generated: '2026-07-31'
method: probed
source: live probes of every Aescape host on 2026-07-31 + well-known/aescape-openid-configuration.json
standards:
- id: openid-connect-discovery-1.0
  conforms: true
  evidence: 200 application/json at https://aescape-8ocoec.zitadel.cloud/.well-known/openid-configuration
    with issuer, authorization_endpoint, token_endpoint, userinfo_endpoint and jwks_uri
- id: oauth2
  conforms: true
  evidence: discovery document advertises authorization_code, refresh_token, client_credentials,
    device_code and jwt-bearer grant types
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported = [S256]
- id: rfc8628-device-authorization-grant
  conforms: true
  evidence: device_authorization_endpoint present and urn:ietf:params:oauth:grant-type:device_code
    in grant_types_supported
- id: rfc7662-token-introspection
  conforms: true
  evidence: introspection_endpoint present
- id: rfc7009-token-revocation
  conforms: true
  evidence: revocation_endpoint present
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: /.well-known/oauth-authorization-server returns 404 on the identity tenant
- id: rfc9728-oauth-protected-resource-metadata
  conforms: false
  evidence: /.well-known/oauth-protected-resource returns 404 on every host
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on www.aescape.com and api.aescape.com,
    401 on developer.aescape.com
- id: rfc8615-well-known-uris
  conforms: partial
  evidence: only the OIDC discovery path is served, and only from the Zitadel-hosted
    identity tenant; no Aescape-controlled host serves a well-known document
- id: openapi
  conforms: false
  evidence: no OpenAPI or Swagger document found — see contract_discovery below
- id: asyncapi
  conforms: false
  evidence: no AsyncAPI document and no publicly documented webhook or event surface
- id: graphql
  conforms: false
  evidence: /graphql returns 404 on api.aescape.com and the SPA catch-all on app.aescape.com
- id: mcp
  conforms: false
  evidence: no hosted Model Context Protocol server found on any Aescape host
- id: a2a
  conforms: false
  evidence: no A2A Agent Card at /.well-known/agent-card.json or /.well-known/agent.json
    on any host
- id: rfc9457-problem-details
  conforms: false
  evidence: api.aescape.com returns application/json {"message":"Not Found"} rather
    than application/problem+json
contract_discovery:
  performed: '2026-07-31'
  result: no public machine-readable API contract
  hosts_probed:
  - https://www.aescape.com
  - https://aescape.com
  - https://api.aescape.com
  - https://developer.aescape.com
  - https://app.aescape.com
  - https://store.aescape.com
  - https://one.aescape.com
  - https://aescape-8ocoec.zitadel.cloud
  rest_openapi:
    probed: [/openapi.json, /openapi.yaml, /swagger.json, /v1/openapi.json, /api-docs,
      /docs, /redoc, /v1/]
    result: >-
      api.aescape.com answers every path with HTTP 404 application/json
      {"message":"Not Found"} and returns an apigw-requestid response header,
      identifying it as an AWS API Gateway fronting the consumer application. No
      spec is exposed. www.aescape.com returns the Next.js 404 page.
      app.aescape.com returns its Flutter SPA shell (text/html) for every path,
      which does not parse as OpenAPI and is rejected.
  graphql:
    result: 404 on api.aescape.com; app.aescape.com /graphql is the SPA catch-all,
      not a GraphQL endpoint. No introspection performed because no endpoint exists.
  mcp:
    result: no MCP server advertised in docs, on any host, or in the app CSP connect-src
      allowlist.
  a2a:
    result: >-
      /.well-known/agent-card.json and /.well-known/agent.json probed on every host.
      404 on aescape.com, www.aescape.com and api.aescape.com; 401 on
      developer.aescape.com; 200 text/html SPA catch-all on app.aescape.com, which
      fails the AgentCard JSON-object shape test and is rejected as a false
      positive. No agent card exists — nothing was written to a2a/.
  developer_portal:
    host: https://developer.aescape.com
    status: 401
    www_authenticate: Basic realm="Developer Docs"
    result: >-
      Aescape operates a developer documentation site but it is gated behind HTTP
      Basic authentication and fronted by Cloudflare. Every path, including
      /.well-known/*, returns 401. No DeveloperPortal or Documentation pointer is
      wired in apis.yml because nothing on this host is publicly published.
  packages:
    result: >-
      No first-party client library found on npm, PyPI, RubyGems or in the GitHub
      organization. The github.com/aescape-inc organization holds nine public
      repositories, all forks of third-party projects (pusher-channels-flutter,
      flutter_calendar_view, Open3D, mobile_scanner, fluent-bit, consent-manager,
      flutter_map_marker_cluster, open-mail-app-flutter, and an Aescape fork of
      cyclonedds patched for ROS 2 Humble). None is an Aescape SDK, so no SDKs
      pointer is wired.
compliance:
  published_certifications: []
  trust_center: null
  note: probe-security-programs.py returned vdp=none trust=none. No SOC 2, ISO 27001,
    HIPAA, PCI DSS or FedRAMP claim was found on any Aescape page, and there is no
    trust.aescape.com, security.aescape.com or /security page. No Compliance or
    TrustCenter pointer is wired.
observed_third_party_stack:
  source: Content-Security-Policy header on https://app.aescape.com/
  identity: [Zitadel (aescape-8ocoec.zitadel.cloud production, plus qa and dev tenants),
    Auth0]
  payments: [Stripe]
  realtime: [Pusher Channels, wss://*.aescape.com]
  maps: [Mapbox]
  feature_flags: [LaunchDarkly]
  localization: [Lokalise]
  observability: [Sentry]
  support_crm: [Zendesk, Salesforce, Qualtrics]
  note: this is the client-side integration surface Aescape's own app declares. It is
    recorded as observed evidence, not as an Aescape-published API.