Does the PayRun.IO API need an API key?

Yes for the 17 operations checked: an anonymous request was refused, on 2026-09-15. Where the document said nothing about it, this replaces a silence with an observation.

ERR-2026-1713, ERR-2026-1722, ERR-2026-1757, ERR-2026-1807, ERR-2026-1817, ERR-2026-1898, ERR-2026-2011, ERR-2026-2030, ERR-2026-2031, ERR-2026-2086, ERR-2026-2089, ERR-2026-2129

Where is the PayRun.IO OpenAPI specification?

Not where the directory says. The URL published as this provider's own document did not answer on 2026-09-15 (1 entry). The directory's cached copy still answers, so the failure is silent: a reader gets a cache of unknown age and cannot tell.

ERR-2026-0614

Every record behind those answers

18 open records, observed 2026-09-10. Every claim below carries the command that disproves it. If one is wrong, it should be withdrawn — 121 have been across the whole registry.

credentials are required (observed) (17)

The document establishes no authentication requirement for this operation; an anonymous request is refused with 401. The requirement is now observed rather than unknown.

`ERR-2026-1713`	Gets the employer	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1722`	Get links to all commentaries for the specified employee	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1757`	Get employee from employer	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1807`	Gets the DPS messages	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1817`	Gets the specified pay instruction from the employee	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1898`	Get commentary from employee	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2011`	Gets the journal Lines from the specified employee	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2030`	Get CIS line type tag	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2031`	Get all CIS line type tags	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2086`	Get the auto enrolment assessments	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2089`	Get all tags from the CIS line type	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2129`	Get CIS line types with tag	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2145`	Gets the DPS message	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2176`	Get the CIS transaction	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2203`	Get CIS line types from employer.	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2226`	Get all CIS transactions for the employer	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2231`	Get the auto enrolment assessment	HTTP 401	checked 2026-09-15, 2 times

Check it yourself:

curl -sS -o /dev/null -w '%{http_code}\n' https://api.test.payrun.io/Employer/errata-probe-not-a-real-identifier

the description document is gone (1)

The document APIs.guru names as this provider's own origin returns HTTP 404.

ERR-2026-0614 https://api.test.payrun.io/swagger/json HTTP 404 checked 2026-09-15, 2 times

Check it yourself:

curl -sS -o /dev/null -w '%{http_code}\n' https://api.test.payrun.io/swagger/json

Withdrawn (1)

Our own check stopped supporting these claims — including claims that were wrong the day they were written.

ERR-2026-1783 2026-09-15 timeout: timeout on https://api.test.payrun.io/Employer/errata-probe-n

Also filed as: payrun.io. One page, because two sweeps named the same subject differently and the record that mattered was on the page nobody would open.

If a record here is wrong

Run its check. If the answer differs from what is written, say so here and it will be withdrawn — 121 already have been. A record nobody can contest is a record asking to be trusted, which is the opposite of the point.

What this page does not tell you

This is not a clean bill of health for anything not listed. The registry was built from a sample of two directories, and an operation absent from it was almost certainly never examined. Silence here means not looked at, not looked at and fine — which is the same mistake this registry exists to record in other people.

What this is

A record of defects in the public description of machine-callable operations: documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe. It is not a ranking, not a review, and not a judgement about the service. No credential is ever sent to anything listed here.

The whole registry, machine-readable: errata.json. Index of subjects: index.html.

Built from registry errata-2026-09-10@b7cb54d3a847. If manifest.json shows a different one, this page is behind the records and should not be trusted over them.