generated: '2026-08-01'
method: derived
source: openapi/decart-api-openapi-original.json + openapi/decart-platform-openapi-original.json
  + grpc/decart-a2v.proto + https://docs.platform.decart.ai/
description: Cross-cutting standards conformance for the Decart API, derived from
  the two published OpenAPI documents, the published proto3 definitions, the A2A agent
  card and the MCP server, and checked against the documentation for explicit compliance
  claims.
standards:
- id: openapi-3.1
  conforms: true
  evidence: Both published documents declare openapi 3.1.0. Served at https://api.decart.ai/openapi.json
    (54 paths / 55 operations) and https://docs.platform.decart.ai/openapi.json (19
    paths / 20 operations).
- id: json-schema-2020-12
  conforms: true
  evidence: OpenAPI 3.1 schema objects; components.schemas defines 55 named schemas
    in the API-host document.
- id: grpc-proto3
  conforms: true
  evidence: grpc/decart-a2v.proto and grpc/decart-common.proto declare syntax = "proto3";
    service decart.inference.a2v.A2VService exposes Initialize / Prompt / Infer / Finish.
- id: webrtc
  conforms: true
  evidence: The realtime surface is WebRTC media over a LiveKit-managed session; SDKs
    negotiate h264 or vp9.
- id: model-context-protocol
  conforms: true
  evidence: Hosted MCP server at https://docs.platform.decart.ai/mcp answers JSON-RPC
    2.0 tools/list anonymously with three tools carrying inputSchema.
- id: a2a-agent-card
  conforms: true
  grade: near-conformant
  evidence: /.well-known/agent-card.json on docs.platform.decart.ai returns a valid
    AgentCard with protocolVersion 0.3, an object capabilities member and a skills
    array. Uses the pre-1.0 `supportedInterfaces` member name.
- id: llms-txt
  conforms: true
  evidence: https://docs.platform.decart.ai/llms.txt returns a valid llms.txt index
    (HTTP 200, text/plain) listing every documentation page plus the OpenAPI spec.
- id: rfc8615-well-known
  conforms: true
  evidence: Serves /.well-known/agent-card.json and /.well-known/agent-skills/decart/skill.md
    on the docs host.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme in either spec; no /.well-known/oauth-authorization-server
    (404 on all four hosts). Authentication is an x-api-key header plus ephemeral client
    tokens.
- id: openid-connect
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on decart.ai, platform.decart.ai,
    api.decart.ai and docs.platform.decart.ai. Enterprise SSO governs console sign-in,
    not API authentication.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use the FastAPI HTTPValidationError envelope with application/json;
    no application/problem+json media type and no type URIs.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on all four probed hosts.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header is documented; model retirement is announced
    in the changelog only.
- id: idempotency-key
  conforms: false
  evidence: No idempotency key header, parameter, or deduplication contract appears
    in either spec or anywhere in the documentation.
- id: asyncapi
  conforms: false
  evidence: No event or webhook surface exists. Job completion is discovered by polling
    GET /v1/jobs/{job_id}; there are no callbacks to describe.
- id: json-api
  conforms: false
- id: scim2
  conforms: false
- id: odata
  conforms: false
- id: fhir-r4
  conforms: false
compliance_program:
  published: false
  trust_center: null
  certifications: []
  note: 'No trust centre, security page, or named certification (SOC 2, ISO 27001,
    PCI DSS, HIPAA, FedRAMP) was found. trust.decart.ai and security.decart.ai do
    not resolve; decart.ai/security returns 404. Decart does publish privacy and data-handling
    legal instruments — a Privacy Policy, an Acceptable Use Policy and a Data Processing
    Addendum (April 2026) — but a DPA is a contractual instrument, not an audited compliance
    programme, so no Compliance pointer is emitted.'
legal_instruments:
- {name: Terms of Service, url: 'https://docs.platform.decart.ai/resources/terms-of-service'}
- {name: API Terms of Service, url: 'https://docs.platform.decart.ai/resources/api-terms'}
- {name: Acceptable Use Policy, url: 'https://docs.platform.decart.ai/resources/aup'}
- {name: Data Processing Addendum, url: 'https://docs.platform.decart.ai/resources/dpa'}
- {name: Privacy Policy, url: 'https://docs.platform.decart.ai/resources/privacy-policy'}