generated: '2026-07-21'
method: derived
source: openapi/sprig-api-openapi-original.json
standards:
  - id: openapi-3.1
    conforms: true
    evidence: Spec published as OpenAPI 3.1.0 at docs.sprig.com/reference/sprig-api.json
  - id: oauth2
    conforms: true
    evidence: MCP server uses OAuth 2.0 authorization_code + PKCE (S256); metadata at mcp.sprig.com/.well-known/oauth-authorization-server
  - id: rfc8414-oauth-metadata
    conforms: true
    evidence: /.well-known/oauth-authorization-server returns 200
  - id: rfc9728-protected-resource-metadata
    conforms: true
    evidence: /.well-known/oauth-protected-resource returns 200
  - id: mcp
    conforms: true
    evidence: Official hosted MCP server at https://mcp.sprig.com/mcp
  - id: api-key-auth
    conforms: true
    evidence: REST API uses Authorization header API key (apiKeyAuth security scheme)
  - id: rfc9457-problem-details
    conforms: false
    evidence: Error responses declared by HTTP status only; no application/problem+json body
  - id: gdpr-ccpa
    conforms: true
    evidence: POST /v2/purge/visitors purges visitor data for GDPR/CCPA compliance; DPA published at sprig.com/dpa
  - id: cursor-pagination
    conforms: true
    evidence: Export endpoints support opaque cursor + limit (max 1000) pagination