generated: '2026-07-25'
method: derived
source: openapi/cooperators-duuo-platform-openapi.yml
docs: https://web.archive.org/web/20240127073206id_/https://developer.duuo.ca/api/collections/26639007/2s93sXcubU
note: >-
  Standards posture for The Co-operators group. The finding for this carrier is largely negative and
  that is itself the signal: a top-tier Canadian multi-line insurer publishes no data-standards
  posture at all. Nothing below is asserted from a compliance page — The Co-operators publishes no
  trust centre, no certification list and no security disclosure programme (probed 2026-07-25).
standards:
  - id: oauth2-client-credentials
    conforms: true
    evidence: >-
      Duuo documents OAuth 2.0 with the client_credentials grant, client id/secret as an HTTP Basic
      header, JSON body grant_type=client_credentials, and a Bearer token on subsequent calls.
  - id: rfc6749-oauth2
    conforms: true
    evidence: Token response is the standard access_token / expires_in / token_type shape (3600s, Bearer).
  - id: rfc6750-bearer-token
    conforms: true
    evidence: 'Authorization: Bearer {access_token} on every operation.'
  - id: oauth2-scopes
    conforms: false
    evidence: No scopes are published; entitlement is per-partner and enforced server-side (403 "Requires Access Mgmt").
  - id: oidc-discovery
    conforms: false
    evidence: /.well-known/openid-configuration returns 404 on cooperators.ca and duuo.ca (probed 2026-07-25).
  - id: rfc8414-oauth-authorization-server-metadata
    conforms: false
    evidence: /.well-known/oauth-authorization-server returns 404 (probed 2026-07-25).
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Proprietary envelope (data.resolved.*). Tenant 404 is plain text "Module not found". No
      application/problem+json anywhere.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on cooperators.ca and duuo.ca (probed 2026-07-25).
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No deprecation or sunset policy is published.
  - id: rest-http-semantics
    conforms: partial
    evidence: >-
      Resource paths and JSON bodies, but verbs are used loosely — PUT is used to create a payment
      redirect (createTenantQuotePayment) and to trigger an email (emailEventPolicy), and a
      non-standard 440 status is documented on the event product.
  - id: openapi
    conforms: false
    evidence: >-
      Duuo published a Postman collection, never an OpenAPI document. The OpenAPI in this repo is a
      derivation by API Evangelist, not a provider artifact.
  - id: json-api
    conforms: false
  - id: odata
    conforms: false
  - id: scim2
    conforms: false
  - id: fapi
    conforms: false
  - id: acord-al3
    conforms: false
    evidence: >-
      No ACORD, AL3, ACORD XML, NGDS or IVANS reference exists in any Co-operators or Duuo public
      material, including the archived developer portal.
  - id: acord-xml
    conforms: false
  - id: csio-xml
    conforms: false
    evidence: >-
      CSIO is Canada's P&C data-standards body and the domestic counterpart to ACORD XML. The
      Co-operators and Sovereign Insurance are not listed in the public CSIO member directory
      (https://csio.com/membership/member-directory, HTTP 200, checked 2026-07-25).
  - id: agency-download
    conforms: false
    evidence: No broker download / data-exchange transport is published.
  - id: fhir-r4
    conforms: false
    evidence: Not applicable — property, casualty and life insurance, not health records.
  - id: open-banking-cdr
    conforms: false
    evidence: Not applicable — Canada has no in-force open-insurance mandate.
regulatory_context:
  jurisdiction: Canada
  note: >-
    Canada has no open-insurance or open-data mandate for insurers, and Canada's consumer-driven
    banking framework does not reach insurance carriers. Nothing legally compels The Co-operators to
    publish an API, which is the structural reason this surface is partner-gated and thin. The
    binding compliance regime Duuo does enforce on partners is conduct regulation — licensed
    representative handling of coverage questions, mandatory consent capture and disclosure text,
    credit-check consent, and a pre-go-live compliance review — not a data standard.
compliance_program:
  published: false
  certifications: []
  note: >-
    No SOC 2, ISO 27001, PCI DSS or equivalent certification is published on cooperators.ca or
    duuo.ca, and no trust centre was found (probe-security-programs.py, 2026-07-25). No `Compliance`
    pointer is emitted because there is no published compliance programme to point at.