Apple Ads Platform API vs Refersion MCP

Apple Ads Platform API 35

Read with the hosted lines, grading the Platform API 1.0. No status page for Apple Ads was linked from the documentation or help pages read (0). With no readable incident history, the record scores the brief's 5 (5). Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset, though the docs state no fixed quota and show 100 only as an example (8 of 15). A 429 carries Retry-After, and the docs give pacing rules and a sample backoff client. No idempotency key was found (12 of 15). No SLA was found (0). Version 1.0 is described as the current version, released in August 2026 (10). Total 35.

Refersion MCP 72

Read with the hosted lines, for the remote server at api.refersion.com/mcp. status.refersion.com is an Atlassian Statuspage with components for the dashboards, click and conversion tracking, REST API and GraphQL API, though none for the MCP server (20). The last 90 days hold one incident, on 1 September 2026, when the marketing website didn't load for about two hours while tracking and the app stayed up. The one before was a cloud-provider degradation on 20 October 2025 (20 of 30). API v2026-08 publishes 300 reads, 60 writes and 30 webhook-endpoint requests a minute per account. The tools map to that API per Refersion, but no limit is stated for the MCP server itself (12 of 15). 429 responses carry Retry-After with the wait in the body, and a few operations are documented as idempotent, but there are no idempotency keys for writes such as manual credits (10 of 15). No SLA found (0 of 10). The server isn't labelled beta or preview on the product page or the launch post (10). Total 72.

Apple Ads Platform API 69

The four client libraries are generated from an OpenAPI document (Apple Ads API Combined Specification 1.0.0) that Apple does not publish. The typed models in the MIT libraries stand in for part of it (10 of 25). Each docs page links a Markdown twin. developer.apple.com/llms.txt answers 404 (10). Workflow guides for App Store and Apple Maps campaigns and an overview page for each entity explain purpose and order of use (14 of 20). Models carry enums and required fields, such as five required fields on campaign creation, while a filter value is a scalar or an array (12 of 15). The pages read have JSON requests and responses, a table of six HTTP errors and one detailed error body. No full list of error codes was read (11 of 15). The version is in the path and the changelog is dated by month, with one entry so far (12 of 15). Total 69.

Refersion MCP 46

The MCP tool definitions can be read only after signing in, which this run didn't do. Refersion says each tool maps to an endpoint of API v2026-08, whose OpenAPI 3.1 file is public at refersion.dev with 36 paths and 44 operations. That counts in part, since it's the API's contract and not the tools' (12 of 25). No llms.txt on refersion.com or refersion.dev (both 404) and no Markdown docs for agents (0 of 10). The OpenAPI descriptions run 240 to 1,221 characters and state behaviour and preconditions (an affiliate with unpaid conversions can't be deleted, topics replaces rather than merges), with little on when not to call, and the MCP descriptions weren't read (8 of 20). 315 required markers, but only 5 enums, and statuses such as PENDING or APPROVED are listed in prose rather than as enums (6 of 15). 615 examples and documented 401, 402, 403, 404, 422 and 429 responses in the API file, none readable for the MCP tools (10 of 15). A dated API version with a no-breaking-change commitment and dated product posts on the blog. The changelog site wasn't read (its robots.txt disallows agents) and the MCP server has no version of its own (10 of 15). Total 46.

Apple Ads Platform API 69

Queries take pageSize, offset and filters. No field selection was found on the Platform API, though the API it replaces had one (15 of 25). Offset paging, filters with operators, sorting and an optional total count on every /query endpoint. The largest page size was not read (18 of 20). Errors carry a code, a message and details naming the field, with six HTTP codes documented (15 of 20). No idempotency key, validate-only mode or test account was found. PUT changes only the fields sent, arrays are replaced whole, and bulk calls match results to inputs by correlationId (7 of 20). Official libraries in Swift, Python, Java and Node.js handle tokens, and a call needs two headers (14 of 15). Total 69.

