generated: '2026-08-02'
method: derived
source: >-
  openapi/outdoorsy-openapi-original.json, openapi/outdoorsy-search-openapi-original.json,
  live probes 2026-08-02, https://developers.outdoorsy.com/api
standards:
- id: openapi-3
  conforms: false
  evidence: >-
    Both contracts are Swagger 2.0 (`"swagger": "2.0"`), not OpenAPI 3.x. Upgrading is the single
    highest-leverage contract improvement available to Outdoorsy.
- id: swagger-2.0
  conforms: true
  evidence: >-
    https://api.outdoorsy.com/swagger.json and https://search.outdoorsy.com/swagger.json both parse
    as valid Swagger 2.0 with `paths` and `definitions`.
- id: rest
  conforms: true
  evidence: >-
    Resource-oriented URLs, standard verbs (GET/POST/PATCH/DELETE) and standard status codes, as
    stated in the contract's own info.description.
- id: json-api
  conforms: partial
  evidence: >-
    The Search API declares `produces: [application/vnd.api+json]` and returns JSON:API-shaped
    documents (`data[]` with id/type/attributes, `included[]`, `meta`) and JSON:API-shaped error
    objects (status/code/detail), and uses `page[limit]`/`page[offset]`. However it serves those
    bodies with `Content-Type: text/plain; charset=utf-8` rather than the JSON:API media type, so
    it is not conformant. The core API is not JSON:API at all.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use proprietary envelopes (`{error, code, original_error}` on the core API,
    `{status, code, detail}` on search). No `application/problem+json` anywhere.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme in either contract. The platform does expose social-login OAuth for
    end users (GET /auth/{provider}/login, GET /auth/{provider}/callback for facebook, google,
    apple), but this is consumer sign-in, not an API authorization framework for partners.
- id: oidc
  conforms: false
  evidence: '/.well-known/openid-configuration returned 404/405 on every host probed 2026-08-02.'
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: '/.well-known/oauth-authorization-server returned 404/405 on every host probed 2026-08-02.'
- id: rfc9116-security-txt
  conforms: false
  evidence: '/.well-known/security.txt returned 403 (Cloudflare) / 404 / 405 on every host probed 2026-08-02.'
- id: rfc8615-well-known
  conforms: false
  evidence: 'No /.well-known/ document served on any Outdoorsy host.'
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header support and no deprecation policy published.
- id: rfc9331-ratelimit-headers
  conforms: false
  evidence: >-
    Rate limits are signalled via non-standard X-Rate-Limit-Limit / X-Rate-Limit-Duration headers
    rather than the RateLimit-* draft standard. No 429 declared in the contract.
- id: idempotency-key
  conforms: false
  evidence: No Idempotency-Key header, parameter or extension in either contract.
- id: pagination
  conforms: true
  evidence: >-
    Consistent limit/offset on the core API (28 operations) and page[limit]/page[offset] on the
    search API, with a Total-Results response header on both.
- id: semver
  conforms: partial
  evidence: >-
    The contract declares "The API implements semantic versioning" but ships info.version 0.0.1 on
    a /v0 base path, with no published version history to verify the claim against.
- id: iso-4217
  conforms: true
  evidence: 'Currency codes usd, gbp, cad, eur, aud, nzd documented on https://developers.outdoorsy.com/api.'
- id: bcp47-language-tags
  conforms: true
  evidence: 'Locales en-us, en-gb, en-ca, en-au, en-nz, fr-fr, fr-ca, es-es, de-de, it-it.'
- id: icalendar-rfc5545
  conforms: true
  evidence: >-
    Six ics-calendar operations expose iCalendar availability import/export for rentals; the
    provider maintains a fork of golang-ical at https://github.com/outdoorsy/golang-ical.
- id: mcp
  conforms: false
  evidence: No hosted MCP server found; no /mcp endpoint on any Outdoorsy host.
- id: a2a
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json probed on outdoorsy.com,
    www.outdoorsy.com, developers.outdoorsy.com, api.outdoorsy.com and search.outdoorsy.com on
    2026-08-02 — all 403 (Cloudflare HTML) / 404 / 405. No agent card published.
- id: asyncapi
  conforms: false
  evidence: >-
    No event, streaming or webhook surface found. "webhook" appears nowhere in either contract and
    the developer portal documents no callbacks. Not applicable rather than deficient.
compliance_program:
  published: false
  trust_center: null
  certifications: []
  note: >-
    No trust centre, compliance page or named certification (SOC 2 / ISO 27001 / PCI DSS) was found
    on any Outdoorsy host by probe-security-programs.py on 2026-08-02. No `Compliance` pointer is
    emitted. Note that the platform does process card payments via Stripe (X-Ppp-Token) and runs
    identity verification via Persona, but Outdoorsy publishes no compliance posture of its own.