generated: '2026-08-12'
method: derived
source: >-
  openapi/_original/das-technology-daswebapi-v1-swagger.json,
  openapi/_original/das-technology-daswebapi-v2-swagger.json, live probes of
  https://api.digitalairstrike.com/, and a search of https://www.dastechnology.com for published
  compliance or certification claims
api: DAS Web API (DASWebAPI v1 + v2)
note: >-
  Every assertion below is evidence-backed. `conforms: false` on a standard the provider never
  claimed is a factual reading of the contract, not a criticism of a claim they did not make. No
  compliance program, certification or audit report (SOC 2, ISO 27001, PCI DSS, HIPAA) was found
  published on any DAS Technology surface, so no Compliance pointer is emitted.
standards:
- id: openapi-3
  conforms: false
  evidence: >-
    Both documents declare `swagger: "2.0"` with host/basePath, definitions and (absent)
    securityDefinitions. Neither is an OpenAPI 3.x document.
- id: swagger-2
  conforms: true
  evidence: >-
    /swagger/docs/v1 and /swagger/docs/v2 are valid Swagger 2.0, generated by Swashbuckle and
    served publicly and anonymously (HTTP 200, application/json).
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityDefinition, no anonymous token endpoint (/token 404, /oauth/token 404) and no
    /.well-known/oauth-authorization-server (404). The live 401 advertises `WWW-Authenticate: Bearer`
    but the grant is not an OAuth 2.0 flow that a caller can discover.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every host.
- id: rfc9457
  conforms: false
  evidence: >-
    Errors are a proprietary XML <Error> envelope; no application/problem+json is produced anywhere.
- id: rfc8594-deprecation
  conforms: false
  evidence: No Deprecation or Sunset header observed; one operation flagged deprecated with no sunset date.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on api.digitalairstrike.com and www.dastechnology.com.
- id: idempotency
  conforms: false
  evidence: >-
    No Idempotency-Key header and no client request identifier on any of the 25 non-GET operations,
    including email send, SMS provisioning and survey dispatch.
- id: pagination
  conforms: partial
  evidence: >-
    v2 collections return DAS.Models.PagedResult[T] with `data` + `count` and accept page/pageSize/
    orderBy. v1 collections return bare arrays with no envelope or total. No cursor, no Link header.
- id: json-api
  conforms: false
  evidence: No JSON:API media type, document structure or included/relationships envelope.
- id: hal
  conforms: false
  evidence: No hypermedia links in any response schema.
- id: rest-content-negotiation
  conforms: true
  evidence: >-
    Every operation advertises application/json, text/json, application/xml, text/xml and text/html
    in `produces`, and the API honors Accept.
- id: https-only
  conforms: true
  evidence: >-
    `schemes: [https]` in both documents; api.digitalairstrike.com negotiates TLS 1.3 (see
    security/das-technology-domain-security.yml).
- id: hsts
  conforms: false
  evidence: >-
    api.digitalairstrike.com returns no Strict-Transport-Security header (probed 2026-08-12).
compliance_claims_published: []