generated: '2026-08-06' method: derived source: >- openapi/accelsius-*-openapi.yml and live responses from https://accelsius.com/wp-json/ (2026-08-06) summary: >- Which cross-cutting standards the Accelsius content API actually conforms to. Accelsius is a data-center thermal-management manufacturer; it makes no compliance or standards claims about this surface anywhere, because it publishes no API documentation at all. Every assertion below is derived from observed behaviour, not from a provider claim. No `Compliance` pointer is emitted for this provider — no trust center, certification page or compliance program was found (/security/, /trust/ and /compliance/ all 404, trust.accelsius.com and security.accelsius.com are NXDOMAIN). standards: - id: openapi-3.1 conforms: true authored_by: api-evangelist evidence: >- Not published by the provider — the seven specs in openapi/ are OpenAPI 3.1.0 documents DERIVED by API Evangelist from the live route index at /wp-json/. Recorded as our artifact, not theirs. - id: rest conforms: true evidence: >- Resource-oriented URIs, GET-only public surface (`Allow: GET`), JSON representations, correct 200/400/401/404 status semantics on the WordPress layer. - id: hal-style-hypermedia conforms: partial evidence: >- Objects carry a `_links` object with self/collection/about/author/wp:term/wp:featuredmedia/ replies relations and a `curies` prefix definition. It resembles HAL but is the WordPress variant, not application/hal+json — the media type is application/json. - id: rfc8288-web-linking conforms: true evidence: >- Collection responses return a `Link` header with rel="next"/rel="prev", e.g. ; rel="next" - id: rfc9457-problem-details conforms: false evidence: >- Errors are application/json with the WordPress {code, message, data.status} envelope, not application/problem+json — and on this host the firewall substitutes a text/html 403 for the envelope entirely. See errors/accelsius-problem-types.yml. - id: rfc9331-ratelimit-headers conforms: false evidence: >- No RateLimit-* or X-RateLimit-* header on any response, despite the host enforcing a behavioural limit that 403s a caller. Enforcement without signalling. - id: rfc8594-sunset-header conforms: false evidence: No Sunset or Deprecation header observed; no deprecation policy published. - id: oembed-1.0 conforms: true evidence: >- The oembed/1.0 namespace is registered and /oembed/1.0/embed returns HTTP 400 for a missing `url` parameter, which is the route's declared validation behaviour rather than a 404. A successful oEmbed response was not captured before the site firewall began refusing this pass; conformance is asserted on route registration, not on a captured body. - id: schema-org-json-ld conforms: true evidence: >- Yoast SEO emits a schema.org JSON-LD @graph in every page head and in the `yoast_head_json` field of every post, news, page and term object returned by this API. - id: sitemaps-org conforms: true evidence: >- https://accelsius.com/sitemap_index.xml (HTTP 200) is a valid Yoast sitemap index enumerating post, page, news, bricks_template, category, post_tag and author sitemaps, and it is declared in /robots.txt. - id: rfc9309-robots conforms: true evidence: >- /robots.txt returns 200 with `Crawl-delay: 10`, one Disallow, and a Sitemap directive. - id: rfc9116-security-txt conforms: false evidence: /.well-known/security.txt returned 404. See well-known/accelsius-well-known.yml. - id: rfc9727-api-catalog conforms: false evidence: /.well-known/api-catalog returned 404. - id: oauth2 conforms: false evidence: >- No oauth2 security scheme anywhere on the surface; /.well-known/oauth-authorization-server returned 404. The only credential the host advertises is WordPress Application Passwords over HTTP Basic. - id: oidc conforms: false evidence: /.well-known/openid-configuration returned 404. - id: asyncapi conforms: false applicable: false evidence: >- No event, streaming or webhook surface exists on this site — nothing to describe. Not a gap, and not penalised. - id: mcp conforms: false evidence: >- No hosted MCP server published. Searched the site and probed mcp.accelsius.com (NXDOMAIN), /.well-known/ai-plugin.json (404) and /llms.txt (404). A candidate tool list derived from the OpenAPI operations is recorded in mcp/accelsius-mcp.yml with status `candidate`. - id: a2a conforms: false evidence: >- No A2A agent card. /.well-known/agent-card.json and the legacy /.well-known/agent.json both returned 404, so no a2a/ artifact was written — an agent card is only ever recorded when the provider serves one. - id: tls-1.3 conforms: true evidence: >- accelsius.com negotiates TLSv1.3; certificate valid to 2026-10-15. See security/accelsius-domain-security.yml. - id: hsts conforms: false evidence: No Strict-Transport-Security header observed on accelsius.com. - id: dnssec conforms: false evidence: No DNSKEY record for accelsius.com. - id: caa conforms: false evidence: No CAA record for accelsius.com. - id: dmarc conforms: partial evidence: >- A DMARC record exists but its policy is `p=none` — reporting only, no enforcement. SPF is present. compliance_claims: published: false probed: - url: https://accelsius.com/security/ status: 404 - url: https://accelsius.com/trust/ status: 404 detail: >- No SOC 2, ISO 27001, PCI, HIPAA or FedRAMP claim was found on accelsius.com, and no trust center exists. The company's public standards affiliations are industry-body memberships (The Green Grid, Open Compute Project community, Climate Accord, NVIDIA Inception) rather than information-security certifications, and they are not evidence of anything about this API surface. x-evidence: fetched: '2026-08-06' host: https://accelsius.com