generated: '2026-08-13'
method: searched
source: https://developer.ispot.tv/documentation/api
note: >-
  Derived from iSpot's public documentation plus live unauthenticated probes of
  api.ispot.tv. No OpenAPI is published, so nothing here is derived from a spec.
  Absence is recorded as conforms:false with the reason, not omitted.
standards:
- id: oauth2
  conforms: true
  evidence: >-
    OAuth 2.0 client_credentials grant at https://api.ispot.tv/v4/oauth2/token;
    Bearer token in the Authorization header; probed live (HTTP 400 RFC 6749
    invalid_request wording on an empty request).
  method: probed
- id: rfc6749-client-credentials
  conforms: true
  evidence: >-
    grant_type=client_credentials with client_id/client_secret posted as
    application/x-www-form-urlencoded; error wording matches the RFC 6749
    invalid_request description verbatim.
  method: probed
- id: rfc9457-problem-details
  conforms: partial
  evidence: >-
    Errors are served as application/problem+json with title/type/status/detail/
    instance. Deviations: `type` is a bare slug ("authentication-required",
    "resource-not-found") on resource endpoints rather than a dereferenceable
    URI, and on the token endpoint `detail` carries the request id instead of a
    human explanation.
  method: probed
- id: rfc6750-bearer-token
  conforms: partial
  evidence: >-
    Bearer tokens are used in the Authorization header, but the 401 response
    carries no WWW-Authenticate challenge header — probed on
    https://api.ispot.tv/v4/brands.
  method: probed
- id: json-api
  conforms: partial
  evidence: >-
    Uses JSON:API-family conventions — filter[...], page[number]/page[size],
    comma-separated `include` for compound documents, `sort` with a '-' descending
    prefix, and a top-level `data` + `meta` envelope. It does NOT claim JSON:API,
    does not serve application/vnd.api+json, and errors use problem+json rather
    than the JSON:API `errors` member.
  method: searched
- id: pagination
  conforms: true
  evidence: >-
    page[number]/page[size] with meta.pagination carrying total, count, per_page,
    current_page, total_pages and previous/next links.
  source: https://developer.ispot.tv/sites/default/files/iSpot_API_Integration_Guide_2023-compressed.pdf
  method: searched
- id: rate-limiting
  conforms: partial
  evidence: >-
    Per-endpoint limits published with a 429 on exhaustion; three rate-limit
    response headers are described in prose but never named, so the runtime
    signal is not bindable from public documentation.
  source: https://developer.ispot.tv/documentation/api/rate-limits
  method: searched
- id: idempotency
  conforms: false
  evidence: No idempotency key or retry-safety contract is documented.
- id: iso8601
  conforms: true
  evidence: >-
    Date filters accept YYYY-MM-DD and full ISO 8601 (YYYY-MM-DDThh:mm:ssZ);
    stated explicitly in the Integration Guide and the glossary.
  method: searched
- id: openapi
  conforms: false
  evidence: >-
    No OpenAPI document is published at any probed location on api.ispot.tv,
    developer.ispot.tv or www.ispot.tv. The changelog does reference an "OpenAPI
    annotation comparison endpoint" (v4.48.1), implying a spec exists internally
    behind the credentialed developer site.
  method: probed
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is published.
- id: mcp
  conforms: false
  evidence: No MCP server is published.
- id: a2a
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json probed on
    www.ispot.tv, developer.ispot.tv, api.ispot.tv and login.ispot.tv — no card.
  method: probed
- id: rfc9116-security-txt
  conforms: false
  evidence: >-
    /.well-known/security.txt returns 404 on www.ispot.tv, 403 on
    developer.ispot.tv, 503 on api.ispot.tv and an SPA HTML shell on
    login.ispot.tv.
  method: probed
- id: rfc8615-well-known
  conforms: false
  evidence: No /.well-known/ document is served on any iSpot host.
  method: probed
- id: rfc8594-sunset-header
  conforms: unknown
  evidence: >-
    Not observable without credentials; no Sunset/Deprecation header commitment
    is published.
compliance_program:
  published: false
  trust_center: https://trust.ispot.tv/
  trust_center_status: 403
  certifications: []
  note: >-
    iSpot links a dedicated trust-center subdomain from its site footer, but
    trust.ispot.tv returns HTTP 403 to automated clients, so no named
    certification (SOC 2, ISO 27001, PCI, HIPAA, FedRAMP) can be verified. No
    Compliance pointer is emitted — certifications are asserted nowhere we can
    read them, and inventing them would be fabrication.
privacy_posture:
  note: >-
    iSpot documents PII handling on the measurement pixel — PII passed through a
    customer-facing field is obfuscated — and publishes a developer-site
    Security & Privacy documentation section. This is a stated practice, not a
    certification.
  source: https://developer.ispot.tv/documentation/privacy-security
x-evidence:
- url: https://api.ispot.tv/v4/oauth2/token
  http_status: 400
  fetched: '2026-08-13'
- url: https://api.ispot.tv/v4/brands
  http_status: 401
  fetched: '2026-08-13'
- url: https://trust.ispot.tv/
  http_status: 403
  fetched: '2026-08-13'
- url: https://www.ispot.tv/.well-known/security.txt
  http_status: 404
  fetched: '2026-08-13'