generated: '2026-08-13'
method: searched
source: >-
  Ghost documentation (docs.ghost.org), live probes of demo.ghost.io and docs.ghost.org,
  the TryGhost GitHub organisation, and the OpenAPI/AsyncAPI captures in this repo
provider: Ghost
providerId: ghost-org
description: >-
  Which industry and cross-cutting standards Ghost's API surface actually conforms to.
  Ghost is a publishing platform, so the regulated-industry profiles (FHIR, FAPI, PSD2,
  SCIM, OData) are not applicable and are recorded as non-conforming rather than
  omitted. The interesting conformance story is at the other end: Ghost ships a genuine
  ActivityPub/fediverse implementation, an MCP server, an A2A agent card and an Agent
  Skill, all served from its own hosts.
standards:
- id: oauth2
  name: OAuth 2.0
  conforms: false
  evidence: >-
    Neither API declares an oauth2 securityScheme and Ghost documents no authorization
    server. Content API uses a query-parameter key; Admin API uses a self-signed JWT.
    /.well-known/oauth-authorization-server 404s on every Ghost host.
- id: oidc
  name: OpenID Connect
  conforms: false
  evidence: /.well-known/openid-configuration returned 404 on ghost.org and docs.ghost.org.
- id: jwt
  name: JSON Web Token (RFC 7519)
  conforms: true
  evidence: >-
    Admin API authentication is a short-lived HS256 JWT signed from the Admin API key
    secret and sent as `Authorization: Ghost <token>`; Ghost publishes signing examples
    in Node, Ruby, Python, PHP and bash at https://docs.ghost.org/admin-api.
- id: rfc9457
  name: Problem Details for HTTP APIs
  conforms: false
  evidence: >-
    Errors are application/json with a Ghost-specific `{"errors":[...]}` envelope, not
    application/problem+json. See errors/ghost-org-problem-types.yml.
- id: pagination
  name: Documented pagination
  conforms: true
  evidence: >-
    page/limit query parameters with a meta.pagination block carrying page, limit,
    pages, total, next and prev. https://docs.ghost.org/content-api/pagination
- id: idempotency
  name: Idempotent write semantics
  conforms: false
  evidence: >-
    No Idempotency-Key header is published. Ghost uses optimistic concurrency on update
    (stale `updated_at` produces 409) which prevents lost updates but does not make a
    retried create safe.
- id: api-versioning
  name: Explicit API version negotiation
  conforms: true
  evidence: >-
    `Accept-Version: v{major}.{minor}` request header answered with a `Content-Version`
    response header; observed live as `content-version: v6.57`. A published stability
    index and per-major EOL table back it.
- id: rfc8594
  name: Sunset HTTP header
  conforms: false
  evidence: No Sunset or Deprecation header is documented or observed.
- id: openapi
  name: OpenAPI
  conforms: false
  evidence: >-
    Ghost publishes no OpenAPI document. Probes of /openapi.json and /openapi.yaml on
    docs.ghost.org and demo.ghost.io returned 404. The specs in openapi/ are API
    Evangelist captures derived from the published reference, not provider artifacts.
- id: asyncapi
  name: AsyncAPI
  conforms: false
  evidence: >-
    Ghost documents its webhook event catalogue in prose at
    https://docs.ghost.org/webhooks but publishes no AsyncAPI document. The file in
    asyncapi/ is an API Evangelist capture of that catalogue.
- id: activitypub
  name: ActivityPub
  conforms: true
  evidence: >-
    Ghost ships a first-party ActivityPub server (https://github.com/TryGhost/ActivityPub)
    and the social-web surface is exposed through the CLI and MCP tools. Probed live:
    https://demo.ghost.io/.well-known/webfinger returned 200 application/jrd+json
    resolving to an actor at /.ghost/activitypub/users/index.
- id: webfinger
  name: WebFinger (RFC 7033)
  conforms: true
  evidence: >-
    https://demo.ghost.io/.well-known/webfinger?resource=acct:index@demo.ghost.io
    returned 200 with a valid JRD. Saved at well-known/ghost-org-webfinger.json.
- id: nodeinfo
  name: NodeInfo 2.1
  conforms: true
  evidence: >-
    https://demo.ghost.io/.well-known/nodeinfo returned 200 with a 2.1 schema link.
    Saved at well-known/ghost-org-nodeinfo.json.
- id: rss
  name: RSS 2.0
  conforms: true
  evidence: >-
    https://demo.ghost.io/rss/ returned 200 application/rss+xml, RSS 2.0 with the
    dc, content and atom namespaces. Every Ghost site serves it by default.
- id: json-ld
  name: JSON-LD / schema.org structured data
  conforms: true
  evidence: >-
    Ghost emits an application/ld+json block from {{ghost_head}} on every rendered page;
    confirmed on https://demo.ghost.io/.
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    Hosted server at https://docs.ghost.org/mcp answered initialize with
    protocolVersion 2025-06-18 and returned three tools from tools/list. A second
    first-party server ships inside @tryghost/ghst. See mcp/ghost-org-mcp.yml.
- id: a2a
  name: A2A Agent Card
  conforms: partial
  evidence: >-
    https://docs.ghost.org/.well-known/agent-card.json returns a real card at the
    canonical path, graded conformant against the hard checks but declaring
    protocolVersion 0.3 and omitting the required top-level description. See
    a2a/ghost-org-a2a.yml.
- id: agent-skills
  name: Agent Skills
  conforms: true
  evidence: >-
    https://docs.ghost.org/.well-known/agent-skills/ghost/skill.md returns a
    frontmatter-bearing skill document referenced from the agent card. Saved verbatim at
    skills/ghost-org-ghost-skill.md.
- id: llmstxt
  name: llms.txt
  conforms: true
  evidence: >-
    https://docs.ghost.org/llms.txt returns 200 text/plain, 183 lines, with a per-page
    .md companion for every entry. Saved at llms/ghost-org-llms.txt.
- id: semver
  name: Semantic Versioning
  conforms: true
  evidence: Platform releases are semver-tagged on GitHub; current v6.57.1 (2026-08-10).
- id: json-api
  name: 'JSON:API'
  conforms: false
  evidence: Response envelope is a resource-named array plus meta, not a JSON:API document.
- id: odata
  name: OData
  conforms: false
  evidence: Filtering uses NQL, Ghost's own query language, not $filter.
- id: scim
  name: SCIM
  conforms: false
  evidence: >-
    Staff users are managed through the Admin API users/invites endpoints; no SCIM
    provisioning endpoint is published.
- id: fhir
  name: FHIR
  conforms: false
  evidence: Not applicable — Ghost is a publishing platform.
- id: fapi
  name: 'FAPI'
  conforms: false
  evidence: Not applicable — Ghost is a publishing platform.
- id: psd2
  name: PSD2
  conforms: false
  evidence: >-
    Not applicable. Ghost handles paid memberships by delegating to Stripe rather than
    by moving money itself.
compliance:
  certifications_published: []
  trust_center: false
  note: >-
    Ghost publishes no SOC 2, ISO 27001, PCI or HIPAA attestation and operates no trust
    centre. Its security posture is published as prose plus an open source codebase at
    https://docs.ghost.org/security. No Compliance pointer is emitted for this provider,
    because there is no certification to point at.
summary:
  standards_evaluated: 26
  conforms: 12
  partial: 1
  does_not_conform: 13