generated: '2026-08-02'
method: derived
source:
- openapi/beehero-openapi-original.yml
- authentication/beehero-authentication.yml
- security/beehero-domain-security.yml
- errors/beehero-problem-types.yml
- conventions/beehero-conventions.yml
- well-known/beehero-well-known.yml
note: >-
  Derived from the harvested contract and live probes. BeeHero publishes no compliance program,
  certification list or trust center, so no `Compliance` pointer is wired in apis.yml.
standards:
- id: openapi-3.0
  conforms: true
  evidence: openapi/beehero-openapi-original.yml declares openapi 3.0.0 with 12 operations across 4 tags
- id: openapi-3.1
  conforms: false
  evidence: spec is pinned at 3.0.0
- id: rfc6750-bearer-token
  conforms: true
  evidence: securitySchemes.bearerAuth is type http, scheme bearer, bearerFormat JWT
- id: oauth2
  conforms: false
  evidence: no oauth2 securityScheme; auth is an email/password login exchanged for a bearer token
- id: oidc
  conforms: false
  evidence: no /.well-known/openid-configuration on any host (see well-known/beehero-well-known.yml)
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: /.well-known/oauth-authorization-server returns 404 on every host
- id: rfc9457-problem-details
  conforms: false
  evidence: 4xx responses carry a description only; no application/problem+json media type anywhere
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every BeeHero host
- id: rfc8594-sunset-header
  conforms: false
  evidence: no deprecation or sunset policy published (see lifecycle/beehero-lifecycle.yml)
- id: rest-http-method-semantics
  conforms: false
  evidence: >-
    read operations are modelled as POST with a JSON body (e.g. get_sensors_sample_by_mac_address),
    and validation failures return 404 rather than 400/422
- id: json-api
  conforms: false
  evidence: responses are bare JSON objects, no JSON:API document structure
- id: idempotency-key
  conforms: false
  evidence: no idempotency key header or de-duplication contract is documented
- id: pagination
  conforms: false
  evidence: no limit/offset/cursor parameters and no pagination envelope in the public spec
- id: model-context-protocol
  conforms: true
  evidence: >-
    official beehero-mcp package on npm built on @modelcontextprotocol/sdk, stdio transport, 11 tools
    and 10 prompts, plus an MCPB bundle (see mcp/beehero-mcp.yml)
- id: a2a-agent-card
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json return 404 on every host
- id: asyncapi
  conforms: false
  evidence: no event, streaming or webhook surface is documented
- id: tls-1.3
  conforms: true
  evidence: www.beehero.io, docs.beehero.io and backend.beehero.io all negotiate TLSv1.3
- id: hsts
  conforms: partial
  evidence: www.beehero.io sets max-age 31536000; docs.beehero.io and backend.beehero.io do not
- id: dnssec
  conforms: false
  evidence: beehero.io is not DNSSEC signed
- id: caa
  conforms: false
  evidence: no CAA records on beehero.io
- id: spf
  conforms: true
  evidence: beehero.io publishes an SPF record
- id: dmarc
  conforms: partial
  evidence: beehero.io publishes DMARC with policy p=none
certifications: []
certifications_note: >-
  No SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP or GDPR certification claim was found on beehero.io,
  and trust.beehero.io / security.beehero.io do not resolve.