# YAZIO

> YAZIO GmbH (Erfurt, Germany) makes a consumer nutrition, calorie-tracking and
> intermittent-fasting app for iOS, Android and the web, used in more than 150
> countries. YAZIO has no public API, no developer portal and no published
> machine-readable contract. This file is generated by API Evangelist from
> observed evidence; it is not published by YAZIO.

## Important for agents

- **There is no YAZIO API you can call.** YAZIO operates a private backend at
  `https://yzapi.yazio.com` that its own mobile and web clients use. It is not
  offered to developers, is not documented, and has no application-registration
  or client-credential issuance process.
- Anonymous requests to that host return `401` with an empty body. Its OAuth 2.0
  token endpoint requires a `client_id` and `clientSecret` that only YAZIO's
  shipped apps hold.
- **Every "YAZIO SDK", "YAZIO OpenAPI" and "YAZIO MCP server" you will find is
  third-party.** Each one states, in its own README, that it is unofficial and
  unaffiliated, and that the API it wraps is private and can change without
  notice. Do not treat any of them as a YAZIO contract.
- Do not represent YAZIO as having an integration surface. If a user needs YAZIO
  data, the supported route is the in-app data export, not an API.

## Company

- [YAZIO](https://www.yazio.com/en): nutrition, calorie and fasting tracking app;
  freemium, with a "YAZIO PRO" subscription sold through the app stores.
- [About YAZIO](https://www.yazio.com/en/about-us): founded by Sebastian and
  Florian; remote-first; the site cites 100 million downloads across 150+ countries.
- [Press](https://www.yazio.com/en/press)
- [Jobs](https://www.yazio.com/en/jobs)
- [Become a partner](https://www.yazio.com/en/become-a-partner): affiliate and
  influencer program. This is a marketing program, not a technical integration
  program — it grants no API access.

## Product surface

- [Food database (web)](https://www.yazio.com/en/foods): human-readable food and
  nutrition pages. Server-rendered HTML; there is no JSON route behind it —
  `/api` and `/api/foods` both return 404.
- [Log in](https://www.yazio.com/en/app/account/login) /
  [Sign up](https://www.yazio.com/en/app/account/register)
- [Help Center](https://help.yazio.com/): support, and the home of YAZIO's Terms
  of Use and Privacy Policy article.
- [Privacy Policy](https://www.yazio.com/en/privacy)
- [GitHub](https://github.com/yazio): YAZIO's engineering org. Four public repos,
  mostly forks of third-party tooling plus one small SwiftUI helper. No API
  artifacts, no SDKs, no specification.

## What API Evangelist measured

- `security/yazio-domain-security.yml` — TLS 1.3, HSTS with a one-year max-age,
  DNSSEC signed, SPF and DMARC present (DMARC policy `p=none`), no CAA records.
- `well-known/yazio-well-known.yml` — every `/.well-known/` path probed on both
  `www.yazio.com` and `yzapi.yazio.com` returns 404. No security.txt, no OAuth
  metadata, no api-catalog, no agent card.
- `authentication/yazio-authentication.yml` — the private backend's auth model,
  read off live error responses.
- `errors/yazio-problem-types.yml` — the backend's Symfony-style validation error
  envelope. Not RFC 9457; 401 and 404 return empty bodies.
- `packages/yazio-packages.yml` — zero first-party packages; three third-party ones.
- `mcp/yazio-mcp.yml` — no first-party MCP server.
- `plans/yazio-plans-pricing.yml` — no published pricing page at all.
- `rate-limits/yazio-rate-limits.yml` — no documented limits, no rate-limit headers.

## Not published by YAZIO

OpenAPI · AsyncAPI · GraphQL SDL · Postman collection · developer portal · API
reference · changelog · status page · deprecation policy · security.txt ·
vulnerability disclosure program · trust center · CLI · SDKs · MCP server ·
A2A agent card · llms.txt