generated: '2026-08-14' method: searched source: https://apidocs.nextroll.com/guides/oauth.html standards: - id: oauth2 name: OAuth 2.0 (RFC 6749) conforms: true evidence: >- The OAuth guide states "AdRoll's OAuth implementation conforms to RFC 6749" and documents /auth/authorize and /auth/token with authorization-code, implicit and resource-owner-password grants. source: https://apidocs.nextroll.com/guides/oauth.html - id: rfc6750-bearer name: OAuth 2.0 Bearer Token Usage (RFC 6750) conforms: true evidence: Bearer tokens accepted via Authorization header, form-encoded body parameter and URL query parameter, as defined in RFC 6750. source: https://apidocs.nextroll.com/guides/oauth.html - id: oauth21 name: OAuth 2.1 (MCP surface only) conforms: partial evidence: >- The AdRoll MCP Server authorization server advertises S256 PKCE, authorization code and refresh token grants only, and dynamic client registration — an OAuth 2.1 shaped deployment. Scoped to https://services.adroll.com/mcp; the developer API OAuth deployment still offers the implicit and password grants OAuth 2.1 removes. source: well-known/nextroll-oauth-authorization-server.json - id: rfc8414 name: OAuth 2.0 Authorization Server Metadata (RFC 8414) conforms: true evidence: 'https://services.adroll.com/.well-known/oauth-authorization-server returns 200 application/json with issuer, authorization_endpoint, token_endpoint, registration_endpoint, revocation_endpoint, introspection_endpoint, response_types_supported, grant_types_supported, code_challenge_methods_supported, token_endpoint_auth_methods_supported and scopes_supported.' source: well-known/nextroll-oauth-authorization-server.json - id: rfc9728 name: OAuth 2.0 Protected Resource Metadata (RFC 9728) conforms: true evidence: 'https://services.adroll.com/.well-known/oauth-protected-resource returns 200 with resource, authorization_servers, scopes_supported, bearer_methods_supported and resource_documentation.' source: well-known/nextroll-oauth-protected-resource.json - id: rfc7591-dcr name: OAuth 2.0 Dynamic Client Registration (RFC 7591) conforms: true evidence: registration_endpoint https://services.adroll.com/mcp/auth/register is advertised in the authorization-server metadata. source: well-known/nextroll-oauth-authorization-server.json - id: rfc7662-introspection name: OAuth 2.0 Token Introspection (RFC 7662) conforms: true evidence: introspection_endpoint advertised at https://services.adroll.com/mcp/auth/introspect. source: well-known/nextroll-oauth-authorization-server.json - id: rfc7009-revocation name: OAuth 2.0 Token Revocation (RFC 7009) conforms: true evidence: revocation_endpoint advertised at https://services.adroll.com/mcp/auth/revoke. source: well-known/nextroll-oauth-authorization-server.json - id: mcp name: Model Context Protocol conforms: true evidence: >- JSON-RPC endpoint at https://services.adroll.com/mcp answers a tools/list POST with an RFC 6750 WWW-Authenticate challenge rather than a transport error, and NextRoll announced the AdRoll MCP Server publicly on 2026-05-27. source: https://www.adroll.com/blog/adroll-mcp-server - id: graphql name: GraphQL conforms: partial evidence: >- A real GraphQL endpoint with a published schema reference and a hosted GraphiQL console — but the error contract deliberately departs from the GraphQL specification's error handling in favour of a proprietary has_errors / errors[id] propagation model. source: https://apidocs.nextroll.com/graphql-reporting-api/overview.html - id: openapi name: OpenAPI conforms: false authored_but_unpublished: true evidence: >- No OpenAPI or Swagger document is REACHABLE, but NextRoll demonstrably AUTHORS them. The reference pages are built by the Sphinx `openapi:spec` directive, and the published reStructuredText sources name the source files directly — e.g. https://apidocs.nextroll.com/_sources/audience-api/reference.rst.txt (HTTP 200) contains the single line `.. openapi:spec:: ../apispecs/audience.json`. Seven such documents are named across the reference pages. None is deployed: every https://apidocs.nextroll.com/apispecs/.json returns HTTP 404 NoSuchKey from the S3 origin, so the specs exist in the