generated: '2026-08-13'
method: searched
source: >-
  Derived from the three first-party specs in openapi/ and the probed documents in well-known/,
  cross-checked against https://trust.mparticle.com/, https://www.mparticle.com/security/ and
  https://docs.mparticle.com/
standards:
  - id: openapi-3.0
    conforms: true
    evidence: >-
      openapi/mparticle-events-openapi-original.yml is OpenAPI 3.0.3 and
      openapi/mparticle-dataplanning-openapi-original.yml is OpenAPI 3.0.2, both published by
      mParticle at https://docs.mparticle.com/downloads/.
  - id: swagger-2.0
    conforms: true
    evidence: >-
      openapi/mparticle-identity-swagger-original.yml is Swagger 2.0, published at
      https://docs.mparticle.com/downloads/identity-swagger.yaml. Not upgraded to OpenAPI 3.
  - id: openapi-3.1
    conforms: false
    evidence: No mParticle spec is published at 3.1.
  - id: oauth2
    conforms: true
    evidence: >-
      OAuth 2.0 client-credentials grant at https://sso.auth.mparticle.com/oauth/token with an
      audience parameter, protecting the Platform, Data Planning and Warehouse Sync APIs.
  - id: oauth2-scopes
    conforms: false
    evidence: >-
      No scope parameter and no scope registry are documented; authorization is carried by the
      credential plus AccountId/workspace_id. No scopes/ artifact is emitted.
  - id: rfc8414-oauth-authorization-server-metadata
    conforms: true
    evidence: >-
      https://sso.auth.mparticle.com/.well-known/oauth-authorization-server returns 200 with the
      authorization-server metadata document (saved as
      well-known/mparticle-openid-configuration.json).
  - id: oidc-discovery
    conforms: true
    evidence: >-
      https://sso.auth.mparticle.com/.well-known/openid-configuration returns 200 with issuer,
      authorization_endpoint, token_endpoint, jwks_uri and userinfo_endpoint.
  - id: rfc7519-jwt
    conforms: true
    evidence: Bearer tokens are JWTs; bearerFormat JWT in the Data Planning spec, JWKS published.
  - id: rfc7617-http-basic
    conforms: true
    evidence: Events API and IDSync accept HTTP Basic with the workspace key/secret.
  - id: hmac-request-signing
    conforms: true
    evidence: >-
      IDSync publishes an HMAC-SHA256 request digest scheme over x-mp-key / Date /
      x-mp-signature and recommends it over Basic.
  - id: rfc9116-security-txt
    conforms: true
    evidence: >-
      https://www.mparticle.com/.well-known/security.txt returns 200 text/plain with Contact,
      Policy, Canonical, Expires and Preferred-Languages fields. NOTE - the Expires field reads
      2024-06-02, so the document is expired under RFC 9116 even though it is served and its
      contact details are current (security@rokt.com).
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use a vendor {"errors":[{"code","message"}]} envelope, not
      application/problem+json. See errors/mparticle-problem-types.yml.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No Sunset or Deprecation response headers and no deprecation policy are published.
  - id: rfc6585-429
    conforms: true
    evidence: 429 with Retry-After on the Events API, plus the X-mp-rate-limit-* header family.
  - id: json-schema
    conforms: true
    evidence: >-
      mParticle publishes the Events API request contract as JSON Schema
      (json-schema/mparticle-eventsapi-schema.json, harvested from
      https://docs.mparticle.com/schema/mparticle.inbound.eventsapi.schema.json) and the Data
      Planning product validates event batches against customer-authored JSON Schema data plans.
  - id: idempotency
    conforms: false
    evidence: No idempotency key or deduplication contract is published. See conventions/.
  - id: pagination
    conforms: false
    evidence: No list operation in any published spec exposes limit/offset/cursor parameters.
  - id: json-api
    conforms: false
  - id: odata
    conforms: false
  - id: scim
    conforms: false
  - id: fhir
    conforms: false
  - id: graphql
    conforms: false
    evidence: No GraphQL endpoint is documented or discoverable on any mParticle host.
  - id: mcp
    conforms: false
    evidence: No MCP server published. See mcp/mparticle-mcp.yml.
  - id: a2a
    conforms: false
    evidence: >-
      No agent card at /.well-known/agent-card.json or /.well-known/agent.json on any mParticle
      host. See well-known/mparticle-well-known.yml.
  - id: asyncapi
    conforms: false
    evidence: >-
      mParticle operates a real outbound event surface (the Webhook output integration) but
      publishes no AsyncAPI document for it. See asyncapi/mparticle-webhooks.yml.
compliance:
  published: true
  url: https://trust.mparticle.com/
  certifications:
    - SOC 2
    - ISO 27001
    - GDPR
  privacy_regimes:
    - id: gdpr
      supported: true
      evidence: >-
        GDPRConsentState in the Events API schema, plus a Data Subject Request API (v2 and v3)
        for access/erasure requests.
    - id: ccpa-cpra
      supported: true
      evidence: CCPAConsentState in the Events API schema and DSR API coverage.
  detail: security/mparticle-trust-center.yml