Is Xendit agent-ready?

Xendit scores Band C on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.

Does Xendit publish an OpenAPI spec?

No published OpenAPI specification was found when Xendit was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.

What is Xendit's Headless Index score?

Xendit scores 50/100 on the Headless Index thesis-fit rubric and sits in Band C in the Payments category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.

03 / Scorecard / Payments

Xendit

Headless Index

50/100

JAIRF

N/A

Verified

AUG 20, 2026

Methodology v1 · JAIRF v1.0.0

Xendit earns Band C in the Payments category of The Headless Index, with a thesis-fit score of 50/100. Its strongest dimension is API-first design intent (14/20); its weakest scored dimension is MCP and agent posture (4/20). No public OpenAPI specification was found when Xendit was scored, which limits how far an agent can go without human integration work.

Editorial verdict

Xendit is partially headless and partly UI-led. The Headless Index thesis-fit score of 50/100 puts it mid-table on the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier are partly machine-consumable: the core flows are reachable through code but several adjacent surfaces still expect a human at a dashboard, and the rest of this verdict explains where Xendit lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Southeast Asia's payment layer is API-native in a way the incumbents around it are not. One host (api.xendit.co), HTTP Basic with a secret key, and six generated clients people actually install: xendit-php at 192 stars, xendit-go at 156, xendit-node shipping 7.0.0. Payment Requests, Invoices, Payouts and Virtual Accounts are all first-class REST resources. An agent can drive parts of this product, but not all of it: integrators should plan for human-in-the-loop checkpoints where the headless surface stops short. On headless operability: Money movement is fully programmatic: create an invoice, request a payment, disburse to a bank account, none of it requiring the dashboard. Account setup is another matter. API key issuance, callback URL registration and business verification live in the Xendit console, and no CLI or config-as-code path exists (no Terraform provider published). Agents operate; humans still provision.^[1] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: No MCP server under github.com/xendit, no registry listing, no agent-facing documentation of any kind. Outsiders are filling the gap, including a four-star community build (mrslbt/xendit-mcp). Given that Xendit's value is executing real transfers across Indonesia and the Philippines, an unofficial server holding live disbursement credentials is the worst available outcome for everyone.^[2] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Callbacks are documented per product with concrete names (invoice.paid, plus payment and disbursement events), and retries run automatically over a documented window. Verification is where it falls down: a static shared secret carried in the x-callback-token header rather than an HMAC over the raw body, so an agent replaying a captured payload is indistinguishable from Xendit itself. Net assessment: integrators can build agent flows against Xendit, but the rough edge to plan around is MCP posture^[3]. Expect to wrap missing pieces in bespoke glue or accept human-in-the-loop checkpoints. Workable but requires scaffolding.

Verdict by Headless Index pipeline (auto)

// AI-drafted from the evidence layer. Editorial review pending.

Scores

Scorecard detail

Headless Index · 5 sub-criteria

API-first design intent14/20

scored

Southeast Asia's payment layer is API-native in a way the incumbents around it are not. One host (api.xendit.co), HTTP Basic with a secret key, and six generated clients people actually install: xendit-php at 192 stars, xendit-go at 156, xendit-node shipping 7.0.0. Payment Requests, Invoices, Payouts and Virtual Accounts are all first-class REST resources.

signals (6)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPI specNot found across 0 probe paths
−GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
+SDKs maintained5 (java, javascript, kotlin, swift); top by stars: xendit/xendit-sdk-android (31 stars)
+SDK recency1 of 5 SDK repos pushed within 30 days (most recent SDK commit: 2026-07-30)
−npm weekly downloadsNo published npm package detected for the JS/TS SDKs

cite (1)

github.sdks@2026-08-19

Headless operation12/20

scored

Money movement is fully programmatic: create an invoice, request a payment, disburse to a bank account, none of it requiring the dashboard. Account setup is another matter. API key issuance, callback URL registration and business verification live in the Xendit console, and no CLI or config-as-code path exists (no Terraform provider published). Agents operate; humans still provision.

signals (9)

+AI review appliedReviewer: Editorial review on 2026-08-19
−API operations exposedNo OpenAPI spec; operations count unknown
·Docs pages crawled0 pages (crawler: none)
·Auth schemes documentedAuth documentation page not reached by crawler
·Setup / quickstart docsNot reached by crawler
·Billing docsNot reached by crawler
·Teams / org docsNot reached by crawler
·CLI docsNot reached by crawler
·Schema / data model docsNot reached by crawler

cite (1)

github.sdks@2026-08-19

MCP & agent posture4/20

scored

No MCP server under github.com/xendit, no registry listing, no agent-facing documentation of any kind. Outsiders are filling the gap, including a four-star community build (mrslbt/xendit-mcp). Given that Xendit's value is executing real transfers across Indonesia and the Philippines, an unofficial server holding live disbursement credentials is the worst available outcome for everyone.

signals (4)

+AI review appliedReviewer: Editorial review on 2026-08-19
−Official MCP serverNone found in vendor's GitHub org or the official MCP registry
−Community MCP serversNone found
+Agent-friendly SDKs1 TS/JS SDKs available; top: xendit-api-key-scanner-action

cite (1)

github.sdks@2026-08-19

Schema observability10/20

scored

The SDKs are generated and the repos admit it (.openapi-generator directories in github.com/xendit/xendit-node), but the source document is published nowhere fetchable. An agent wanting a schema has to reverse it out of generated TypeScript models. The evidence of a spec exists; the spec does not. That is a short fix Xendit has chosen not to make.

signals (3)

+AI review appliedReviewer: Editorial review on 2026-08-19
−OpenAPINot discovered across 0 standard probe paths
−GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)

cite (1)

github.sdks@2026-08-19

Webhooks & events10/20

scored

Callbacks are documented per product with concrete names (invoice.paid, plus payment and disbursement events), and retries run automatically over a documented window. Verification is where it falls down: a static shared secret carried in the x-callback-token header rather than an HMAC over the raw body, so an agent replaying a captured payload is indistinguishable from Xendit itself.

signals (2)

+AI review appliedReviewer: Editorial review on 2026-08-19
·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.

cite (1)

github.sdks@2026-08-19

JAIRF · 6 dimensions

JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Band rationale:C band: scores 40-75 range

04 / Embed

Show Xendit's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Get embed code

Peers in Payments

RapydC

Headless Index 50/100

NuveiC

Headless Index 50/100

BlueSnapC

Headless Index 50/100

See full Payments ranking →

FAQ

Xendit and agent readiness

Is Xendit agent-ready?: Xendit scores Band C on The Headless Index. Its JAIRF rating is not available because no machine-readable spec was scored. Its strongest area for agent use is API-first design intent; its weakest is MCP and agent posture.
Does Xendit publish an OpenAPI spec?: No published OpenAPI specification was found when Xendit was scored. That caps its JAIRF dimensions and forces agents to rely on documentation or reverse engineering to operate it.
What is Xendit's Headless Index score?: Xendit scores 50/100 on the Headless Index thesis-fit rubric and sits in Band C in the Payments category. The score weighs API-first design, headless operation, MCP and agent posture, schema observability, and webhooks.