generated: '2026-09-07'
method: derived
source: >-
  Derived from openapi/, live response headers and live error bodies observed at
  https://www.adionics.com/wp-json/ on 2026-09-07, plus a search of adionics.com for published
  compliance claims (none found).
standards:
- id: oauth2
  conforms: false
  evidence: No oauth2 security scheme is declared or advertised; the only mechanism is HTTP Basic
    (WordPress Application Passwords).
- id: oidc
  conforms: false
  evidence: '/.well-known/openid-configuration returns 404 on www.adionics.com.'
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are returned as application/json with a WordPress {code, message, data.status}
    envelope, never application/problem+json.
- id: rfc8288-web-linking
  conforms: true
  evidence: 'Collection responses return a Link header with rel="next" / rel="prev" — observed on
    /wp/v2/posts?per_page=1.'
- id: hal-style-links
  conforms: true
  evidence: Every object carries a _links member of link relations, and _embed inlines them into
    _embedded.
- id: oembed-1.0
  conforms: true
  evidence: '/oembed/1.0/embed returns a valid oEmbed 1.0 rich response (version, provider_name,
    provider_url, type, html) — verified 200 on 2026-09-07.'
- id: mcp
  conforms: partial
  evidence: 'An MCP endpoint is registered and served at /wp-json/mcp/mcp-adapter-default-server,
    but initialize and tools/list both return 401 rest_forbidden anonymously, so protocol
    conformance could not be verified.'
- id: pagination
  conforms: true
  evidence: 'Page-number pagination with page/per_page and X-WP-Total / X-WP-TotalPages headers.'
- id: idempotency
  conforms: false
  evidence: No idempotency key mechanism exists; see conventions/adionics-conventions.yml.
- id: https-only
  conforms: true
  evidence: 'TLSv1.3 with HSTS max-age=63072000 — see security/adionics-domain-security.yml.'
domain_standards:
  applicable: false
  detail: >-
    Adionics operates in lithium extraction and mineral processing. No machine-readable domain
    standard for that market (mining reporting, brine assay, or process-plant data exchange) is
    declared anywhere in this contract, and none is expected — the only contract Adionics serves is
    a CMS content API, whose domain is web publishing, not minerals.
compliance_program:
  published: false
  certifications: []
  detail: >-
    No trust centre, no SOC 2 / ISO 27001 / GDPR compliance page and no security page were found.
    probe-security-programs.py returned vdp=none trust=none on 2026-09-07. The site publishes a
    French-language privacy policy (politique de confidentialité) and a legals page, and nothing
    further. No Compliance pointer is emitted.