Apache Guacamole
Apache Guacamole is a clientless remote desktop gateway that supports standard protocols like VNC, RDP, and SSH. It requires no plugins or client software and provides access to remote desktops through a web browser with a comprehensive REST API for connection, user, and session management.
Real signal across most facets with visible, nameable gaps — the contract exists but is thin, or the portal is good while governance and commercial terms are absent.
API Evangelist profiles Apache Guacamole the way a machine reads it — 57 machine-readable artifacts across 7 APIs, pulled from the provider's own public surface and indexed so a developer, an analyst, or an AI agent can evaluate it against every other provider on the network.
Every provider in the network is reduced to the same set of machine-readable artifacts — OpenAPI contracts, event specifications, GraphQL schemas, runnable collections, pricing and rate-limit signals, security posture, OAuth scopes, and the agent surfaces (MCP servers and skills) that let software drive the API on its own. We profile them because the interface is the part of a company you can actually inspect: it is a truer signal of what a provider does than any marketing page. From those artifacts we compute the Kin Score — Apache Guacamole scores 55.3/100 (developing), with a separate agent-readiness read of 48/100 (agent ready). The full breakdown is below, followed by every artifact we hold — each card links through to its machine-readable definition on apis.io.
Kin Score
This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.
Kin Score
How this is scored →scored 2026-07-27 · rubric v0.5
How we profile Apache Guacamole
Each block below is one kind of artifact we hold for Apache Guacamole. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.
APIs 7
Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.
Individual APIs this provider publishes, each with its own machine-readable definition.
Apache Guacamole JavaScript Client API
JavaScript client library for embedding the Guacamole remote desktop client in web applications, with APIs for protocol tunneling, display rendering, and user input handling.
Apache Guacamole Active Connections API
Active connection session management
Apache Guacamole Authentication API
Authentication token management
Apache Guacamole Connections API
Remote desktop connection management
Apache Guacamole History API
Connection history and audit logs
Apache Guacamole User Groups API
User group management
Apache Guacamole Users API
User account management
Scroll within the panel for all 7 ·
Open Collections 1
Open, tool-agnostic collections carry the same runnable value as Postman without locking you to one client — the portable, forkable form of the same exercise.
Open, tool-agnostic API collections (OpenAPI-derived and Bruno).
Apache Guacamole REST API
OPEN COLLECTIONPricing Plans 1
Pricing is part of the interface. Machine-readable plans tell you what a tier costs and includes before you commit — one of the six things the Kin Score reads for commercial clarity.
Published pricing tiers and plan structures.
Rate Limits 1
Rate limits are the difference between a demo that works and a production integration that doesn't fall over. Publishing them is an operational-transparency signal — and a hard requirement for any agent that plans its own throughput.
Documented rate limits and quota policies.
Apache Guacamole Rate Limits
RATE LIMITSFinOps 1
Cost, billing, and metering signals let a buyer model the financial operations of an API before it's live. We profile them for the same reason we profile pricing: the money is part of the contract.
Cost, billing, and metering signals for API financial operations.
Apache Guacamole Finops
FINOPSFeatures 8
The notable capabilities this provider advertises, captured as structured features so they can be searched and compared instead of read one landing page at a time.
Notable capabilities this provider offers.
Clientless Remote Desktop
Access remote desktops through any HTML5 web browser with no client software or plugins required.
Multi-Protocol Support
Supports VNC, RDP, SSH, and Telnet protocols through a unified web gateway.
Token-Based Authentication
Stateless REST API authentication using time-limited tokens from the /api/tokens endpoint.
Connection Management
REST API for creating, updating, and organizing remote desktop connections and connection groups.
User and Group Management
Fine-grained user and group permissions for controlling access to connections and administrative functions.
Active Session Monitoring
Monitor and terminate active remote desktop sessions through the REST API.
Connection History
Audit log of all remote desktop sessions with timestamps and user attribution.
Extension API
Java extension API for implementing custom authentication providers, event listeners, and protocol extensions.