docs build and stop there. Corroborated by the Sphinx inventory (https://apidocs.nextroll.com/objects.inv, HTTP 200), which carries 120 `openapi:schema` objects — component schema names that only an OpenAPI document could have produced. authored_specs: - spec: apispecs/adroll.json renders: crud-api/reference.html probe: {url: 'https://apidocs.nextroll.com/apispecs/adroll.json', status: 404} - spec: apispecs/audience.json renders: audience-api/reference.html probe: {url: 'https://apidocs.nextroll.com/apispecs/audience.json', status: 404} - spec: apispecs/prospecting.json renders: prospecting-api/reference.html probe: {url: 'https://apidocs.nextroll.com/apispecs/prospecting.json', status: 404} - spec: apispecs/user-lists.json renders: user-lists-api/reference.html probe: {url: 'https://apidocs.nextroll.com/apispecs/user-lists.json', status: 404} - spec: apispecs/geotargeting.json renders: geotargeting-api/reference.html probe: {url: 'https://apidocs.nextroll.com/apispecs/geotargeting.json', status: 404} - spec: apispecs/universal-campaigns.json renders: universal-campaigns-api/reference.html probe: {url: 'https://apidocs.nextroll.com/apispecs/universal-campaigns.json', status: 404} - spec: apispecs/automated-campaigns.json renders: automated-campaigns-api/reference.html status: retired service probe: {url: 'https://apidocs.nextroll.com/apispecs/automated-campaigns.json', status: 404} - spec: apispecs/graphql-reporting.json renders: graphql-reporting-api/reference.html note: describes the HTTP envelope around the GraphQL endpoint, not the GraphQL schema itself. probe: {url: 'https://apidocs.nextroll.com/apispecs/graphql-reporting.json', status: 404} provider_ask: >- This is the single cheapest, highest-value change available to NextRoll. The OpenAPI documents already exist and are already the source of truth for the public reference pages; publishing them at a stable URL alongside the rendered HTML is a build-output change, not an authoring effort. Doing so would give every agent and client generator a machine-readable contract where today there is only HTML. checked: '2026-08-14' - id: asyncapi name: AsyncAPI conforms: false evidence: No AsyncAPI document published. The S2S Event API is documented in prose with JSON examples. - id: rfc9457-problem-details name: RFC 9457 Problem Details conforms: false evidence: Errors use a proprietary {"errors":[{message, code|field}]} envelope, not application/problem+json. source: https://apidocs.nextroll.com/crud-api/api-usage.html - id: rfc8594-sunset name: Sunset HTTP header (RFC 8594) conforms: false evidence: No Sunset or Deprecation header support documented; retirements are announced as documentation banners. - id: rfc9116-security-txt name: security.txt (RFC 9116) conforms: false evidence: No /.well-known/security.txt on any NextRoll or AdRoll host. source: well-known/nextroll-well-known.yml - id: idempotency-key name: Idempotency-Key HTTP header conforms: false evidence: No idempotency key or request-deduplication contract is documented for any write operation. source: conventions/nextroll-conventions.yml - id: iso8601 name: ISO 8601 date and time conforms: true evidence: The published data-type table defines DateTime as ISO 8601, and all dates and times are stated to be UTC. source: https://apidocs.nextroll.com/crud-api/api-usage.html - id: iso4217 name: ISO 4217 currency codes conforms: true evidence: The S2S event `currency` field is documented as supporting three-letter ISO 4217 currency codes. source: https://apidocs.nextroll.com/server-to-server-api/events.html - id: rfc5322-email name: Internet Message Format email addresses (RFC 5322) conforms: true evidence: Audience API CRM user records specify email in the RFC 5322 standard. source: https://apidocs.nextroll.com/audience-api/overview.html compliance_programs: source: https://security.nextroll.com/ see: security/nextroll-trust-center.yml certifications: - SOC 2 Type 2 - SOC 3 - PCI DSS privacy_regimes: - GDPR - CCPA / CPRA - COPPA self_assessments: - ISO 27001 - 2013 - CAIQ v4.0.2 - SIG Lite - VSA Full industry_programs: - IAB member - NAI member and NAI Code of Conduct - TAG registered - EDAA certified