generated: '2026-08-01'
method: derived
source: >-
  openapi/gotham-greens-*-openapi.yml and live responses from
  https://www.gothamgreens.com/wp-json/ (2026-08-01)
summary: >-
  Which cross-cutting standards the Gotham Greens content API actually conforms to. Gotham Greens
  is a fresh-produce and CPG company; it makes no compliance or standards claims about this
  surface anywhere in its documentation, because it publishes no API documentation at all. Every
  assertion below is derived from observed behaviour, not from a provider claim, and no
  `Compliance` pointer is emitted for this provider.
standards:
- id: openapi-3.1
  conforms: true
  evidence: >-
    Not published by the provider — the eight specs in openapi/ are OpenAPI 3.1.0 documents
    DERIVED by API Evangelist from the live route index. Recorded as our artifact, not theirs.
  authored_by: api-evangelist
- id: rest
  conforms: true
  evidence: >-
    Resource-oriented URIs, GET-only public surface, JSON representations, correct 200/400/401/404
    status semantics.
- id: hal-style-hypermedia
  conforms: partial
  evidence: >-
    Objects carry a `_links` object with self/collection/about/author/wp:term/wp:attachment/replies
    relations and a `curies` prefix definition. It resembles HAL but is the WordPress variant, not
    application/hal+json — the media type is application/json.
- id: rfc8288-web-linking
  conforms: true
  evidence: >-
    Collection responses return a `Link` header with rel="next"/rel="prev", e.g.
    <https://www.gothamgreens.com/wp-json/wp/v2/posts?per_page=2&page=2>; rel="next"
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors are application/json with the WordPress {code, message, data.status} envelope, not
    application/problem+json. See errors/gotham-greens-problem-types.yml.
- id: oembed-1.0
  conforms: true
  evidence: >-
    /oembed/1.0/embed returns a version "1.0" oEmbed response with provider_name, provider_url,
    author_name, title, type, html and thumbnail fields. Verified live for
    https://www.gothamgreens.com/our-story/.
- id: schema-org-json-ld
  conforms: true
  evidence: >-
    Yoast SEO emits a schema.org JSON-LD @graph in every page head and in the `yoast_head_json`
    field of post, page, category and tag objects, and serves it via /yoast/v1/get_head.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returned 404. See well-known/gotham-greens-well-known.yml.
- id: rfc9727-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returned 404.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 security scheme anywhere on the surface; /.well-known/oauth-authorization-server and
    /.well-known/oauth-protected-resource both returned 404.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returned 404.
- id: asyncapi
  conforms: false
  applicable: false
  evidence: >-
    No event, streaming or webhook surface exists on this site — nothing to describe. Not a gap.
- id: mcp
  conforms: false
  evidence: >-
    No hosted MCP server published. A candidate tool list derived from the OpenAPI operations is
    recorded in mcp/gotham-greens-mcp.yml with status candidate.
- id: a2a
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json both returned 404 on
    www.gothamgreens.com. No agent card exists; none was authored.
- id: llms-txt
  conforms: false
  evidence: >-
    /llms.txt returned 404. The file in llms/ was GENERATED by API Evangelist, not published by
    Gotham Greens.
- id: cors
  conforms: true
  evidence: >-
    Access-Control-Allow-Headers and Access-Control-Expose-Headers are set, exposing X-WP-Total,
    X-WP-TotalPages and Link to browser clients.
- id: tls-1.3
  conforms: true
  evidence: >-
    www.gothamgreens.com negotiates TLSv1.3. See security/gotham-greens-domain-security.yml.
- id: hsts
  conforms: false
  evidence: No Strict-Transport-Security header observed on www.gothamgreens.com.
- id: dnssec
  conforms: true
  evidence: DNSSEC is enabled on gothamgreens.com (probed 2026-08-01).
- id: dmarc
  conforms: partial
  evidence: >-
    A DMARC record exists but its policy is p=none — monitoring only, no enforcement. SPF is
    present. No CAA records are published.
compliance_program:
  published: false
  detail: >-
    Gotham Greens publishes no trust center, no SOC 2 / ISO 27001 / PCI / HIPAA / FedRAMP
    certification page, and no security or vulnerability disclosure policy. Probed 2026-08-01 —
    see security/. Food-safety certifications (e.g. GFSI / SQF) may govern its physical
    operations, but none are asserted about this API surface, so no Compliance pointer is wired.