generated: '2026-09-03' method: derived source: >- Asserted against openapi/flightfinder-aviation-safety-data-openapi.json, the live /.well-known/api-catalog linkset, live response headers observed 2026-09-03, and the published policy pages (/developers, /legal/terms, /legal/privacy, /legal/attributions, /editorial-standards, /ai-content-policy). description: >- Cross-cutting and domain-standard conformance for the FlightFinder Aviation Safety Data API. The provider's real strength is identifier hygiene and licence provenance; its gaps are the HTTP-level API standards (no RFC 9457, no OAuth, no RFC 8594) and the absence of any published security or compliance programme. cross_cutting: - id: openapi-3 conforms: true evidence: >- openapi 3.0.3 served at https://himaxym.com/api/v1/data/openapi.json, 17 paths, 18 operations, components.schemas + components.responses reused throughout. - id: rfc9727-api-catalog conforms: true evidence: >- https://himaxym.com/.well-known/api-catalog returns HTTP 200 application/linkset+json with an anchor of https://himaxym.com/api/v1/data and service-desc / service-doc / status link relations. This is a correct RFC 9727 (API Catalog) / RFC 9264 linkset. - id: rfc9331-ratelimit-headers conforms: true evidence: >- Live responses carry RateLimit-Policy (e.g. "100;w=86400"), RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset on every request, plus Retry-After on 429 (declared in components.responses.RateLimited). - id: pagination conforms: true style: cursor evidence: >- GET /events takes limit (1-100, default 25) + cursor and returns {data[], next_cursor}. - id: rfc9457-problem-details conforms: false evidence: >- Errors are {"error":{"code","message"}} with media type application/json, not application/problem+json. The /keys routes use a second, different envelope. - id: idempotency conforms: false evidence: >- No Idempotency-Key header anywhere in the spec or docs. The data surface is GET-only so it is inherently idempotent, but POST /keys is not replay-safe. - id: rfc8594-sunset-deprecation conforms: false evidence: No Sunset or Deprecation header observed; no deprecation policy published. - id: rfc9116-security-txt conforms: false evidence: /.well-known/security.txt returns HTTP 404 on himaxym.com. - id: oauth2 conforms: false evidence: >- Only an http/bearer securityScheme is declared; both OAuth discovery well-knowns return 404. - id: oidc conforms: false evidence: /.well-known/openid-configuration returns HTTP 404. - id: mcp conforms: true evidence: >- https://himaxym.com/mcp answers JSON-RPC 2.0 initialize with protocolVersion 2025-06-18 and tools/list with 9 tools carrying full inputSchemas, anonymously. - id: cors conforms: true evidence: 'access-control-allow-origin: * on /api/v1/data responses.' - id: hsts conforms: true evidence: 'strict-transport-security: max-age=63072000; includeSubDomains; preload' domain_standards: note: >- The Kin Score regime map has no aviation or transportation regime, so nothing below is scored against a regime shortlist. It is recorded because these ARE the identifier standards of this market, and a consumer who already speaks them integrates with no bespoke connector. standards: - id: icao-doc-8643-type-designators name: ICAO aircraft type designators (ICAO Doc 8643) conforms: true declared_in_contract: true evidence: >- OpenAPI paths./events.get.parameters[name=type].description — "ICAO aircraft type designator (e.g. B738)"; components.schemas.Occurrence.type_icao. Also the aircraft_safety / search_accidents MCP tool schemas. - id: icao-iata-location-identifiers name: ICAO / IATA airport location identifiers conforms: true declared_in_contract: true evidence: >- OpenAPI paths./airports/{ident}.get — "Airport reference lookup by ICAO ident or IATA code (OurAirports, CC0)"; MCP tool airport_reference inputSchema "ICAO ident or IATA code". - id: iso-3166-1-alpha-2 name: ISO 3166-1 alpha-2 country codes conforms: true declared_in_contract: true evidence: >- OpenAPI paths./events.get.parameters[name=country].description — "ISO 3166-1 alpha-2 country code"; components.schemas.Occurrence.country_iso. - id: iso-8601-dates name: ISO 8601 / RFC 3339 dates conforms: true declared_in_contract: true evidence: 'from/to query parameters declared as type: string, format: date (YYYY-MM-DD).' - id: ourairports name: OurAirports reference dataset (CC0) conforms: true declared_in_contract: true evidence: >- GET /airports/{ident} names OurAirports and its CC0 licence in the operation summary; also cited in /editorial-standards. - id: datacite-doi name: DataCite DOI (via Zenodo) conforms: true declared_in_contract: false evidence: >- https://himaxym.com/llms.txt declares a Zenodo concept DOI (10.5281/zenodo.21347859) for versioned CC BY wildlife-strike aggregates. This is a real persistent-identifier registration, but it is declared in llms.txt, NOT in the API contract, so declared_in_contract is false. - id: schema-org name: schema.org structured data conforms: true declared_in_contract: false evidence: >- JSON-LD @graph blocks (WebSite, Organization, BreadcrumbList, FAQPage) are served on the HTML pages; /editorial-standards describes Person structured data on bylined stories. - id: contentsignals name: Content Signals Policy (contentsignals.org) conforms: true declared_in_contract: false evidence: >- 'Content-Signal: search=yes, ai-input=yes, ai-train=yes' in https://himaxym.com/robots.txt, alongside per-agent rules for GPTBot, ClaudeBot, PerplexityBot, CCBot, Google-Extended and others. compliance: certifications: [] programs: [] published: false note: >- No SOC 2, ISO 27001, PCI, HIPAA, FedRAMP or GDPR compliance claim was found on any page, and there is no trust centre. The provider publishes a privacy policy and terms of service (/legal/privacy, /legal/terms) and an AI content policy (/ai-content-policy), but those are legal notices, not a compliance programme — so no Compliance pointer is emitted. licensing: model: per-source, machine-readable endpoint: https://himaxym.com/api/v1/data/sources evidence: >- GET /sources returns 130 source records, each with code, name, license, homepage, narrative count and narrative policy (full | excerpt). Every Occurrence carries a sources[] array of {source, attribution, license, url}. note: >- This is the most standards-relevant thing the API does: licence provenance is a first-class field in the contract, not a footnote in the terms.