generated: '2026-09-05' method: searched source: https://www.opus.com/enterprise docs: - https://www.opus.com/enterprise - https://trust.opus.com/ - https://developer.opus.com/api-reference/introduction note: >- Compliance claims are read from AAICO's own enterprise page, which names six frameworks in one block, and corroborated by a live Vanta-hosted trust center at trust.opus.com. Technical/API conformance is asserted from the published API reference and a live probe of the API host. No OpenAPI exists for this API, so no spec-derived conformance is claimed. conformance: - id: soc2-type-ii category: certification conforms: true evidence: >- Named verbatim on the Opus enterprise page in the compliance block "SOC 2 Type II, ISO 27001, HIPAA, GDPR, EU AI Act, ISO 42001". source: https://www.opus.com/enterprise attestation_available: trust.opus.com (Vanta trust center; document access is gated) - id: iso-27001 category: certification conforms: true evidence: Named on the Opus enterprise page compliance block. source: https://www.opus.com/enterprise - id: iso-42001 category: certification conforms: true evidence: >- Named on the Opus enterprise page compliance block. ISO/IEC 42001 is the AI management-system standard — the domain-relevant certification for an AI workflow platform. source: https://www.opus.com/enterprise - id: hipaa category: regulatory conforms: true evidence: Named on the Opus enterprise page compliance block; healthcare is a named target sector. source: https://www.opus.com/enterprise - id: gdpr category: regulatory conforms: true evidence: >- Named on the Opus enterprise page ("GDPR compliant" badge). A published Data Processing Agreement is served at https://www.opus.com/legal-docs/Opus-DPA.pdf (HTTP 200). source: https://www.opus.com/enterprise - id: eu-ai-act category: regulatory conforms: true evidence: >- Named on the Opus enterprise page compliance block. Relevant because Opus places AI agents in regulated decision paths in banking, insurance and healthcare. source: https://www.opus.com/enterprise - id: data-residency category: regulatory conforms: true evidence: >- Enterprise page states regional data residency "across UAE, EU, US, and more", plus private cloud and on-premises/air-gapped deployment for regulated industries. source: https://www.opus.com/enterprise - id: oauth2 category: technical conforms: false evidence: >- The Opus platform API authenticates only with a static x-service-key header. No OAuth 2.0 surface is documented and /.well-known/oauth-authorization-server 404s on every host probed. source: https://developer.opus.com/api-reference/quickstart - id: oidc category: technical conforms: false evidence: /.well-known/openid-configuration returns 404 on all ten hosts probed on 2026-09-05. source: well-known/aaico-well-known.yml - id: rfc9457 category: technical conforms: false evidence: >- Errors are plain application/json {statusCode, message, timestamp, path}, not application/problem+json. Confirmed live at https://operator.opus.com/api/v1 (HTTP 401). source: errors/aaico-problem-types.yml - id: idempotency category: technical conforms: false evidence: >- No Idempotency-Key header or client request identifier appears anywhere in the published API reference; every write is replay-unprotected. source: conventions/aaico-conventions.yml - id: pagination category: technical conforms: false evidence: No collection endpoints and no pagination parameters are documented. source: conventions/aaico-conventions.yml - id: openapi category: technical conforms: false evidence: >- No OpenAPI is published for the Opus platform API. The only openapi.json on the developer host (https://developer.opus.com/api-reference/openapi.json, HTTP 200) is the Mintlify starter template — info.title "OpenAPI Plant Store" — and describes a sample plant store, not Opus. It is deliberately NOT saved to this repo. source: https://developer.opus.com/api-reference/openapi.json - id: mcp category: technical conforms: true evidence: >- A live remote MCP server answers initialize and tools/list anonymously at https://developer.opus.com/mcp, declaring protocolVersion 2025-06-18 and serverInfo "Opus Docs" 1.0.0, with 3 tools carrying inputSchema. source: mcp/aaico-mcp.yml - id: a2a category: technical conforms: true grade: near-conformant evidence: >- A real A2A Agent Card is served at https://developer.opus.com/.well-known/agent-card.json (HTTP 200, application/json), declaring protocolVersion 0.3 with capabilities as an object and skills as an array. source: a2a/aaico-a2a.yml - id: llmstxt category: technical conforms: true evidence: https://developer.opus.com/llms.txt returns HTTP 200 text/plain with a full page index. source: llms/aaico-llms.txt domain_standard: applicable: false note: >- Reward-only check, deliberately left unclaimed. AI-native business-process orchestration has no settled interchange standard for the contract itself (nothing analogous to SCIM, FHIR, OpenRTB, OData or ISO 20022 applies to "run this workflow"). AAICO's domain-relevant credential is a management-system certification, ISO/IEC 42001, recorded above as a certification rather than as a contract-declared domain standard — the Opus API declares no domain schema, URN or message type in its own contract. gaps: - No OpenAPI, so the contract cannot be validated, linted, mocked or code-generated. - No RFC 9457, no OAuth/OIDC, no idempotency, no rate-limit headers. - Certification claims are marketing-page assertions; the attesting documents behind the Vanta trust center are access-gated.