generated: '2026-07-26'
method: derived
source: openapi/apex27-crm-api-openapi.yml, openapi/apex27-portal-api-openapi.yml, live probes 2026-07-26
standards:
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme; auth is a static API key. /.well-known/oauth-authorization-server
    returned 404 on both hosts.
- id: openid-connect
  conforms: false
  evidence: /.well-known/openid-configuration returned HTTP 404 on api.apex27.co.uk and apex27.co.uk.
- id: api-keys
  conforms: true
  evidence: x-api-key request header (CRM API) and api_key query parameter (Portal API).
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a vendor envelope {success,message,errors} served as text/json, not application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returned HTTP 404 on both hosts.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy published.
- id: openapi
  conforms: false
  evidence: 'Apex27 publishes no OpenAPI. The specs in openapi/ are API Evangelist derivations from Apex27''s
    own npm client, marked provider_published: false.'
- id: json-api
  conforms: false
  evidence: Plain JSON collections, no JSON:API document structure.
- id: odata
  conforms: false
  evidence: https://api.apex27.co.uk/$metadata returned HTTP 404.
- id: reso-web-api
  conforms: false
  evidence: No RESO Web API certification. RESO is a US NAR/MLS construct with no UK counterpart; the
    string "RESO" appears nowhere on apex27.co.uk or in either npm package.
- id: reso-data-dictionary
  conforms: false
  evidence: No RESO Data Dictionary alignment. Field names are vendor-specific camelCase (transactionType,
    websiteStatus, mainSearchRegionId).
- id: pagination
  conforms: true
  evidence: Uniform page/pageSize (25-250) query parameters across CRM list operations.
- id: idempotency
  conforms: false
  evidence: No idempotency key header or documented retry semantics.
- id: webhooks
  conforms: true
  evidence: First-class webhook subscription CRUD at /webhooks; Apex27 names webhooks on https://apex27.co.uk/integration/n8n.
    No event catalogue or payload schema published.
- id: asyncapi
  conforms: false
  evidence: No AsyncAPI document; no event catalogue published.
- id: graphql
  conforms: false
  evidence: https://api.apex27.co.uk/graphql returned HTTP 404.
- id: grpc
  conforms: false
  evidence: No .proto published; no public GitHub organisation exists.
- id: tls-1-2
  conforms: true
  evidence: security/apex27-domain-security.yml — TLSv1.2 on apex27.co.uk, api.apex27.co.uk and dev-api.apex27.co.uk.
- id: hsts
  conforms: partial
  evidence: HSTS present on apex27.co.uk (max-age 63072000); absent on api.apex27.co.uk and dev-api.apex27.co.uk.
- id: dnssec
  conforms: false
  evidence: security/apex27-domain-security.yml — DNSSEC not enabled on apex27.co.uk.
- id: caa
  conforms: false
  evidence: No CAA records on apex27.co.uk.
- id: spf
  conforms: true
  evidence: SPF record present on apex27.co.uk.
- id: dmarc
  conforms: true
  evidence: DMARC present with policy quarantine.
certifications:
  published: false
  evidence: No SOC 2, ISO 27001, PCI DSS, Cyber Essentials, GDPR or ICO claim appears on apex27.co.uk.
    The acceptable-use-policy and privacy-policy pages contain zero compliance-certification keywords,
    and no trust centre exists at trust./security./compliance. The round-1 apis.yml Compliance pointer
    aimed at the acceptable-use policy has therefore been retyped to AcceptableUsePolicy — an AUP is not
    a published compliance programme.