generated: '2026-09-13' method: derived source: openapi/agrology-public-api-openapi.yml searched: https://github.com/agrology/public-api-docs/blob/main/README.md probed: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_qBmvSfyNK/.well-known/openid-configuration api: Agrology Public API v2 conformance: - id: openapi-3.0 conforms: true version: 3.0.1 evidence: openapi/agrology-public-api-openapi.yml — parses as OpenAPI 3.0.1 with 66 paths, 90 operations and 22 component schemas, published first-party at https://github.com/agrology/public-api-docs/blob/main/openapi.yml method: searched - id: geojson conforms: true standard: GeoJSON spec: RFC 7946 domain_standard: true market: agriculture / geospatial evidence: >- Three dedicated operations serve GeoJSON — GET /geojson/sites, GET /geojson/customer/{customerID} and GET /geojson/site/{siteID}. The provider's documented response body is a conformant FeatureCollection: "type": "FeatureCollection" at the root, features[] of "type": "Feature" each with properties{} and geometry{}, and node geometry as {"type":"Point","coordinates": [-122.602875, 45.556985]} in RFC 7946 longitude-then-latitude order with WGS 84 decimal degrees. evidence_url: https://github.com/agrology/public-api-docs/blob/main/README.md#geojson-format deviations: - >- Non-standard sibling members (key, description, historicalURL, predictionsURL, syntheticsURL, sites[]) are added at the FeatureCollection root. RFC 7946 permits foreign members, so this remains conformant; a strict parser ignores them. - >- The site Feature is published with an empty geometry object ({}) rather than null. RFC 7946 requires geometry to be a Geometry object or null; {} is neither. significance: >- This is the domain standard that matters for this market. A grower using QGIS, a farm-management platform, or any PostGIS-backed stack ingests Agrology field geometry with no bespoke connector, and the templated historicalURL / predictionsURL / syntheticsURL members carried inside the GeoJSON take a consumer straight from a mapped node to its telemetry. method: searched - id: oauth2 conforms: partial evidence: >- An OAuth 2.0 authorization server is deployed for the Grower's Portal on auth.agrology.ag (authorize / token / revoke endpoints, response_types code and token, client_secret_basic and client_secret_post). The PUBLIC API itself does not accept an OAuth flow — it takes the resulting JWT as an opaque bearer credential, or a static API key, and declares no oauth2 securityScheme. evidence_url: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_qBmvSfyNK/.well-known/openid-configuration method: probed - id: oidc conforms: partial spec: OpenID Connect Core 1.0 / Discovery 1.0 evidence: >- The Amazon Cognito user pool behind the Grower's Portal serves a conformant OIDC discovery document (HTTP 200) with issuer, jwks_uri, RS256 id-token signing and the openid/email/phone/profile scopes. deviations: - >- Discovery is served on cognito-idp.us-east-1.amazonaws.com, not on an agrology.ag host. No agrology.ag host serves /.well-known/openid-configuration — https://auth.agrology.ag/.well-known/openid-configuration returns 404 with {"error":"This URL doesn't exist on the authorization server."}. A relying party cannot discover the issuer from the company's own domain. method: probed - id: bearer-token-rfc6750 conforms: true spec: RFC 6750 evidence: >- securitySchemes.publicApiAuthorizer is type http, scheme bearer, bearerFormat JWT, and the README documents the header verbatim as "Authorization: Bearer $ACCESS_TOKEN". method: derived - id: jwt-rfc7519 conforms: true spec: RFC 7519 evidence: bearerFormat JWT in the OpenAPI; RS256-signed tokens from the Cognito pool with a published jwks_uri. method: derived - id: json conforms: true evidence: All request and response bodies are application/json. method: derived - id: cors conforms: true spec: W3C CORS / WHATWG Fetch evidence: >- Live response headers from https://api.agrology.ag/v2/access carry access-control-allow-origin *, access-control-allow-headers * and access-control-allow-methods *. method: probed - id: rfc9457 conforms: false evidence: >- No application/problem+json media type anywhere in the spec, and the observed error body is the AWS API Gateway default {"message":"Forbidden"}. No operation declares any 4xx or 5xx response. method: probed - id: pagination conforms: false evidence: >- No limit/offset/page/cursor parameter on any