# Gap Inc.

> Gap Inc. is a Fortune 500 American clothing and accessories retailer operating the Gap,
> Old Navy, Banana Republic and Athleta brands. Gap Inc. does not publish a public developer
> API, developer portal, SDK or machine-readable API contract. This file is generated by
> API Evangelist from an independent third-party profile of Gap Inc.'s public surface; it is
> not published by Gap Inc.

generated: 2026-09-10
method: generated
source: apis.yml and the probe artifacts in this repository (API Evangelist, all/gap)
subject: Gap Inc. (gapinc.com, gap.com) — profiled by API Evangelist, not authored by Gap Inc.

## What a developer or agent can and cannot do here

- There is **no public Gap Inc. API**. No OpenAPI, Swagger, GraphQL SDL, AsyncAPI, Protobuf
  or WSDL contract is published on any Gap-controlled host.
- There is **no MCP server and no A2A agent card**. Probes of /.well-known/agent-card.json,
  /.well-known/agent.json, /mcp and /.well-known/mcp.json on eight Gap hosts all returned 404
  (2026-09-10).
- `api.gap.com` **is** a live Apigee gateway, but it exposes no proxy to an anonymous caller;
  it fronts Gap's own web and mobile clients.
- `developer.gap.com` is a DNS CNAME to `gap-api-docs-portal.apigee.net`. The service behind
  it is gone and its TLS certificate does not cover the hostname, so it cannot be reached.
- Gap Inc. **does** run a vulnerability disclosure programme, on HackerOne.
- Gap Inc.'s robots.txt at www.gap.com explicitly names AI crawlers — ClaudeBot, GPTBot,
  OAI-SearchBot, ChatGPT-User, PerplexityBot, Amazonbot, Meta-ExternalAgent, YouBot, CCBot,
  Bingbot, Googlebot — in a group with `Allow: /`, while disallowing /buy/, /checkout/,
  /profile/, /shopping-bag and the site-search and error paths. Catalogue browsing is
  permitted to agents; transactional paths are not.

## Company

- [Gap Inc. corporate site](https://www.gapinc.com/): company, brands, leadership, impact and news.
- [Gap.com](https://www.gap.com): the Gap brand storefront.
- [About Gap Inc.](https://www.gapinc.com/en-us/about): brand portfolio — Gap, Old Navy, Banana Republic, Athleta.
- [Gap Inc. on LinkedIn](https://www.linkedin.com/company/gap-inc-)

## Technology and engineering

- [Gap Inc. technology news](https://www.gapinc.com/en-us/news/technology): the company's technology announcements.
- [Gap Inc. on GitHub](https://github.com/gapinc): the verified open-source organisation, contact open_source_office@gap.com.
- [Hoodies-Network](https://github.com/gapinc/hoodies-network): Gap Inc.'s only public first-party library — a Kotlin/Android HTTP client, MIT licensed, release v1.0.0 (2023-11-29). It is a general-purpose HTTP library, not an SDK for a Gap API, and it is not published to any package registry.

## Security

- [Gap vulnerability disclosure programme on HackerOne](https://hackerone.com/gap): the published channel for reporting a security issue. The HackerOne team record names http://www.gapinc.com as its website.
- No `/.well-known/security.txt` is served on any Gap host (72 probes across 8 hosts and 9 well-known paths, all negative, 2026-09-10).

## Legal and customer

- [Terms of Use](https://www.gap.com/customer-service/terms-of-use?cid=6754): covers Gap.com, BananaRepublic.com, OldNavy.com and Athleta.com. Last revised 2025-02-03.
- [Consumer Privacy Policy](https://www.gapinc.com/en-us/consumer-privacy-policy)
- [Customer Service FAQs](https://www.gap.com/customer-service/customer-service-faqs?cid=2136)
- [Contact Us (Gap.com)](https://www.gap.com/customer-service/contact-us?cid=81270)
- [Contact Us (Gap Inc.)](https://www.gapinc.com/en-us/contact-us)

## Notes for agents

- Gap.com customer-service pages require their `?cid=` query parameter. Without it the site
  answers HTTP 200 with an error body ("We're sorry. An error occurred that prevented this
  page from being displayed") — a soft 404. Do not treat a 200 from gap.com as proof a page
  exists; read the body.
- www.gap.com serves an HTML shell for `/llms.txt`. It is not an llms.txt document.