generated: '2026-08-13'
method: derived
source: openapi/2x-knownwell-openapi.json + well-known/2x-well-known.yml
note: >-
  Cross-cutting standards conformance for 2X's API surface. The strongest result is on the
  MCP server's authorization stack, which implements the current OAuth discovery RFCs
  properly. The REST API is a plain FastAPI service — correct OpenAPI 3.1, but no problem
  details, no hypermedia, no conditional requests. No compliance certifications were found,
  so no Compliance pointer is emitted.
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi field is "3.1.0"; document parses and declares 26 paths / 27 operations
- id: oauth2-authorization-code
  conforms: true
  evidence: >-
    mcp.knownwell.com advertises authorization_code + refresh_token grants at
    /.well-known/oauth-authorization-server
- id: oauth2-pkce
  conforms: true
  evidence: code_challenge_methods_supported is ["S256"]
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: https://mcp.knownwell.com/.well-known/oauth-authorization-server returns 200 JSON
- id: rfc9728-oauth-protected-resource-metadata
  conforms: true
  evidence: >-
    https://mcp.knownwell.com/.well-known/oauth-protected-resource/mcp returns 200 JSON and
    is advertised via the WWW-Authenticate resource_metadata parameter on a 401
- id: rfc7591-dynamic-client-registration
  conforms: true
  evidence: registration_endpoint published at https://mcp.knownwell.com/register
- id: rfc7009-token-revocation
  conforms: true
  evidence: revocation_endpoint published at https://mcp.knownwell.com/revoke
- id: mcp
  conforms: true
  evidence: >-
    JSON-RPC endpoint at https://mcp.knownwell.com/mcp returns an MCP-shaped 401 OAuth
    challenge; tools/list is auth-gated so protocol version was not observed
- id: openid-connect
  conforms: false
  evidence: no /.well-known/openid-configuration on any host
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    errors are custom JSON ({error, detail, status_code}) and FastAPI 422 validation
    envelopes; no application/problem+json anywhere in the spec
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt 404s on 2x.com, api.knownwell.com and mcp.knownwell.com
- id: rfc8594-sunset-header
  conforms: false
  evidence: no deprecation or sunset policy published; no operation marked deprecated
- id: rfc8615-well-known-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog 404s on all hosts
- id: a2a-agent-card
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json 404 on all three hosts; the
    2x.com 404s return the WordPress HTML error page, not a document
- id: asyncapi
  conforms: false
  evidence: no event, streaming or webhook surface published — not applicable to this API
- id: json-api
  conforms: false
  evidence: responses are bespoke envelopes, not JSON:API documents
- id: cursor-pagination
  conforms: false
  evidence: limit/offset only; no cursor, no next link, no Link header
- id: idempotency-keys
  conforms: false
  evidence: >-
    no idempotency header documented or present in the spec; 24 of 27 operations are GET so
    the exposure is limited to API-key creation
- id: conditional-requests
  conforms: false
  evidence: no ETag / If-None-Match / Last-Modified documented or declared
compliance_certifications:
  found: []
  note: >-
    No trust center, no SOC 2 / ISO 27001 / HIPAA / PCI claim, and no security page was
    found on 2x.com or knownwell.com. probe-security-programs.py returned vdp=none
    trust=none on 2026-08-13. No Compliance or TrustCenter pointer is emitted.
summary:
  conforms: 8
  does_not_conform: 12
  strongest: oauth-discovery-stack
  weakest: error-semantics-and-well-known-surface