generated: '2026-08-22' method: derived source: >- openapi/hypertrack-openapi.yaml, https://hypertrack.com/reference/webhooks, https://hypertrack.com/privacy, https://hypertrack.com/agreement, https://hypertrack.com/docs/mcp-server standards: - id: openapi conforms: true version: 3.0.3 evidence: >- openapi/hypertrack-openapi.yaml — provider-published at https://hypertrack.com/reference/openapi.yaml and indexed from the docs llms.txt. 64 paths, 85 operations, 395 component schemas. - id: oauth2 conforms: true evidence: >- POST /oauth/token implements the OAuth 2.0 client_credentials grant with application/x-www-form-urlencoded body (grant_type, client_id, client_secret, optional scope) returning access_token / token_type / expires_in. Note the securitySchemes block declares the result only as http/bearer (TokenAuth, BearerAuth), not as an oauth2 scheme with flows — so the grant is real but the contract does not machine-declare it. - id: oauth2-scopes conforms: false evidence: >- The token endpoint accepts an optional space-delimited `scope` parameter, but no scope names are published anywhere and no securityScheme declares scopes. No scopes/ artifact is written. - id: oidc conforms: false evidence: /.well-known/openid-configuration returns 404 on every host (well-known/hypertrack-well-known.yml). - id: rfc9457 conforms: false evidence: >- Errors are vendor JSON in three different shapes (Error, ValidationError, HTTPError); no application/problem+json media type appears anywhere in the contract. - id: rfc9116 conforms: false evidence: /.well-known/security.txt returns 404 on hypertrack.com and v3.api.hypertrack.com. - id: rfc8594 conforms: false evidence: No Sunset or Deprecation header is documented; no operation is marked deprecated. - id: pagination conforms: true style: cursor evidence: >- `limit` + opaque `pagination_token` on collection operations (16 and 15 operations respectively). Consistent across Orders, Workers, Places, Visits and Geotags. - id: idempotency conforms: partial evidence: >- No Idempotency-Key header. Creates are natural-key idempotent via caller-supplied handles and return 409 `duplicate_resource` on repeat; action endpoints have no replay protection. See conventions/hypertrack-conventions.yml. - id: rate-limit-headers conforms: false evidence: >- No RateLimit-*/X-RateLimit-*/Retry-After headers documented or observed; no 429 declared in the contract. See rate-limits/hypertrack-rate-limits.yml. - id: webhooks conforms: true evidence: >- 14 event types with 22 order-event values and a documented envelope, signature header (x-hypertrack-signature), 10-second ack window and 3x/20s retry policy. See asyncapi/hypertrack-events-webhooks.yml. - id: asyncapi conforms: false evidence: No AsyncAPI document published (probed 2026-08-22, three candidate URLs, all 404). - id: mcp conforms: true evidence: >- Official @hypertrack/mcp-server 0.1.60 on npm with 21 read-only tools, documented at https://hypertrack.com/docs/mcp-server. Local stdio only; no hosted remote endpoint. - id: agent-skills conforms: true evidence: >- Provider-published Agent Skill at https://github.com/hypertrack/hypertrack-skills, written against the agentskills.io specification, saved verbatim in skills/. - id: llms-txt conforms: true evidence: >- https://hypertrack.com/llms.txt (200, 42,341 bytes) plus a second, docs-scoped index at https://hypertrack.com/docs/llms.txt that is the only place the OpenAPI URL is advertised. - id: a2a conforms: false evidence: >- No agent card. /.well-known/agent-card.json and /.well-known/agent.json return 404 on hypertrack.com and v3.api.hypertrack.com. domain_standards: - id: geojson name: GeoJSON (RFC 7946) conforms: true evidence: >- The contract models all geometry as GeoJSON rather than as bespoke lat/lng pairs. components.schemas.PointGeometry declares type enum ["Point"] with coordinates as [longitude, latitude]; PolygonGeometry declares type enum ["Polygon"] with the RFC 7946 nested ring array; order destinations are a oneOf over the two. Route responses are described as "the route polyline as a GeoJSON LineString". Webhook payloads carry the same shape ("location": {"type": "Point", "coordinates": [...]}). This is the domain standard for the geospatial market: a consumer that already speaks GeoJSON — PostGIS, Leaflet, Mapbox, MapLibre, Turf, ArcGIS — reads HyperTrack geometry with no bespoke connector. spec_locations: - components.schemas.PointGeometry - components.schemas.PolygonGeometry - components.schemas.LocationGeometryResponse - GET /orders/estimated-routes/{estimated_route_id} (description) - id: iso8601 name: ISO 8601 timestamps conforms: true evidence: >- created_at / recorded_at / scheduled_at are ISO 8601 UTC throughout the REST contract and the webhook envelope; the webhooks reference states the format explicitly. - id: gpx name: GPS Exchange Format conforms: partial evidence: >- Not a payload format. GPX is the format HyperTrack's own testing guide (https://hypertrack.com/docs/mock-location) tells iOS developers to use to drive simulated location in XCTest. Recorded because it is a real, published interop point, not because the API accepts GPX. - id: ogc-api-features conforms: false evidence: >- No OGC API - Features surface, no /collections, no landing page or conformance declaration. The geospatial standard HyperTrack adopts is the payload format (GeoJSON), not the OGC service interface. compliance: certifications_published: false trust_center: false note: >- No trust center, no named certification (SOC 2 / ISO 27001 / HIPAA / PCI / FedRAMP) on the site, and probe-security-programs.py returned vdp=none trust=none on 2026-08-22. HyperTrack markets into healthcare staffing (https://hypertrack.com/healthcare) and publishes a privacy policy and a SaaS agreement, but no compliance attestation is published. No Compliance pointer is emitted. privacy_policy: https://hypertrack.com/privacy terms: https://hypertrack.com/terms agreement: https://hypertrack.com/agreement