specification: API Commons Conformance specificationVersion: '0.1' provider: Yahoo providerId: yahoo generated: '2026-08-28' method: searched source: >- https://api.login.yahoo.com/.well-known/openid-configuration , https://developer.yahoo.com/oauth2/guide/ , https://help.yahooinc.com/dsp-api/docs/ads-txt-targeting , https://help.yahooinc.com/dsp-api/docs/standard-yahoo-conversion-api , https://help.yahooinc.com/datax/docs/gdpr , https://help.yahooinc.com/dsp-api/docs/traffic-api-release-notes , https://developer.yahoo.com/.well-known/security.txt description: >- Cross-cutting and domain-standard conformance for the Yahoo API surface, asserted only where the contract or its documentation names the standard. Yahoo's identity service is a genuine OpenID Connect Discovery deployment, and its ad-tech APIs speak the IAB Tech Lab vocabulary end to end - ads.txt seller relationships, IAB video-placement taxonomy, TCF consent purpose bits and the Global Privacy Platform. Yahoo publishes no OpenAPI, no AsyncAPI and no RFC 9457 problem documents on any surface. standards: - id: oauth2 name: OAuth 2.0 (RFC 6749) conforms: true evidence: >- Authorization-code + refresh_token flows published in the OIDC discovery document at api.login.yahoo.com; client_credentials with a JWT client assertion documented for the DSP and DataX APIs. source: https://api.login.yahoo.com/.well-known/openid-configuration - id: oidc name: OpenID Connect Core / Discovery 1.0 conforms: true evidence: >- HTTP 200 discovery document with issuer, authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri, introspection_endpoint, revocation_endpoint, id_token_signing_alg_values_supported [ES256, RS256], scopes_supported and claims_supported. source: https://api.login.yahoo.com/.well-known/openid-configuration saved: well-known/yahoo-openid-configuration.json - id: oauth2-introspection name: OAuth 2.0 Token Introspection (RFC 7662) conforms: true evidence: introspection_endpoint https://api.login.yahoo.com/oauth2/introspect advertised in discovery. source: https://api.login.yahoo.com/.well-known/openid-configuration - id: oauth2-revocation name: OAuth 2.0 Token Revocation (RFC 7009) conforms: true evidence: token_revocation_endpoint https://api.login.yahoo.com/oauth2/revoke advertised in discovery. source: https://api.login.yahoo.com/.well-known/openid-configuration - id: jwt name: JSON Web Token (RFC 7519) / JWS conforms: true evidence: >- The DSP client_credentials flow requires the caller to sign an HS256 JWT client assertion; the Conversion API documentation cites the JOSE JSON Web Signature draft directly. source: https://help.yahooinc.com/dsp-api/docs/setup-access-guide - id: rfc9116 name: security.txt (RFC 9116) conforms: true evidence: >- HTTP 200 security.txt served across yahoo.com properties with Contact, Acknowledgments, Policy, Hiring and Expires fields. source: https://developer.yahoo.com/.well-known/security.txt saved: well-known/yahoo-security.txt - id: rfc4122 name: UUID (RFC 4122) conforms: true evidence: The Standard Yahoo Conversion API cites RFC 4122 for event identifier generation. source: https://help.yahooinc.com/dsp-api/docs/standard-yahoo-conversion-api - id: rfc9457 name: Problem Details for HTTP APIs (RFC 9457) conforms: false evidence: >- Both DSP error envelopes are vendor JSON shapes; the Fantasy Sports fault is an XML document in the yahooapis.com base.rng namespace. No application/problem+json is served. - id: openapi name: OpenAPI Specification conforms: false evidence: >- Probed /openapi.json, /openapi.yaml, /swagger.json, /api-docs and /redoc on developer.yahoo.com, developer.yahooinc.com, help.yahooinc.com, api.login.yahoo.com, dspapi.admanagerplus.yahoo.com and fantasysports.yahooapis.com - all 403/404. Yahoo distributes an API description as a Postman collection instead. - id: asyncapi name: AsyncAPI conforms: false evidence: No event/streaming contract is published; there is no webhook surface to describe. - id: rfc8594 name: Deprecation