generated: '2026-08-04'
method: derived
source: >-
  Derived from the captured OpenAPI documents in openapi/ and from live response headers and
  bodies observed against https://daring.com/wp-json/ on 2026-08-04. Daring Foods makes no
  conformance or compliance claim anywhere on its public surface, so nothing here is a provider
  assertion - every entry is our own measurement.
standards:
- id: rest
  conforms: true
  evidence: >-
    Resource-oriented collections and items over HTTPS with GET semantics, JSON representations
    and hypermedia `_links` on every record.
- id: openapi-3.1
  conforms: true
  evidence: >-
    Not published by the provider. Eleven OpenAPI 3.1.0 documents covering 31 verified operations
    were derived by API Evangelist from the live route index and are held in openapi/.
  provider_published: false
- id: json
  conforms: true
  evidence: All wp/v2 and yoast/v1 responses are application/json; charset=UTF-8.
- id: rfc8288-web-linking
  conforms: true
  evidence: >-
    Collection responses carry a Link header with rel="prev" and rel="next". Verified live on
    /wp/v2/recipes?per_page=2&page=2.
- id: oembed-1.0
  conforms: true
  evidence: >-
    /oembed/1.0/embed returns a valid oEmbed 1.0 rich response in JSON and XML, and the site
    advertises application/json+oembed and text/xml+oembed link relations in its HTML head.
- id: schema-org
  conforms: true
  evidence: >-
    Yoast emits a schema.org JSON-LD @graph for every URL, exposed both at /yoast/v1/get_head and
    inline as `yoast_head_json.schema` on each record. This is the only semantically typed
    description of Daring products and recipes available from this host.
- id: hal
  conforms: partial
  evidence: >-
    Records carry a `_links` object with self/collection/about/curies relations in HAL style, but
    the media type is application/json rather than application/hal+json.
- id: cors
  conforms: true
  evidence: >-
    Access-Control-Allow-Headers and Access-Control-Expose-Headers are set; X-WP-Total,
    X-WP-TotalPages and Link are exposed to browser clients.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use the WordPress {code, message, data.status} envelope over application/json. There is
    no type URI, no title member, and no application/problem+json media type.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404.
- id: rfc9727-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returns 404.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation headers are served; no deprecation policy exists.
- id: rfc9331-ratelimit-headers
  conforms: false
  evidence: No RateLimit or X-RateLimit-* headers are returned; no limits are published.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 security scheme in any captured spec; /.well-known/oauth-authorization-server
    returns 404. The advertised write-side mechanism is WordPress Application Passwords (HTTP
    Basic over TLS), not OAuth.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404.
- id: a2a
  conforms: false
  evidence: >-
    Both /.well-known/agent-card.json and the legacy /.well-known/agent.json return 404. No agent
    card is published.
- id: mcp
  conforms: false
  evidence: >-
    No hosted MCP server exists for this provider. mcp/daring-foods-mcp.yml holds a candidate tool
    set derived from the captured OpenAPI operations, explicitly marked status: candidate.
- id: asyncapi
  conforms: false
  applicable: false
  evidence: >-
    No event, streaming or webhook surface exists on this host - not applicable to a read-only CMS
    content API, so no AsyncAPI or Webhooks artifact is emitted.
- id: llms-txt
  conforms: false
  evidence: >-
    https://daring.com/llms.txt returns 404. llms/daring-foods-llms.txt in this repo is generated
    by API Evangelist from the catalog, not served by the provider.
compliance_program:
  published: false
  certifications: []
  trust_center: null
  detail: >-
    No SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP or GDPR posture is published, and
    probe-security-programs.py found no trust center and no vulnerability-disclosure program on
    this domain. Consequently NO `Compliance`, `TrustCenter`, `Security` or
    `VulnerabilityDisclosure` pointer is emitted in apis.yml - the underlying thing does not exist.
    A privacy policy is published at https://privacy.daring.com/privacy-policy, which is a consumer
    data-practices document, not an API compliance program.