generated: '2026-09-02' method: searched source: https://vergesense.readme.io/reference/spaces_detections sources: - https://vergesense.readme.io/reference/spaces_detections - https://vergesense.readme.io/reference/hardware_sensors - https://vergesense.readme.io/reference/links - https://vergesense.readme.io/reference/reference-getting-started - https://mcp.vergesense.com/.well-known/oauth-protected-resource/mcp - https://www.vergesense.com/privacy-policy - openapi/vergesense-api-openapi.json summary: >- VergeSense declares one cross-cutting media-type standard in its contract (JSON:API, named by URL in the descriptions of its paginated collection endpoints) and implements two OAuth discovery RFCs on the MCP surface. It declares NO domain standard for the workplace/PropTech market it sells into — no Brick Schema, no Project Haystack, no BACnet/Web Services, no RESO, no ASHRAE/IFC identifier scheme appears anywhere in the contract or the docs. That is recorded as not-declared, not as a failure: domain_standard_conformance is reward-only and this market's standards are optional. standards: - id: jsonapi name: 'JSON:API v1.x' conforms: true scope: partial evidence: type: contract-description detail: >- The published OpenAPI operation descriptions for /spaces/detections, /hardware/sensors and /hardware/gateways each state "Response conforms to the JSON API spec https://jsonapi.org/", and the Links reference page documents the links.next / links.previous members with page[number] / page[size] query parameters — the JSON:API pagination profile. locations: - openapi/vergesense-api-openapi.json#/paths/~1spaces~1detections/get/description - openapi/vergesense-api-openapi.json#/paths/~1hardware~1sensors/get/description - openapi/vergesense-api-openapi.json#/paths/~1hardware~1gateways/get/description urls: - https://vergesense.readme.io/reference/spaces_detections - https://vergesense.readme.io/reference/links additional_evidence: type: response-examples detail: >- The conformance is broader than the three descriptions that name it. The response examples embedded in the published spec show the JSON:API DOCUMENT structure across the metrics surface too — success bodies are {"data":[{"id","type":"metrics_hourly_space","attributes":{...}}]} and error bodies are the JSON:API errors object {"errors":[{"status","title","detail","source":{"parameter"}}]}. That is the resource-object and error-object shape, not merely the pagination profile. file: examples/vergesense-api-examples.json caveat: >- Three deviations keep this from being full conformance. The API does not advertise the JSON:API media type (application/vnd.api+json) — responses are application/json. The optional errors[].code member is never emitted, so there is no stable application error code. And two operations break the error envelope outright: GET /buildings/{building_ref_id}/history returns errors[] as an array of bare strings, and GET /buildings documents an empty object. - id: iso8601 name: ISO 8601 date and time conforms: true evidence: type: documented detail: >- "Timestamps should be specified in ISO 8601 format... Timestamps will be returned in ISO 8601 UTC format, for example: 2019-01-15T23:30:28Z." Both offset and Z request forms are accepted. url: https://vergesense.readme.io/reference/reference-getting-started - id: rfc9728 name: OAuth 2.0 Protected Resource Metadata conforms: true surface: mcp evidence: type: probed detail: >- https://mcp.vergesense.com/mcp answers an anonymous request with 401 and WWW-Authenticate: Bearer resource_metadata="https://mcp.vergesense.com/.well-known/oauth-protected-resource/mcp"; that document resolves 200 and carries resource, authorization_servers and bearer_methods_supported. url: https://mcp.vergesense.com/.well-known/oauth-protected-resource/mcp file: well-known/vergesense-mcp-oauth-protected-resource.json probed: '2026-09-02' - id: oauth2 name: OAuth 2.0 conforms: true scope: mcp-only evidence: type: probed detail: >- The MCP surface is bearer-token OAuth 2.0 delegated to https://vergesense.auth0.com/. The REST API at api.vergesense.com is NOT OAuth — it uses a static vs-api-key header. url: https://vergesense.auth0.com/.well-known/openid-configuration file: well-known/vergesense-auth0-openid-configuration.json - id: oidc name: OpenID Connect Discovery 1.0 conforms: true scope: authorization-server-only operator: Auth0 tenant operated for VergeSense evidence: type: probed detail: >- https://vergesense.auth0.com/.well-known/openid-configuration returns 200 with issuer https://vergesense.auth0.com/ and advertises authorization_code, client_credentials, refresh_token and device_code grants plus dynamic client registration at /oidc/register. url: https://vergesense.auth0.com/.well-known/openid-configuration caveat: >- This is discovery