generated: '2026-08-06'
method: derived
source: openapi/allay-therapeutics-content-openapi.yml + live probes of https://www.allaytx.com on 2026-08-06
note: >-
  Cross-cutting standards conformance for the only public API surface Allay Therapeutics exposes.
  Allay Therapeutics makes no published compliance claims of any kind — no trust center, no SOC 2 /
  ISO 27001 / HIPAA statement, no certifications page — so no `Compliance` pointer is emitted in
  apis.yml. Every entry below is derived from the deployed contract, not from a provider assertion.
standards:
- id: openapi-3.1
  conforms: true
  evidence: >-
    openapi/allay-therapeutics-content-openapi.yml is an API Evangelist derivation, not a provider
    publication. Allay Therapeutics itself publishes no OpenAPI at any probed location.
  published_by_provider: false
- id: wordpress-rest-api-v2
  conforms: true
  evidence: >-
    The /wp-json/ index declares the wp/v2 namespace and every modelled route matches the upstream
    WordPress REST contract documented at https://developer.wordpress.org/rest-api/.
- id: oembed-1.0
  conforms: true
  evidence: The oembed/1.0 namespace is registered and /oembed/1.0/embed returned 200 anonymously.
- id: rfc8288-web-linking
  conforms: true
  evidence: >-
    Collection responses carry a Link header with rel="next" / rel="prev"; every resource carries a
    _links object with WordPress link relations.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use the WordPress envelope {code, message, data:{status}} served as application/json. No
    `type` URI, no application/problem+json media type.
- id: rfc9116-security-txt
  conforms: false
  evidence: 'https://www.allaytx.com/.well-known/security.txt returned 404 (HTML).'
- id: rfc8615-well-known
  conforms: false
  evidence: >-
    No /.well-known/ document is served. security.txt, openid-configuration,
    oauth-authorization-server, api-catalog, ai-plugin.json, agent-card.json and agent.json all
    returned 404.
- id: oauth2
  conforms: false
  evidence: >-
    No OAuth 2.0 surface. The only advertised authentication method is WordPress application
    passwords (HTTP Basic against an admin-issued credential), which is not OAuth.
- id: openid-connect
  conforms: false
  evidence: '/.well-known/openid-configuration returned 404.'
- id: idempotency-key
  conforms: false
  evidence: No idempotency key header is accepted or documented; there is no anonymous write surface.
- id: pagination
  conforms: true
  evidence: >-
    Page-number pagination with page/per_page/offset, plus X-WP-Total and X-WP-TotalPages response
    headers exposed cross-origin via Access-Control-Expose-Headers.
- id: cors
  conforms: true
  evidence: >-
    Access-Control-Allow-Headers and Access-Control-Expose-Headers are set on /wp-json responses.
- id: hsts
  conforms: true
  evidence: 'strict-transport-security: max-age=63072000 observed on www.allaytx.com. See security/allay-therapeutics-domain-security.yml.'
- id: dnssec
  conforms: false
  evidence: allaytx.com is not DNSSEC-signed (probed 2026-08-06).
- id: caa
  conforms: false
  evidence: No CAA records published for allaytx.com (probed 2026-08-06).
- id: spf
  conforms: true
  evidence: SPF record present for allaytx.com.
- id: dmarc
  conforms: true
  evidence: 'DMARC record present with policy p=quarantine.'
- id: a2a-agent-card
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json both returned 404 (HTML) on
    www.allaytx.com. No agent card is published, so no AgentCard pointer is emitted.
- id: model-context-protocol
  conforms: false
  evidence: >-
    The wp-abilities/v1 namespace is registered by WordPress core but every route returns 401
    rest_forbidden anonymously, and no MCP endpoint exists. No MCPServer pointer is emitted.
compliance_program:
  published: false
  detail: >-
    Allay Therapeutics is a clinical-stage drug developer. It is subject to FDA regulation of its
    investigational products (ATX-101 holds Breakthrough Therapy Designation and is in a pivotal
    Phase 2b trial), but that is drug regulation, not an information-security or API compliance
    program, and the company publishes no trust center, certification list, or security posture
    page. Probes: trust.allaytx.com and status.allaytx.com are NXDOMAIN.