Agent report card
Can an agent use DigitalOcean Cloud through API resource management?
Grade B: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
DigitalOcean / active
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateReady
- Sign upLimited
- PayReady
- ProvisionLimited
- OperateLimited
The exact service and stable evaluation or access entrypoints are publicly discoverable.
Applicable terms are stable, readable, retrievable, and materially complete.
Eligibility conditions and required inputs are explicit and decidable.
Price or no-charge status, variables, currency, and material conditions are explicit.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshEligibility conditions and required inputs are explicit and decidable.
DigitalOcean's Terms of Service explicitly outline material eligibility conditions prior to commitment: users must be at least 18 years old (or have sufficient legal consent/capacity), agree to the TOS directly or represent an entity with authority to bind it, and create an account with required information such as name, email address, and a valid form of payment.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
DigitalOcean provides explicit pricing details for its cloud solutions before commitment, including AI/ML inference starting at $0.05/M tokens, GPU Droplets starting at $1.91/GPU/hour (or $0.76/GPU/hour on-demand), App Platform starting at $0/month, and Droplets starting at $4/month with per-second billing ($0.01 minimum).
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
DigitalOcean's API documentation provides stable public routes and entrypoints to programmatically manage Droplets, Spaces, and other cloud infrastructure resources using conventional RESTful HTTP requests, doctl CLI commands, and inference APIs.
Are verified structured discovery artifacts available?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
DigitalOcean's legal Terms of Service Agreement is publicly retrievable, readable, and incorporates related terms by reference, including the Data Processing Agreement, Acceptable Use Policy, Privacy Policy, and Service Terms.
Does the vendor deliberately describe access for web agents?
missing: unknownCurrent admissible evidence does not resolve this finding.
Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
A stable canonical route begins the required access bootstrap.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The capture for the signup endpoint returned a 403 HTTP response from Cloudflare ('Sorry, you have been blocked'). Current admissible evidence does not resolve access control operability.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
DigitalOcean documentation provides a stable canonical route to begin obtaining service access by directing users to sign up and log in to the Control Panel.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
Target registration endpoint captures resulted in HTTP 403 Cloudflare block pages, and the documentation page does not explicitly declare CAPTCHA requirements or alternative agent boundaries.
Can an agent obtain scoped, revocable authority for this service?
supported: freshMachine credentials exist but require manual copying, broad authority, or weak lifecycle support.
DigitalOcean documentation details personal access tokens that provide scoped, revocable machine credentials with customizable expiration and scopes, but token generation requires manual steps in the Control Panel.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The registration endpoints resulted in HTTP 403 blocks and the guide evidence does not address phone verification requirements or safe explicit handoffs.
What would improve this stage
- Provide scoped delegated authorization with consent, revocation, and deterministic resumption.
Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
A documented direct purchase path reaches paid access without a vendor decision point.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence describes accepted payment methods and steps for adding a payment method on DigitalOcean, but it does not establish a complete end-to-end checkout flow supporting deterministic construction, approval handoff, and safe resumption.
Is the exact commercial commitment disclosed before authorization?
supported: freshCharge or no-charge status, currency, recurrence, and material conditions are disclosed.
DigitalOcean discloses its pricing structure with monthly caps and flat rates, including specific starting rates such as $0.05 per million tokens for Inference or $0.76/GPU/hour on-demand ($1.91/GPU/hour on multi-month commitment).
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence details adding credit cards, PayPal, Google Pay, Alipay, Link, crypto wallets, and ACH direct debit, including temporary authorization charges, but does not state a delegated authorization rail or human-confirmed approval with receipt mechanics.
Is a direct self-service path to paid access documented?
supported: freshA documented direct purchase path reaches paid access without a vendor decision point.
DigitalOcean documentation explicitly states that users can navigate to the Billing tab in the Control Panel and add a payment method to create resources or invite team members directly without a vendor decision point.
Delivery needs additional human transfer or has weak scope or lifecycle semantics.
Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshDelivery needs additional human transfer or has weak scope or lifecycle semantics.
When creating a personal access token in the Control Panel, DigitalOcean displays the secret key only once upon generation and directs the user to save it. Custom scope details are displayed and managing actions like rename, regenerate, or delete are available, but delivery requires manual user transfer of the single-display secret.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshCompletion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
When creating a Droplet in the Control Panel, a progress bar displays how close the Droplet is to being ready, and once fully set up, the Control Panel displays its IP address. However, the evidence does not establish asynchronous failure reconciliation, retry bounds, or failure state contracts.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Droplet provisioning can be initiated programmatically within supported agent authority by sending a POST request to https://api.digitalocean.com/v2/droplets or using API client libraries such as PyDo droplets.create().
What would improve this stage
- Deliver scoped access material through a secure documented machine-usable flow.
- Expose bounded machine-readable terminal status and reconciliation semantics.
Safe failure handling is documented only partially.
Only part of the credential lifecycle is agent-operable.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
missing: unknownCurrent admissible evidence does not resolve this finding.
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
DigitalOcean documentation explicitly states that if a personal access token becomes compromised, deleting it will revoke that token's access, and notes that tokens should be rotated rather than hard coded. However, the evidence does not detail full programmatic credential recovery or rotation lifecycle mechanisms.
Can an agent handle applicable failure modes safely?
supported: freshSafe failure handling is documented only partially.
DigitalOcean API documentation specifies HTTP status codes (200, 400, and 500 ranges), JSON error response structure (id, message, request_id), rate limits, and the retry-after header for burst limits. It also specifies DELETE idempotency, but omits complete cancellation and reconciliation semantics.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
DigitalOcean API authentication is documented using personal access tokens sent in a bearer-type Authorization header, supporting custom scopes for specific permissions.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
DigitalOcean API and Droplet documentation specify essential operations, HTTP methods (GET, DELETE, PUT, HEAD), request parameters, JSON responses, idempotency semantics, and explicit POST requests to endpoints like /v2/droplets with defined body schemas.
- resource-api
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
Every essential target is accessible through stable, documented agent-usable interfaces including the DigitalOcean REST API (via HTTP/cURL) and the doctl CLI, as well as SDKs like godo (Go) and pydo (Python).
- resource-api
What would improve this stage
- Document applicable structured errors, retry, cancellation, and reconciliation semantics.
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
- Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
- Pay: Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
What blocks agents
- Sign up: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
- Provision: Delivery needs additional human transfer or has weak scope or lifecycle semantics.
- Operate: Safe failure handling is documented only partially.
Startup offers
DigitalOcean on the startup-offers board
- 12 months of cloud credits (amount varies) + 15 months free Standard-tier supportDigitalOcean Startups Program
Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzf0m4x8r3etq6ck2b79hsw5
- Projection
- sha256:89e2b7216246f99d39d624c525fc1b89c55b0bb1439e850d49150f9209b28892
- Policy
- service-use-2026-08-20-public-evidence-r9 · sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration