generated: '2026-08-13'
method: searched
source: https://help.awin.com/apidocs/introduction-1
docs:
- https://help.awin.com/apidocs/api-authentication
- https://www.awin.com/gb/legal/information-security
- https://www.awin.com/gb/privacy
description: >-
  Standards posture for the Awin API, asserted from Awin's own documentation and
  from the specs in this repo. Awin claims OAuth 2.0 but implements only the
  bearer-token presentation half of it; the certification claim that IS
  substantiated is ISO/IEC 27001, published on Awin's Information Security page.
standards:
- id: oauth2
  conforms: partial
  evidence: >-
    Docs state "All of our APIs follow the OAuth 2.0 specification and require
    you to pass on the token in combination with the word Bearer". Only RFC 6750
    bearer-token USAGE is implemented - there is no authorization endpoint, no
    token endpoint, no client registration, no grant flow, no refresh token and
    no scopes. Tokens are minted by a human in the platform UI at
    ui.awin.com/awin-api. The OpenAPI in this repo correctly models it as
    `type: http, scheme: bearer` rather than `type: oauth2`.
  source: https://help.awin.com/apidocs/api-authentication
- id: rfc6750-bearer-token
  conforms: true
  evidence: >-
    Authorization header of the form 'Bearer <token>' on every endpoint except the
    Conversion API.
  source: https://help.awin.com/apidocs/api-authentication
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on www, api, ui and help hosts.
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: /.well-known/oauth-authorization-server returns 404 on every host probed.
- id: rfc9116-security-txt
  conforms: true
  evidence: >-
    security.txt served with Contact: and Policy: fields from www.awin.com,
    api.awin.com and ui.awin.com. See well-known/awin-affiliate-well-known.yml.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors are bare {"error","description"} JSON with the HTTP status as the only
    discriminator; no application/problem+json anywhere.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy or header documented.
- id: json-api
  conforms: false
  evidence: Plain JSON resource documents; no JSON:API media type or envelope.
- id: rest
  conforms: true
  evidence: >-
    "Our APIs follow REST principles, use JSON as the default response format" -
    resource-oriented paths under /publishers/{id} and /advertisers/{id}, HTTP
    verbs carry semantics.
  source: https://help.awin.com/apidocs/introduction-1
- id: openapi
  conforms: false
  evidence: >-
    Awin publishes no OpenAPI document. api.awin.com/openapi.json,
    /openapi.yaml, /swagger.json, /v1/openapi.json and /api-docs all return 401
    with a generic unauthorized envelope; the Document360 docs host returns an
    HTML shell. The specs in openapi/ are API Evangelist reconstructions grounded
    in the published documentation, not a provider artifact.
- id: pagination
  conforms: false
  evidence: >-
    No page/offset/cursor/limit parameters. Result sets are bounded by a 31-day
    date window on transaction listings instead.
- id: idempotency
  conforms: false
  evidence: >-
    No idempotency key or retry-safety contract documented on any write surface,
    including the Conversion API and the 40,000-object batch validation endpoint.
- id: https-only
  conforms: true
  evidence: >-
    "only forwarding from HTTPS is supported and not from HTTP"; TLS 1.3 observed
    on api.awin.com. See security/awin-affiliate-domain-security.yml.
  source: https://help.awin.com/apidocs/introduction-1
- id: llmstxt
  conforms: true
  evidence: >-
    help.awin.com/llms.txt returns a real 38KB index (HTTP 200) and every listed
    page is retrievable as markdown by appending .md. Saved verbatim to llms/.
- id: mcp
  conforms: false
  evidence: No MCP server published. See mcp/awin-affiliate-mcp.yml.
- id: a2a
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json 404 on all four hosts.
- id: asyncapi
  conforms: false
  evidence: >-
    No AsyncAPI document, though a real webhook surface exists. See
    asyncapi/awin-affiliate-webhooks.yml.
compliance:
- id: iso-27001
  conforms: true
  evidence: >-
    "We're proud to hold the ISO 27001 certification ... We have successfully
    completed external, independent audits to attest to our compliance with the
    ISO 27001 standard."
  source: https://www.awin.com/gb/legal/information-security
- id: gdpr
  conforms: true
  evidence: >-
    "We meet our legal obligations under the EU General Data Protection
    Regulation (GDPR) by using adequate technical and organisational measures."
  source: https://www.awin.com/gb/legal/information-security
- id: soc-2
  conforms: false
  evidence: Not claimed on the Information Security or Compliance pages.
- id: pci-dss
  conforms: false
  evidence: Not claimed. Awin is not a card acquirer.