generated: '2026-08-27' method: searched source: >- https://grafana.com/docs/loki/latest/reference/loki-http-api/ and https://grafana.com/legal/security-compliance/ name: Grafana Loki conformance and compliance description: >- Which cross-cutting and domain standards Grafana Loki's contract actually declares, with evidence pointing at the exact endpoint, header or published page. Loki's domain is observability, and its strongest conformance claims are domain ones: it accepts OTLP/HTTP log ingest and it serves a Prometheus-API-compatible ruler and Prometheus text-format metrics. standards: - id: otlp-logs name: OpenTelemetry Protocol (OTLP/HTTP) — Logs domain: observability conforms: true evidence: type: endpoint location: 'POST /otlp/v1/logs' source: https://grafana.com/docs/loki/latest/reference/loki-http-api/ note: >- Loki exposes a native OTLP/HTTP logs receiver at the standard OTLP logs path. A producer that already speaks OTLP needs no Loki-specific connector; the OTLP resource and log-record attributes are mapped onto Loki labels and structured metadata. domain_standard: true - id: prometheus-http-api name: Prometheus HTTP API compatibility domain: observability conforms: true evidence: type: endpoint location: '/api/prom/*, GET /prometheus/api/v1/rules, GET /prometheus/api/v1/alerts' source: https://grafana.com/docs/loki/latest/reference/loki-http-api/ quote: >- "API endpoints starting with /api/prom are Prometheus API-compatible and the result formats can be used interchangeably." domain_standard: true - id: prometheus-exposition name: Prometheus text exposition format domain: observability conforms: true evidence: type: endpoint location: 'GET /metrics' source: https://grafana.com/docs/loki/latest/reference/loki-http-api/ note: Loki exposes its own operational metrics in Prometheus exposition format on every component. domain_standard: true - id: prometheus-alerting-rules name: Prometheus alerting/recording rule group schema domain: observability conforms: true evidence: type: schema location: 'POST /loki/api/v1/rules/{namespace} request body; grpc/grafana-loki-rules.proto' source: https://grafana.com/docs/loki/latest/reference/loki-http-api/ note: >- The Loki ruler accepts Prometheus-shaped rule group YAML (name, interval, rules[] with alert/expr/for/labels/annotations), with LogQL in place of PromQL in expr. domain_standard: true - id: grpc-protobuf name: gRPC / Protocol Buffers 3 domain: transport conforms: true evidence: type: contract location: 'grpc/grafana-loki-push.proto, grpc/grafana-loki-logproto.proto' source: https://github.com/grafana/loki/tree/main/pkg note: 'proto3 service definitions: Pusher (1 RPC), Querier (11 RPCs), StreamData (1 RPC).' - id: websocket name: WebSocket (RFC 6455) domain: transport conforms: true evidence: type: endpoint location: 'GET /loki/api/v1/tail' source: https://grafana.com/docs/loki/latest/reference/loki-http-api/ - id: oauth2 name: OAuth 2.1 authorization code with PKCE domain: security conforms: partial evidence: type: metadata location: https://mcp.grafana.com/.well-known/oauth-authorization-server status: 200 note: >- Applies to the hosted Grafana Cloud MCP server, not to the Loki HTTP API. Loki itself has no OAuth surface. - id: rfc8414 name: 'RFC 8414 OAuth 2.0 Authorization Server Metadata' domain: security conforms: partial evidence: type: well-known location: 'https://mcp.grafana.com/.well-known/oauth-authorization-server' status: 200 - id: rfc9728 name: 'RFC 9728 OAuth 2.0 Protected Resource Metadata' domain: security conforms: partial evidence: type: well-known location: 'https://mcp.grafana.com/.well-known/oauth-protected-resource' status: 200 - id: mcp name: Model Context Protocol domain: agent conforms: true evidence: type: endpoint location: 'https://mcp.grafana.com/mcp (streamable HTTP)' status: 401 note: 'Loki reaches MCP through the Grafana Labs MCP servers. See mcp/grafana-loki-mcp.yml.' - id: rfc9457 name: 'RFC 9457 Problem Details for HTTP APIs' domain: cross-cutting conforms: false evidence: type: absence location: 'errors/grafana-loki-problem-types.yml' note: >- Loki returns plain text on the push path and {"status":"error","error":"..."