generated: '2026-08-04' method: derived source: >- openapi/cresilon-*-openapi.yml and live responses from https://cresilon.com/wp-json/ (2026-08-04), plus the certification asserted in the cresilon.com site footer summary: >- Which cross-cutting standards the Cresilon content API actually conforms to. Cresilon is a biotechnology and medical-device manufacturer; it publishes no API documentation and makes no standards claim about this surface. Every API assertion below is derived from observed behaviour, not from a provider claim. The one certification Cresilon DOES publish — ISO 13485:2016 — governs its medical-device quality management system and its manufacturing, not this API; it is recorded separately below and must not be read as an API or information-security compliance claim. standards: - id: openapi-3.1 conforms: true evidence: >- Not published by the provider — the eight specs in openapi/ are OpenAPI 3.1.0 documents DERIVED by API Evangelist from the live route index. Recorded as our artifact, not theirs. authored_by: api-evangelist - id: rest conforms: true evidence: >- Resource-oriented URIs, GET-only public surface, JSON representations, correct 200/400/404 status semantics. - id: http-status-semantics conforms: partial evidence: >- Capability failures for an anonymous caller are returned as 401 Unauthorized rather than 403 Forbidden, and no WWW-Authenticate challenge accompanies them. Observed on /wp/v2/settings, /wp/v2/themes, /wp/v2/plugins and eleven other routes. - id: hal-style-hypermedia conforms: partial evidence: >- Objects carry a `_links` object with self/collection/about/author/wp:term/wp:attachment/ replies relations and a `curies` prefix definition. It resembles HAL but is the WordPress variant, not application/hal+json — the media type is application/json. - id: rfc8288-web-linking conforms: true evidence: >- Collection responses return a `Link` header with rel="next"/rel="prev", e.g. ; rel="next" - id: rfc9457-problem-details conforms: false evidence: >- Errors are application/json with the WordPress {code, message, data.status} envelope, not application/problem+json. See errors/cresilon-problem-types.yml. - id: oembed-1.0 conforms: true evidence: >- /oembed/1.0/embed returns a version "1.0" oEmbed response with provider_name "Cresilon", provider_url, author_name, title, type, html and thumbnail fields, in both JSON and XML. Verified live for https://cresilon.com/ and https://cresilon.com/vetigel/. - id: schema-org-json-ld conforms: true evidence: >- Yoast SEO emits a schema.org JSON-LD @graph in every page head and in the `yoast_head_json` field of post, page, category and tag objects, and serves it via /yoast/v1/get_head. Verified live for the home page and /our-story/. - id: rss-2.0 conforms: true evidence: >- https://cresilon.com/feed/ returns a valid RSS 2.0 channel of the same 36 posts exposed by /wp/v2/posts. Outside the REST API but part of the machine-readable surface. - id: sitemaps-org conforms: true evidence: >- /sitemap.xml returns a Jetpack sitemap index (page, image and video sitemaps) and /robots.txt additionally declares the Yoast index at /sitemap_index.xml and a news sitemap. - id: rfc9116-security-txt conforms: false evidence: /.well-known/security.txt returned 404. See well-known/cresilon-well-known.yml. - id: rfc9727-api-catalog conforms: false evidence: /.well-known/api-catalog returned 404. - id: oauth2 conforms: false evidence: >- No oauth2 security scheme anywhere on the surface; /.well-known/oauth-authorization-server returned 404. The only advertised auth method is WordPress Application Passwords over HTTP Basic — an administrative credential. No scopes/ artifact is emitted for this provider. - id: oidc conforms: false evidence: /.well-known/openid-configuration returned 404. - id: asyncapi conforms: false applicable: false evidence: >- No event, streaming or webhook surface exists on this site — nothing to describe. Not a gap, and not scored against this provider. - id: mcp conforms: false evidence: >- No hosted MCP server published. A candidate tool list derived from the OpenAPI operations is recorded in mcp/cresilon-mcp.yml with status candidate; no MCPServer pointer is wired. - id: a2a conforms: false evidence: >- /.well-known/agent-card.json and /.well-known/agent.json both returned 404 on cresilon.com. No agent card exists; none was authored. - id: llms-txt conforms: false evidence: >- /llms.txt returned 404. The file in llms/ was GENERATED by API Evangelist, not published by Cresilon. - id: cors conforms: true evidence: >- Access-Control-Allow-Headers and Access-Control-Expose-Headers are set, exposing X-WP-Total, X-WP-TotalPages and Link to browser clients. - id: http-caching conforms: false evidence: >- No Cache-Control, ETag or Last-Modified header on any REST response, so conditional requests and a stated freshness window are both unavailable. - id: tls-1.3 conforms: true evidence: >- cresilon.com negotiates TLSv1.3. See security/cresilon-domain-security.yml. - id: hsts conforms: true evidence: >- Strict-Transport-Security: max-age=31536000 observed on both the site root and the API routes. No includeSubDomains, no preload. - id: dnssec conforms: false evidence: DNSSEC is not enabled on cresilon.com (probed 2026-08-04). - id: caa conforms: false evidence: No CAA records published for cresilon.com. - id: spf conforms: true evidence: An SPF record is published for cresilon.com. - id: dmarc conforms: partial evidence: >- A DMARC record exists with policy p=quarantine — enforcing, but short of p=reject. - id: iso-13485 conforms: true scope: medical-device-qms applies_to_api: false evidence: >- Cresilon asserts "ISO 13485:2016 Certified for Quality Management System" in the footer of every page of cresilon.com and links to the certifier's client directory entry — BSI certificate MD 822618. This is a third-party-verifiable certification of the company's medical-device quality management system and manufacturing operation. It says nothing about the security, availability or governance of this API surface. certificate: MD 822618 certifier: BSI Group verification_url: https://www.bsigroup.com/en-IE/products-and-services/assessment-and-certification/validation-and-verification/client-directory-certificate/MD%20822618 compliance_program: published: true scope: medical-device-quality-management certifications: - standard: ISO 13485:2016 subject: Quality Management System certifier: BSI Group certificate: MD 822618 published_at: https://cresilon.com/ verification_url: https://www.bsigroup.com/en-IE/products-and-services/assessment-and-certification/validation-and-verification/client-directory-certificate/MD%20822618 regulatory: - authority: U.S. Food and Drug Administration pathway: 510(k) clearance products: - name: Cresilon Hemostatic Gel (CHG) cleared: '2023' note: First FDA clearance for human use. - name: TRAUMAGEL cleared: '2024' note: >- Cleared for control of moderate to severe external traumatic bleeding; U.S. nationwide launch January 2025. source: https://cresilon.com/our-story/ information_security: published: false detail: >- Cresilon publishes NO trust center, NO SOC 2 / ISO 27001 / PCI DSS / HIPAA / FedRAMP page, and NO security or vulnerability disclosure policy. Probed 2026-08-04 — trust.cresilon.com and security.cresilon.com do not resolve, /.well-known/security.txt returned 404, and no /security or /responsible-disclosure page exists. See security/. This is the notable gap for a company handling clinician, distributor and member-area accounts. detail: >- A `Compliance` pointer IS wired in apis.yml for this provider because the certification is real, named, currently asserted on the provider's own site, and independently verifiable at the certifier. Consumers should read its scope literally: it covers device manufacturing quality, not this API.