of the 59 read operations and no next/cursor member in any response envelope. Volume is bounded by the {timeRange} path segment and the deviceType / metrics filters instead. method: derived - id: idempotency conforms: false evidence: >- No Idempotency-Key header or equivalent in the 71KB spec or the 18KB README; none of the 31 mutating operations declares replay protection. See conventions/agrology-conventions.yml (idempotency.coverage: none). method: derived - id: iso8601 conforms: partial evidence: >- Time-series timestamps are epoch integers (ts) and the {timeRange} path grammar accepts relative, epoch and yyyyMMddhhmm[ss] forms but NOT ISO-8601. The alerts endpoint, however, returns startTime/updateTime as ISO-8601 strings ("2023-03-07T13:01:41Z"). The API is internally inconsistent on time representation. method: derived - id: iana-tz conforms: true spec: IANA Time Zone Database evidence: Site properties carry an IANA tz identifier — observed value "America/Los_Angeles" in the provider's GeoJSON example. method: searched - id: si-units conforms: partial evidence: >- Metric definitions carry explicit units (˚C, %, m/s) from the /metrics endpoints and elevation is published in metres (elevationMeters). Site properties also carry a displayUnits preference (observed "imperial"), which governs presentation, not the API payload. method: searched - id: lorawan conforms: true standard: LoRaWAN domain_standard: true market: agricultural IoT / sensor networks evidence: >- Device identifiers published in the provider's own GeoJSON example are LoRaWAN DevEUI-shaped 16-hex-digit values in the 70B3D57B... Semtech/Decentlab OUI range (70B3D57BA000163E, 70B3D57BA00015EA, 70B3D57BA000163C), paired with make "decentlab" and models trs12/trs21, and the devices carry lastPayload as a raw hex uplink frame. Agrology publicly joined the LoRa Alliance in 2022 to scale its IoT network across rural farmland. evidence_url: https://github.com/agrology/public-api-docs/blob/main/README.md#geojson-format deviations: - >- The API surfaces LoRaWAN device identity and raw payloads but is not itself a LoRaWAN network-server interface — there is no join, downlink or device-management surface in the Public API. method: searched not_claimed: note: >- The following were checked and are genuinely absent. REWARD-ONLY — none of these is expected of an agricultural sensing API and none is counted against the provider. standards: - id: fhir reason: healthcare standard, out of market - id: scim reason: >- No SCIM schema URN anywhere in the spec. User access is managed with a bespoke surface (/access/manage/...), not a SCIM /Users or /Groups endpoint. - id: odata reason: no $metadata surface and no $filter/$select query grammar - id: json:api reason: no application/vnd.api+json media type - id: psd2 reason: financial services standard, out of market - id: fapi reason: financial services standard, out of market - id: openrtb reason: advertising standard, out of market - id: sparkplug reason: >- No MQTT/Sparkplug topic namespace is published. The sensor network's uplink transport is not exposed through the Public API, which is HTTP/JSON only. - id: ogc-api reason: >- Probed by evidence, not by blind pattern. The API serves GeoJSON but declares no OGC API landing page, no conformsTo[] with opengis.net class URIs, and no /collections resource; no WMS/WFS/WCS/WMTS/CSW GetCapabilities surface is named anywhere in the docs or the shipped client bundles. Agrology is a GeoJSON publisher, not an OGC service. - id: ads-abi reason: >- ADAPT / AgGateway ADS is the interoperability standard for machinery and field-operation data exchange. Agrology publishes environmental sensing data, not machine task data, and names no ADAPT, ISOXML or ISO 11783 support. compliance: certifications_published: [] trust_center: null note: >- No SOC 2, ISO 27001, PCI, HIPAA or FedRAMP claim appears on any Agrology surface. probe-security-programs.py found no trust center and no vulnerability-disclosure program (trust.agrology.ag does not resolve; no /.well-known/security.txt is served on any host). No Compliance pointer is emitted, because there is nothing published to point at. regulatory_regime: sector: agriculture note: >- No sector-specific API regulatory regime applies to US specialty-crop sensing. The company's public posture is its Public Benefit Corporation status and its NSF SBIR awards, neither of which is an API conformance claim.