} on the query path. No application/problem+json anywhere. It does publish a stable machine-readable `reason` vocabulary, which is a real error contract, just not this one. - id: rfc8594 name: 'RFC 8594 Sunset header / Deprecation header' domain: cross-cutting conforms: false evidence: type: absence location: 'lifecycle/grafana-loki-lifecycle.yml' note: 'Deprecations are published in a documentation table, never signalled at runtime.' - id: idempotency-key name: Idempotency-Key header domain: cross-cutting conforms: false evidence: type: absence location: 'conventions/grafana-loki-conventions.yml' note: 'No idempotency header is published; retry safety is a storage property, not a contract.' - id: pagination name: Cursor or offset pagination domain: cross-cutting conforms: false evidence: type: absence location: 'conventions/grafana-loki-conventions.yml' note: 'Result sets are bounded by a time window plus a limit; clients walk the window instead.' - id: rate-limit-headers name: 'RateLimit-* response header fields' domain: cross-cutting conforms: false evidence: type: absence location: 'rate-limits/grafana-loki-rate-limits.yml' note: 'No published rate-limit headers and no Retry-After; the signal is a Prometheus counter.' - id: openapi name: OpenAPI domain: cross-cutting conforms: false evidence: type: absence location: 'Probed grafana.com/openapi.json and /swagger.json (404) and scanned all 21,041 paths in grafana/loki.' note: 'No OpenAPI document is published. The machine-readable contracts Loki does publish are protobuf.' domain_standard_conformance: market: observability / log aggregation standards_declared: [otlp-logs, prometheus-http-api, prometheus-exposition, prometheus-alerting-rules] count: 4 summary: >- Loki declares four domain standards in its own contract, not on a marketing page: an OTLP/HTTP logs receiver at the standard path, a Prometheus-API-compatible ruler with an explicit interchangeability statement, Prometheus text-format metrics exposition, and Prometheus-shaped rule groups. A team already running OpenTelemetry collectors or Prometheus tooling integrates with no bespoke connector. compliance: published: true url: https://grafana.com/legal/security-compliance/ scope: >- Grafana Labs corporate and Grafana Cloud (which operates Grafana Cloud Logs, the hosted Loki service). Self-hosted Loki inherits none of it — the certifications attach to Grafana Labs as an operator, not to the AGPL software. certifications: - {name: 'ISO 27001', status: certified, auditor: 'A-LIGN', note: 'Certified through an independent third-party audit.'} - {name: 'SOC 2 Type 2', status: certified, auditor: 'A-LIGN', note: 'Certified through an independent third-party audit.'} - {name: 'PCI DSS', status: compliant, note: 'Maintained through third-party approved scanning vendors for the Grafana Labs corporate environment for client payment processing.'} - {name: 'GDPR', status: compliant, note: 'Data Processing Agreement available at https://grafana.com/legal/data-processing-agreement/'} - {name: 'CSA STAR', status: completed, note: 'Completed the Cloud Security Alliance Security Trust Assurance and Risk program.'} - {name: 'EU-US / Swiss-US Data Privacy Framework', status: participating, url: 'https://grafana.com/legal/eu-privacy-framework/'} - {name: 'FedRAMP High', status: authorized, scope: 'Grafana Federal Cloud only', url: 'https://grafana.com/products/fedramp-federal-cloud/', note: 'FedRAMP High authorization announced 2025-04-16; general availability with DoD IL5 compliance announced at ObservabilityCON 2025. Applies to the separate Grafana Federal Cloud offering, not to commercial Grafana Cloud.'} certification_count: 7 trust_portal: 'https://trust.grafana.com/' conformance_count: 16 checked: '2026-08-27'