generated: '2026-07-18'
method: derived
source: openapi/capy-inc-captcha-openapi.yml + https://help.leminnow.com/knowledge/developers-guide
description: >-
  Cross-cutting standards conformance for the Lemin Captcha Verification API,
  derived from the OpenAPI and developer docs. This is a single-endpoint
  verification API with a custom JSON result envelope, so most REST/identity
  standards do not apply. No published compliance certifications (SOC 2, ISO
  27001, PCI, HIPAA) were found, so no Compliance pointer is emitted.
standards:
- id: https-tls
  conforms: true
  evidence: All hosts serve over TLS 1.3 (see security/capy-inc-domain-security.yml).
- id: json-request-response
  conforms: true
  evidence: Requests and responses are application/json.
- id: oauth2
  conforms: false
  evidence: No OAuth surface; auth is a secret key in the request body.
- id: openidconnect
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Uses a custom {success,message,code} envelope, not application/problem+json.
- id: rfc8594-sunset
  conforms: false
  evidence: No Sunset/Deprecation header support documented.