and Sunset HTTP headers (RFC 8594 / RFC 9745) conforms: false evidence: >- Deprecations are announced only on dated documentation pages; no Deprecation or Sunset response header is documented. - id: pagination name: Documented pagination conforms: true evidence: >- DSP Traffic API uses page/limit/sort/dir query parameters; Fantasy Sports uses start/count matrix parameters on collections. source: https://help.yahooinc.com/dsp-api/docs/campaigns - id: typed-link-relations name: Typed hypermedia link relations conforms: true evidence: >- DataX responses carry custom relation URIs under https://datax.yahooapis.com/rels/ plus opaque https://datax.yahooapis.com/v1/link/{token} resource links. DSP and Fantasy Sports return no links. source: https://help.yahooinc.com/datax/docs/post-audience - id: idempotency name: Idempotency keys conforms: false evidence: No idempotency key, dedupe window or safe-retry contract is documented on any surface. domain_standards: - id: iab-ads-txt name: IAB Tech Lab ads.txt / sellers.json seller relationships conforms: true market: programmatic advertising evidence: >- The Traffic API targeting resource exposes a SELLER_RELATIONSHIPS target type that lets a buyer target or exclude inventory by its ads.txt declaration, which requires the API to carry ads.txt authorization semantics as first-class contract values. location: 'POST /traffic/lines/{id}/targeting, targetType SELLER_RELATIONSHIPS' source: https://help.yahooinc.com/dsp-api/docs/ads-txt-targeting - id: iab-video-placement name: IAB video ad placement taxonomy conforms: true market: programmatic advertising evidence: >- Yahoo realigned both the Traffic API (videoAdPlcmts) and the Reporting API (dimension type ID 1240, "Video Ad Placement (IAB)") to the latest IAB video placement guidelines in August 2025 and announced it in both release-note registers. location: 'Traffic API videoAdPlcmts parameter; Reporting API dimensionTypeId 1240' source: https://help.yahooinc.com/dsp-api/docs/traffic-api-release-notes - id: iab-tcf name: IAB Transparency and Consent Framework (TCF) purpose bits conforms: true market: programmatic advertising / EU data protection evidence: >- The DataX API accepts a gdpr_euconsent attribute carrying IAB Purpose bit descriptions (storage and access of information, personalisation, ad selection and delivery, measurement) alongside a jurisdiction flag. location: DataX GDPR request attributes gdpr / gdpr_euconsent source: https://help.yahooinc.com/datax/docs/gdpr - id: iab-gpp name: IAB Global Privacy Platform (GPP) conforms: true market: programmatic advertising / privacy signalling evidence: >- The Standard Yahoo Conversion API documentation links the IAB Global Privacy Platform Section Information specification for the consent string it accepts. location: Standard Yahoo Conversion API consent fields source: https://help.yahooinc.com/dsp-api/docs/standard-yahoo-conversion-api - id: openrtb name: OpenRTB conforms: unknown market: programmatic advertising evidence: >- Yahoo operates a DSP that necessarily bids into OpenRTB exchanges, but the published API contract for the Traffic, Reporting, Conversion and DataX APIs never names OpenRTB. Recorded as unknown rather than asserted - the buy-side management API is not the bid contract. compliance_certifications: published: false note: >- No trust center and no named certification (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP) is published on yahooinc.com/paranoids/ or elsewhere on the developer surface. Yahoo publishes a Controls and Policies PDF and a transparency report, neither of which is an attestation. No Compliance pointer is emitted for this provider. regulatory: - regime: GDPR evidence: >- DataX documents a full GDPR handling model - jurisdiction flag, consent attributes, opt-out handling and separate taxonomy / audience / cookie-mapping GDPR considerations pages. source: https://help.yahooinc.com/datax/docs/gdpr maintainers: - FN: Kin Lane email: kin@apievangelist.com