generated: '2026-09-03'
method: derived
source: openapi/chocodata-openapi.json + https://chocodata.com/docs/guides/errors + https://chocodata.com/docs/guides/rate-limits + probed well-known surface
note: >-
  No certification or compliance program (SOC 2 / ISO 27001 / etc.) is published anywhere on the
  site, so no Compliance pointer is emitted. Web scraping has no domain API standard to assert;
  domain_standard_conformance is honestly N/A rather than filled.
standards:
  - id: openapi
    conforms: true
    evidence: Valid OpenAPI 3.1.0 served at https://chocodata.com/openapi.json (title Chocodata, servers api.chocodata.com).
  - id: llms-txt
    conforms: true
    evidence: llms.txt convention (llmstxt.org) served at https://chocodata.com/llms.txt and https://chocodata.com/docs/llms.txt, with .md twins for every docs page.
  - id: ai-plugin-manifest
    conforms: true
    evidence: /.well-known/ai-plugin.json (schema_version v1) served on chocodata.com, pointing at the OpenAPI.
  - id: rfc9110-retry-after
    conforms: true
    evidence: 429 and 503 responses carry a standard Retry-After header (docs/guides/rate-limits).
  - id: rfc9457
    conforms: false
    evidence: Errors use a custom JSON envelope {error, message, docs_url, request_id}, not application/problem+json.
  - id: oauth2
    conforms: false
    evidence: Auth is a single api_key query parameter; no OAuth2 flows, no /.well-known/oauth-authorization-server (probed 404).
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration 404 on all hosts probed 2026-09-03.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt 404 on chocodata.com, www, and api.chocodata.com (probed 2026-09-03).
  - id: idempotency
    conforms: false
    evidence: No idempotency-key mechanism documented; sole write operation (createBatch) has no replay protection.
  - id: apis-json
    conforms: false
    evidence: /apis.json, /apis.yml and /.well-known/apis.json all 404 (probed 2026-09-03).