generated: '2026-08-23'
method: probed
source: 'https://api.imvu.com (live probes, 2026-08-23) + https://github.com/imvu/imvu-scripting-docs'
note: 'Together Labs publishes NO authentication documentation for any developer surface. No
  Authentication pointer is emitted in apis.yml, because emitting one would credit the company with an
  auth reference it does not publish. Everything below was observed, not read.'
documented_by_provider: false
security_schemes: []
surfaces:
- name: IMVU REST API
  base_url: https://api.imvu.com
  model: session-cookie (inferred)
  evidence:
  - {observation: 'Vary: Accept, Cookie, Authorization', url: 'https://api.imvu.com/', status: 403}
  - {observation: 'POST /login with an empty JSON body returns 400 LOGIN-005 "Invalid login credentials"', url: 'https://api.imvu.com/login', status: 400}
  - {observation: 'GET /login returns 405 ROUTER-002 "Method GET does not exist for login"', url: 'https://api.imvu.com/login', status: 405}
  - {observation: 'A session resource exists at /login/session (404 "Session does not exist." when absent)', url: 'https://api.imvu.com/login/session', status: 404}
  - {observation: 'No OAuth surface — GET /oauth/token returns REST_DISCOVER_001 "Service oauth does not exist"', url: 'https://api.imvu.com/oauth/token', status: 404}
  - {observation: 'No OIDC discovery — /.well-known/openid-configuration', url: 'https://api.imvu.com/.well-known/openid-configuration', status: 404}
  anonymous_read:
    supported: true
    note: 'A real slice of the API answers with no credentials at all: /product/product-{id} (200),
      /user/user-{cid} (200), /user (200 empty collection), /room (200 empty collection),
      /product/{pid}/uml_products (200). Others gate — /room/room-1 returns 401 AUTHENTICATION-005.'
  key_issuance:
    available: false
    note: 'The public developer program that issued API keys was retired.
      https://developers.imvu.com/ 302s to https://secure.imvu.com/welcome/login/.'
  mtls: false
  api_key_header: null
- name: IMVU Room Scripting API
  model: ambient
  evidence:
  - {observation: 'Scripts execute server-side under the room owner''s account; no token, key or
      credential appears anywhere in the published API.', url: 'https://github.com/imvu/imvu-scripting-docs/blob/main/README.md'}
  authorization_model: 'Capability is bounded by room membership and ownership rather than by scopes: a
    script may only target current members of the room it runs in; imvu.place_furniture requires the ROOM
    OWNER to own the furniture product; imvu.send_room_invite for a foreign room requires a CID-ROOMID
    form and may still fail. The data module has a three-level sharing scope (script / room / account)
    plus a per-visitor partition, which is the nearest thing to an authorization scope on this surface.'
  eligibility: 'VIP membership (a Live Room is required to run a script), alpha-gated.'
oauth_scopes: null
oauth_scopes_note: 'Not applicable — no OAuth surface exists, so no scopes/ artifact is written.'