generated: '2026-09-14'
method: derived
source: >-
  docs.aiola.ai developer guides, the first-party SDK source at
  github.com/aiola-lab/aiola-python-sdk, and the public Trust Center page data behind
  trust.aiola.ai
note: >-
  aiOla publishes no machine-readable contract, so each entry below is asserted from the
  documented wire behaviour or the SDK that implements it. Absence is recorded as
  conforms:false with the evidence that establishes the absence, never left blank.
conformance:
- id: oauth2
  conforms: false
  evidence: >-
    No authorization server, no /authorize or /token endpoint, no grant type, no scopes.
    Credentials are exchanged by a proprietary POST /voip-auth/apiKey2Token +
    POST /voip-auth/session pair described at
    https://docs.aiola.ai/developer-guides/authentication.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on aiola.ai and docs.aiola.ai and
    no response at all on auth.aiola.ai.
- id: rfc6750
  name: OAuth 2.0 Bearer Token Usage
  conforms: partial
  evidence: >-
    Credentials are presented as `Authorization: Bearer <token>` on every call, which is
    the RFC 6750 header form, but the tokens are not OAuth 2.0 access tokens and no
    WWW-Authenticate challenge is documented on 401.
- id: rfc7519
  name: JSON Web Token
  conforms: true
  evidence: >-
    The session credential is a JWT — aiOla's own SDK base64url-decodes the payload and
    reads the `exp` claim to decide when to re-mint
    (aiola/clients/auth/client.py, _parse_jwt_payload).
- id: rfc9457
  name: Problem Details for HTTP APIs
  conforms: false
  evidence: >-
    Errors are a proprietary { "error": { "code", "message" } } envelope with no
    application/problem+json media type. See errors/aiola-error-codes.yml.
- id: rfc9116
  name: security.txt
  conforms: false
  evidence: 404 on every host probed — see security/aiola-vulnerability-disclosure.yml.
- id: rfc8594
  name: Sunset HTTP Header
  conforms: false
  evidence: No deprecation policy and no Sunset/Deprecation header behaviour is documented.
- id: rfc9727
  name: api-catalog well-known URI
  conforms: partial
  evidence: >-
    https://docs.aiola.ai/.well-known/api-catalog returns 200 with the correct
    application/linkset+json media type, but the linkset array is empty and the document
    is emitted by the Fern docs platform rather than authored by aiOla. Correct form, no
    content.
- id: idempotency
  conforms: false
  evidence: >-
    No Idempotency-Key header or replay window anywhere in the docs or either SDK. See
    conventions/aiola-conventions.yml (idempotency.coverage = none).
- id: pagination
  conforms: na
  evidence: No collection endpoint exists on the public surface.
- id: openapi
  conforms: false
  evidence: >-
    Probed /openapi.json, /openapi.yaml, /swagger.json, /api-docs, /api/openapi.json and
    /api-reference on docs.aiola.ai and aiola.ai (all 404 or HTML), and the documentation
    sitemap lists 19 pages with no API reference section. apis.aiola.ai and auth.aiola.ai
    accept no anonymous connection, so the API host root could not be probed.
- id: asyncapi
  conforms: false
  evidence: >-
    A real Socket.IO streaming surface exists (/api/voice-streaming/socket.io, namespace
    /events) but no AsyncAPI document is published for it.
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    Live remote server at https://docs.aiola.ai/_mcp/server — initialize returned 200 with
    protocolVersion 2025-11-25 and tools/list returned one tool. Documentation scope only;
    see mcp/aiola-mcp.yml.
- id: a2a
  name: A2A Agent Card
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json 404 or do not respond
    on all six hosts.
- id: soc2
  conforms: true
  evidence: >-
    SOC 2 Type II recorded as fully-implemented in the Trust Center page data at
    trust.aiola.ai, with a report ("aiOla SOC2 Report 2026") available on request.
- id: iso27001
  conforms: true
  evidence: >-
    ISO 27001:2022 recorded as fully-implemented in the Trust Center page data, with a
    certificate one-pager and full certification report available on request.
- id: gdpr
  conforms: partial
  evidence: >-
    The Trust Center records GDPR as in-progress, while the aiola.ai footer displays a
    GDPR trust badge.
- id: ccpa
  conforms: partial
  evidence: >-
    The Trust Center records CCPA 2024 as in-progress, while the aiola.ai footer displays
    a CCPA trust badge.
domain_standard:
  applicable: false
  note: >-
    Speech recognition and synthesis has no interoperability standard a contract can
    declare — there is no SCIM/OData/FHIR/OpenRTB analogue for an ASR or TTS API. No
    domain-standard conformance is asserted, and none is missing. Reward-only check,
    correctly empty.