaaS. It stops there. Five stars, no entry in the public MCP registry, no agent-facing page on developers.onelogin.com, no toolkit package. An agent finds it by luck rather than by any published discovery path.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
+Official MCP serverhttps://github.com/onelogin/onelogin-mcp (5 stars, last commit 27 days ago)
·Community MCP servers1 community MCP repos; top by stars: https://github.com/onelogin/mcp-testrail (0 stars)
+Agent-friendly SDKs1 TS/JS SDKs available; top: @onelogin/sdk (21.4k/week downloads)

cite (1)

ai_review_browser.mcp@2026-08-19

Schema observability10/20

scored

Nothing machine-readable is published. The docs site renders endpoint prose page by page (developers.onelogin.com/api-docs/2), with Postman collections as the closest thing to a contract, and probes for a spec document return 404. An agent cannot build a OneLogin client cold; it scrapes HTML or leans on a hand-maintained SDK that lags the v2 surface.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPINot discovered across 34 standard probe paths
·GraphQL introspectionGraphQL endpoint at https://www.onelogin.com/graphql but introspection is disabled, scoped, or behind authentication

cite (1)

ai_review_browser.schema@2026-08-19

Webhooks & events12/20

scored

Event delivery is a firehose, not a catalogue. The Event Broadcaster posts every account event to one endpoint (JSON Array format is the recommended setting), with no per-type subscription and no documented signing header. The pull path is better: GET /api/1/events exposes numeric event type IDs and filtering. Retry and replay semantics are not stated.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

ai_review_browser.pages_fetched@2026-08-19

JAIRF · 6 dimensions

JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Band rationale:B band: JAIRF=N/A HeadlessIndex=64

04 / Embed

Show OneLogin's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Peers in Auth & Identity

Ping IdentityB

Headless Index 64/100

JumpCloudB

Headless Index 64/100

Better AuthB

Headless Index 63/100

See full Auth & Identity ranking →

FAQ

OneLogin and agent readiness

Is OneLogin agent-ready?: OneLogin scores Band B on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is headless operation; its weakest is schema observability.
Does OneLogin publish an OpenAPI spec?: No published OpenAPI specification was found when OneLogin was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.
What is OneLogin's Headless Index score?: OneLogin scores 64/100 on the Headless Index thesis-fit rubric and sits in Band B in the Auth & Identity category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.