generated: '2026-08-13' method: derived source: >- Derived from openapi/ (securitySchemes, error schema, pagination parameters, declared status codes), from the live /.well-known/ probes saved under well-known/, and from https://tapfiliate.com/docs/rest/, https://tapfiliate.com/bug-bounty/ and https://support.tapfiliate.com/en/articles/16011230-how-to-use-your-new-affiliate-analyst-the-tapfiliate-mcp-server. description: >- Cross-cutting standards conformance for Tapfiliate. The pattern is stark: the REST API v1.6 conforms to almost nothing beyond plain REST-over-HTTPS, while the 2026 MCP server is built to current specification — RFC 9728 protected resource metadata, RFC 8414 authorization server metadata, RFC 7636 PKCE and RFC 7591 dynamic client registration, all verified by anonymous live probe. standards: - id: oauth2 conforms: true evidence: >- The MCP server at https://mcp.tapfiliate.com/mcp is an OAuth 2.0 protected resource. authorization_code + refresh_token grants, response_type code. Verified by fetching the authorization-server metadata (HTTP 200). The REST API itself does NOT use OAuth. - id: rfc9728-oauth-protected-resource-metadata conforms: true evidence: >- https://mcp.tapfiliate.com/.well-known/oauth-protected-resource returns 200 with resource, authorization_servers, scopes_supported and bearer_methods_supported. The 401 challenge on the MCP endpoint carries a matching WWW-Authenticate resource_metadata parameter. - id: rfc8414-oauth-authorization-server-metadata conforms: true evidence: >- https://mcp.tapfiliate.com/.well-known/oauth-authorization-server returns 200 with issuer, authorization_endpoint, token_endpoint, registration_endpoint and jwks_uri. - id: rfc7636-pkce conforms: true evidence: code_challenge_methods_supported ["S256"] in the AS metadata. - id: rfc7591-dynamic-client-registration conforms: true evidence: >- registration_endpoint https://app.tapfiliate.com/oauth/v2/register/ declared in the AS metadata, with client_id_metadata_document_supported true. - id: rfc9116-security-txt conforms: true evidence: >- https://tapfiliate.com/.well-known/security.txt returns 200 with Contact, Policy and Expires fields. Saved verbatim to well-known/tapfiliate-security.txt. - id: mcp conforms: true evidence: >- Official remote MCP server documented by the provider with a JSON-RPC HTTP endpoint; anonymous JSON-RPC POST returns a well-formed JSON-RPC error object. Live schema gated by OAuth. - id: oidc conforms: false evidence: >- /.well-known/openid-configuration returns 404 on api.tapfiliate.com and mcp.tapfiliate.com and 403 on tapfiliate.com. No OIDC discovery document. - id: api-key-header-auth conforms: true evidence: >- openapi securitySchemes declare a single apiKey scheme in the X-Api-Key header, applied globally. - id: idempotency conforms: false evidence: >- No idempotency key mechanism of any kind in the docs or the contract; the string "idempot" does not occur in the rendered REST reference. See conventions/tapfiliate-conventions.yml. - id: pagination conforms: true evidence: >- Page-number pagination via ?page (1-based), default 25 items, with RFC 8288 Link header relations next/prev. No total count or has_more field. - id: rfc8288-web-linking conforms: true evidence: >- Pagination information is carried in a Link header with rel="next" and rel="prev", documented at https://tapfiliate.com/docs/rest/#header-link-header. - id: rfc9457-problem-details conforms: false evidence: >- Errors are a bare {"message": string} object, media type application/json. No type, title, status, detail or instance members; no application/problem+json. - id: rfc8594-sunset-header conforms: false evidence: No deprecation policy and no Sunset/Deprecation headers documented. - id: webhook-signing conforms: false evidence: >- Trigger webhooks are documented but no payload signature, timestamp or replay protection is described; the only outbound credential is a header the caller sets themselves. - id: asyncapi conforms: false evidence: >- An event surface exists (trigger webhooks) but no AsyncAPI document is published. Catalogued instead at asyncapi/tapfiliate-webhooks.yml. - id: openapi conforms: false evidence: >- Tapfiliate publishes no OpenAPI/Swagger document. Probed api.tapfiliate.com/openapi.json, /openapi.yaml, /swagger.json, /1.6/openapi.json, /api-docs, /docs (all 404), tapfiliate.com/openapi.json (404) and tapfiliate.com/docs/rest/openapi.json, swagger.json, openapi.yaml (all 404). The specs in openapi/ are API Evangelist's own capture of the published HTML reference, not a provider artifact. - id: graphql conforms: false evidence: No GraphQL surface is documented or discoverable. - id: grpc conforms: false evidence: No .proto or gRPC surface published on the site or the GitHub org. - id: a2a conforms: false evidence: >- /.well-known/agent-card.json and /.well-known/agent.json probed on tapfiliate.com (403), api.tapfiliate.com (404), app.tapfiliate.com (404) and mcp.tapfiliate.com (404). No agent card served. - id: llms-txt conforms: false evidence: >- /llms.txt returns 404 on tapfiliate.com, tapfiliate.com/docs/ and mcp.tapfiliate.com. - id: scim conforms: false - id: odata conforms: false - id: json-api conforms: false - id: fhir conforms: false - id: fapi conforms: false - id: psd2 conforms: false compliance_certifications: published: false note: >- No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim is published on tapfiliate.com — checked the bug-bounty page, the MCP page, the terms and the privacy policy. Tapfiliate B.V. is a Netherlands entity and its privacy policy addresses GDPR obligations, but there is no trust centre and no named certification, so no Compliance pointer is emitted.