Scroll within the panel for all 8 ·
Semantic Vocabularies 1
JSON-LD contexts give the data shared meaning across APIs. We profile them because semantics are what let a machine reconcile 'customer' here with 'customer' somewhere else.
JSON-LD contexts and semantic vocabularies used across these APIs.
Spectral Rules 2
Governance rulesets we run against this provider's specs — the automated checks behind parts of the score. Profiling them makes the quality bar explicit and re-runnable, not a matter of opinion.
Apache Guacamole API Rules
SPECTRALApache Guacamole API Rules
SPECTRALJSON Schema 7
Standalone JSON Schema definitions describe the data models behind the API. We profile them so the shapes are validatable on their own — useful long after a single request is forgotten.
Standalone JSON Schema definitions for this provider's data models.
ActiveConnection
JSON SCHEMAAuthToken
JSON SCHEMAConnectionGroup
JSON SCHEMAConnectionHistoryEntry
JSON SCHEMAConnection
JSON SCHEMAUserGroup
JSON SCHEMAUser
JSON SCHEMAScroll within the panel for all 7 ·
JSON Structure 7
JSON Structure captures the data shapes in a form built for tooling — a complement to JSON Schema that keeps the model machine-legible.
JSON Structure definitions describing this provider's data shapes.
Guacamole Rest Active Connection Structure
JSON STRUCTUREGuacamole Rest Auth Token Structure
JSON STRUCTUREGuacamole Rest Connection Group Structure
JSON STRUCTUREGuacamole Rest Connection History Entry Structure
JSON STRUCTUREGuacamole Rest Connection Structure
JSON STRUCTUREGuacamole Rest User Group Structure
JSON STRUCTUREGuacamole Rest User Structure
JSON STRUCTUREScroll within the panel for all 7 ·
Examples 7
Real request and response payloads are what turn a spec from abstract into obvious — and they're one of the twelve things an agent needs to call an API correctly on the first try.
Example request and response payloads for these APIs.
Guacamole Rest User Example
EXAMPLEScroll within the panel for all 7 ·
Security Posture 3
Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.
Authentication, domain security, vulnerability disclosure, and trust-center signals.
Agentic Access 1
An x-agentic-access contract marks which operations are safe for an agent to run on its own and which need a human in the loop. It is the difference between an API an agent can use and one it can use safely.
Recommended x-agentic-access execution contracts for AI agents.
Use Cases 5
What developers actually build with this provider — captured so the catalogue answers 'what is this for', not just 'what does this expose'.
What developers build with this provider.
Remote Desktop Access
Provide browser-based access to Linux and Windows desktops for remote workers.
Cloud Server Management
Access cloud VMs and servers through SSH and RDP via browser without installing VPN or client software.
Secure Bastion Host
Use Guacamole as a protocol-proxying bastion host to isolate internal systems from direct network access.
Development Environment Access
Provide developers with browser-based access to containerized or virtualized development environments.
IT Support Tooling
Enable IT helpdesk teams to access and troubleshoot user desktops through the browser.
Integrations 5
Pre-built integrations with other platforms tell you where this provider already fits in a stack.
Pre-built integrations with other platforms and tools.
Apache Tomcat
Runs as a Java web application on Apache Tomcat or any Java Servlet container.
LDAP / Active Directory
LDAP extension for authenticating users against directory services like Active Directory.
TOTP / Duo MFA
Multi-factor authentication extensions supporting TOTP apps and Duo Security.
MySQL / PostgreSQL
Database authentication extensions for storing connections and users in relational databases.
Kubernetes
Guacamole can be deployed on Kubernetes with the guacamole-client Docker image.
Resources
Every other property we hold for Apache Guacamole — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.
Get Started 1
Portal, sign-up, and the first successful call
Documentation 1
Reference material describing how the API behaves
Agent Surfaces 1
MCP servers, agent skills, and machine-readable catalogs
Design & Contract 2
Pagination, idempotency, versioning, errors, and events
Build 2
SDKs, sample code, and the tooling you integrate with
Access & Security 3
Authentication, authorization, and security posture
← All providers · Data indexed from github.com/api-evangelist/apache-guacamole · machine-readable index on apis.io