on the identity provider, delivered by Auth0's platform, not something VergeSense implemented on its own product API. Recorded honestly at that strength. - id: openapi name: OpenAPI 3.1.0 conforms: true evidence: type: contract detail: >- A valid OpenAPI 3.1.0 document with 36 operations, every one carrying an operationId, a summary and a description, and an apiKey securityScheme applied globally. file: openapi/vergesense-api-openapi.json - id: rfc9457 name: 'RFC 9457 Problem Details for HTTP APIs' conforms: false evidence: type: contract detail: >- No operation declares application/problem+json. 400 and 404 responses are application/json with no declared schema at all. file: openapi/vergesense-api-openapi.json see_also: errors/vergesense-problem-types.yml - id: rfc8594 name: 'RFC 8594 The Sunset HTTP Header Field' conforms: false evidence: type: documented-absence detail: >- Deprecations are announced in a changelog with an effective date, but no Sunset or Deprecation response header is emitted and no operation in the spec carries deprecated: true. url: https://headwayapp.co/vergesense-changelog/deprecating-space-type-attributes-333231 see_also: lifecycle/vergesense-lifecycle.yml - id: rfc9116 name: 'RFC 9116 security.txt' conforms: false evidence: type: probed detail: /.well-known/security.txt returned 404 on www.vergesense.com, api.vergesense.com, api.azure.vergesense.com, mcp.vergesense.com and vergesense.readme.io. file: well-known/vergesense-well-known.yml probed: '2026-09-02' - id: a2a name: A2A Agent Card conforms: false evidence: type: probed detail: /.well-known/agent-card.json and the legacy /.well-known/agent.json returned 404 on every host probed. file: well-known/vergesense-well-known.yml probed: '2026-09-02' - id: asyncapi name: AsyncAPI conforms: false evidence: type: documented-absence detail: >- A real event surface exists (three documented webhook event types) but no AsyncAPI document is published for it. see_also: asyncapi/vergesense-webhooks.yml - id: gdpr name: EU General Data Protection Regulation conforms: claimed evidence: type: prose detail: >- The privacy policy states compliance with GDPR and CCPA and names VergeSense, Inc. (2261 Market Street #5058, San Francisco, CA 94114) as controller, with support@vergesense.com as the privacy contact. This is a self-declaration in a policy document, not a certification, and no DPO is named. url: https://www.vergesense.com/privacy-policy - id: ccpa name: California Consumer Privacy Act conforms: claimed evidence: type: prose detail: Named in the privacy policy alongside GDPR. Self-declared, uncertified. url: https://www.vergesense.com/privacy-policy domain_standard: declared: false market: workplace occupancy intelligence / corporate real estate / smart buildings probed_for: - {standard: Brick Schema, found: false} - {standard: Project Haystack, found: false} - {standard: BACnet / BACnet Web Services, found: false} - {standard: ASHRAE 223P, found: false} - {standard: IFC / buildingSMART, found: false} - {standard: RESO Data Dictionary, found: false} - {standard: OGC GeoJSON, found: partial} geojson_note: >- The Predict API takes a GeoJSON of the spaces on a floor as its request body (see https://vergesense.readme.io/reference/predict-api-geojson), which is the closest thing to a domain interchange format in this contract. GeoJSON is RFC 7946, a geometry encoding rather than a workplace-domain data model, so it is recorded as partial and NOT claimed as domain-standard conformance. assessment: >- VergeSense models buildings, floors, spaces, space types, neighborhoods and space groups in a proprietary vocabulary with a dual identifier scheme (VergeSense numeric ids alongside customer-defined *_ref_id strings). The *_ref_id design is a deliberate BYO-identifier bridge to a customer's IWMS/CAFM rather than an adoption of a shared industry ontology. A buyer already speaking Brick or Haystack needs a bespoke mapping. Reward-only check: no penalty is implied. compliance_certifications: published: false probes: - {url: 'https://trust.vergesense.com', status: NXDOMAIN} - {url: 'https://www.vergesense.com/security', status: 404} - {url: 'https://www.vergesense.com/trust', status: 404} - {url: 'https://www.vergesense.com/data-privacy-security', status: 404} note: >- No trust centre and no named certification (SOC 2, ISO 27001, PCI, HIPAA, FedRAMP) is published on any reachable VergeSense page, and the privacy policy names none. NO Compliance and NO TrustCenter pointer is emitted in apis.yml — an unsupported Compliance pointer would be a claim made on the provider's behalf. For a vendor selling occupancy sensors into Fortune 500 offices this is a conspicuous gap; the certifications may well exist behind the sales process, but they are not public. checked: '2026-09-02'