generated: '2026-09-12'
method: searched
source: >-
  https://www.gbrx.com/certifications/ and https://www.gbrx.com/aar-approvals/ (fetched 2026-09-12),
  plus derivation from openapi/greenbrier-cos-*-openapi.yml and live responses
note: >-
  Two very different kinds of conformance are recorded here and they should not be read as one
  number. Greenbrier publishes a substantial, named set of MANUFACTURING quality, environmental and
  safety certifications - it is a regulated builder of pressure vessels that roll on the interchange
  - and those are real, dated, facility-scoped programs. It publishes NO information-security
  certification (no SOC 2, no ISO 27001), no API standard conformance, and no trust center. Do not
  read AAR M-1002 as an assurance about the API.
standards:
  - id: aar-m-1003
    name: AAR M-1003 Quality Assurance Program Certification
    domain: rail-manufacturing
    conforms: true
    scope: 20 facilities across North America and Mexico
    evidence: https://www.gbrx.com/certifications/
  - id: aar-m-1002
    name: AAR M-1002 Tank Car Facility Certification
    domain: rail-manufacturing
    conforms: true
    scope: 7 manufacturing locations
    evidence: https://www.gbrx.com/certifications/
    note: >-
      This is the domain-standard signature for a tank-car builder, and it is the certification that
      makes the gauge-table API meaningful: a gauge table is the calibration record of an M-1002
      facility's product.
  - id: iso-9001-2015
    name: ISO 9001:2015 Quality Management Systems
    domain: quality
    conforms: true
    scope: five international facilities
    evidence: https://www.gbrx.com/certifications/
  - id: iso-14001-2015
    name: ISO 14001:2015 Environmental Management Systems
    domain: environmental
    conforms: true
    scope: four facilities
    evidence: https://www.gbrx.com/certifications/
  - id: iso-45001-2018
    name: ISO 45001:2018 Occupational Health and Safety Management Systems
    domain: safety
    conforms: true
    scope: two facilities
    evidence: https://www.gbrx.com/certifications/
  - id: eu-tsi-module-sd
    name: Technical Specifications for Interoperability (TSI Module SD)
    domain: rail-interoperability-eu
    conforms: true
    scope: three European facilities
    evidence: https://www.gbrx.com/certifications/
  - id: aar-component-approvals
    name: AAR component approvals (PRD / E series)
    domain: rail-interoperability-na
    conforms: true
    scope: >-
      15 component-level approvals published by number for tank-car valves and relief devices -
      pressure relief (PRD-181006, PRD-131041, PRD-244202, PRD-244204, PRD-244205), vacuum relief
      (E-061027, E-2040200), angle and plug valves (E-101009, E-131042, E-214202), bottom outlet
      valves (E-141086, E-2040201, E-244201) and a thermowell (E-244200).
    evidence: https://www.gbrx.com/aar-approvals/
  - id: soc2
    name: SOC 2
    domain: information-security
    conforms: false
    evidence: >-
      Not claimed anywhere on gbrx.com; no trust center exists (probe-security-programs.py returned
      trust=none on 2026-09-12).
  - id: iso-27001
    name: ISO/IEC 27001
    domain: information-security
    conforms: false
    evidence: Not claimed on https://www.gbrx.com/certifications/, which lists 9001/14001/45001 only.
api_standards:
  - id: openapi
    conforms: false
    evidence: >-
      Greenbrier publishes no OpenAPI. The five specs in openapi/ are API Evangelist derivations
      from the provider's own route index and shipped client code.
  - id: rfc9457
    name: Problem Details for HTTP APIs
    conforms: false
    evidence: >-
      No surface returns application/problem+json. See errors/greenbrier-cos-problem-types.yml.
  - id: rfc5988
    name: Web Linking
    conforms: true
    evidence: >-
      The WordPress surface returns a Link header with rel="next"/rel="prev". Observed on GET
      /wp-json/wp/v2/posts?per_page=1 on 2026-09-12.
  - id: pagination
    conforms: true
    evidence: >-
      page/per_page with X-WP-Total and X-WP-TotalPages on the WordPress surface. The tank-car API
      has no pagination at all.
  - id: oauth2
    conforms: partial
    evidence: >-
      Not on any catalogued API. shop.gbrx.com serves a full OIDC/OAuth 2.0 discovery document
      (authorization_code + refresh_token, PKCE S256, private_key_jwt) at
      https://shop.gbrx.com/.well-known/openid-configuration, but it fronts a human storefront and
      Greenbrier issues no API credentials against it.
  - id: oidc
    conforms: partial
    evidence: https://shop.gbrx.com/.well-known/openid-configuration (HTTP 200, issuer https://shop.gbrx.com)
  - id: oembed
    name: oEmbed 1.0
    conforms: true
    evidence: >-
      GET https://www.gbrx.com/wp-json/oembed/1.0/embed?url=https://www.gbrx.com/ returned a
      conformant oEmbed 1.0 document on 2026-09-12.
  - id: idempotency
    conforms: na
    evidence: Read-only public surface; no mutating operations to protect.
  - id: json-api
    conforms: false
  - id: odata
    conforms: false
  - id: scim
    conforms: false
  - id: fhir
    conforms: false