Refersion MCP 50

Tool count and definition size couldn't be read. Refersion says each tool maps to an endpoint of an API with 44 operations, which points to more than 30 tools, so this takes the more-than-30 reading (5 of 25). The API has page and limit, a cursor on webhook endpoints, sorting and many range filters on affiliates and conversions; whether the tools pass all of them through wasn't seen (15 of 20). Documented 422 validation errors, 402 plan-limit messages such as 'Your plan does not include webhook access.', and a 429 body with retryAfter (14 of 20). Refersion says every tool is marked as reading, changing or deleting, so clients can confirm a delete, but the annotations weren't read and no idempotency keys exist (8 of 20). No API key or SDK is needed for the MCP server, and Refersion's examples are plain requests. Required inputs couldn't be read (8 of 15). Total 50.

Apple Ads Platform API 68

OAuth 2 client credentials with a client secret the user signs (ES256, at most 180 days) and one-hour access tokens. The private key never leaves the user, and the public key can be replaced in the interface. One scope, searchadsorg, covers everything. The deprecated API's page shows the client secret in the token URL's query string, while the Platform API's example sends it in the body, so no deduction is taken (24 of 30). API Account Read Only and a campaign group API Read Only role exist. No confirmation step for a write or delete was found (14 of 20). Reports return search terms and app metadata written by third parties, and no guidance on untrusted content was found (5 of 15). Change history endpoints return audit summaries and change details. Their reference pages were not read (12 of 15). security.txt is valid to 6 October 2027 and points to Apple's bounty guidelines. No SOC 2 or ISO 27001 statement for Apple Ads was found in the pages read (13 of 20). Total 68.

Refersion MCP 58

OAuth on Refersion's own authorisation server with authorisation code and PKCE S256, refresh tokens, device code, a revocation endpoint and client ID metadata documents, and bearer tokens in the header only. The resource lists 20 scopes split by area and by read or write (30 of 30). Refersion says each scope can be unticked at consent, that user management, credentials, payout settings and billing stay off limits, that unverified clients are marked as such, and that connected assistants are listed in account settings and can be revoked. The consent screen wasn't seen, and payments:write and conversions:write reach money (15 of 20). Results include text written by affiliates and prospects (registration answers, promotion methods, prospect pitches), with no injection guidance found (3 of 15). Connected assistants are listed per account, and conversion status changes create an audit trail per the OpenAPI file, but no per-call log for the operator is documented (7 of 15). security.txt answers 403 on www.refersion.com and 404 on api and auth. The terms say vulnerabilities go to security@refersion.com. No bug bounty, SOC 2 or ISO 27001 found (3 of 20). Total 58.

Apple Ads Platform API 48

The Platform API changelog dates 1.0 to August 2026, and the client libraries are tagged v1.109.0 on 14 August 2026, 56 days before the check (20). One Platform API release and no entry for the earlier API fall in the last 90 days (0). Closed service with a changelog, a help centre and an email contact for third-party registration. No developer forum or issue replies were read (7 of 15). Current official libraries in four languages (15). The libraries pin CI actions by commit, publish through trusted publishing and ship tests and lock files. Only publish workflows were found in the two repositories cloned (6 of 10). Total 48.

Refersion MCP 58

Read for a closed service. The server was announced on 26 October 2026, seven days before this check (30). Dated product posts on the blog within the 90 days from 4 August, among them API v2026-08 on 31 August, Branded Links on 21 September and the MCP server on 26 October (20). A help centre updated on 2 October 2026, the support address helpme@refersion.com and chat on Growth. changelog.refersion.com exists but wasn't read, and response times weren't checked (8 of 15). Not in the official MCP registry (0 of 15). No package to judge (0 of 10). Total 58.

Apple Ads Platform API 20

No x402, MPP or L402 (0). No fee for API access is stated. Ads are priced per tap with a maximum the advertiser sets, and no rates are published (10). Apple advertises a 100 USD credit for eligible new App Store advertisers. No test account was found and whether a payment method is needed first was not established (10). A person must sign in, be given an API role and upload a public key in the Apple Ads interface (0). Total 20.

Refersion MCP 12

No machine payment protocol (0 of 40). Plan prices are public without a login, Launch $39 and Growth $199 a month plus 3 or 2 per cent of affiliate-driven sales, but nothing says which plan includes the MCP server, and Scale is through sales (10 of 20). The free Marketplace Listing only publishes an offer, no trial is published, and API access is ticked for Growth only (0 of 20). A merchant signs up in a browser and approves the assistant at consent. Clients can identify themselves by a client ID metadata document with no manual registration, which earns 2 (2 of 20). Total 12.