generated: '2026-08-04'
method: derived
source: openapi/grin-therapeutics-content-openapi.yml + live probes of https://grintherapeutics.com on 2026-08-04
note: >-
  Cross-cutting standards conformance for the GRIN Therapeutics Content API. Derived from the spec
  and live responses; nothing here rests on a compliance claim by GRIN Therapeutics, because it
  publishes none. No Compliance pointer is emitted in apis.yml: GRIN Therapeutics operates no trust
  center and names no certification (SOC 2, ISO 27001, HIPAA, GDPR programme page or equivalent) on
  any public page. As a clinical-stage sponsor its regulatory posture is FDA/EMA drug-development
  regulation, which is not an API compliance programme and is not asserted here.
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi/grin-therapeutics-content-openapi.yml is an API Evangelist derivation, not a provider-published spec.
  published_by_provider: false
- id: rest
  conforms: true
  evidence: Resource-oriented URIs, GET-only anonymous surface, JSON representations, standard status codes.
- id: hateoas
  conforms: true
  evidence: Every resource carries a `_links` object with self/collection/about/author/wp:term relations plus curies; _embed inlines them.
- id: rfc8288-web-linking
  conforms: true
  evidence: 'Link header used for pagination (rel=next/prev) and for API discovery from HTML (rel="https://api.w.org/").'
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are served as application/json with the WordPress {code,message,data} envelope, not application/problem+json. See errors/grin-therapeutics-problem-types.yml.
- id: oembed-1.0
  conforms: true
  evidence: /oembed/1.0/embed returns a valid oEmbed 1.0 rich response; verified live for https://grintherapeutics.com/.
- id: rss-2.0
  conforms: true
  evidence: /feed/ returns a well-formed RSS 2.0 channel (with content, wfw, dc, atom, sy, slash namespaces). Valid but item-less.
- id: sitemaps-0.9
  conforms: true
  evidence: /wp-sitemap.xml is a sitemapindex in the sitemaps.org 0.9 namespace, declared in robots.txt.
- id: cors
  conforms: true
  evidence: 'Access-Control-Allow-Headers and Access-Control-Expose-Headers (X-WP-Total, X-WP-TotalPages, Link) are set on the REST responses.'
- id: oauth2
  conforms: false
  evidence: No oauth2 security scheme, no authorization server, no /.well-known/oauth-authorization-server (404).
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404.
- id: rfc9727-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returns 404.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header observed; no deprecation policy published.
- id: idempotency-key
  conforms: false
  evidence: No idempotency header or documented replay contract. The anonymous surface is GET-only (Allow header reads exactly 'GET').
- id: pagination
  conforms: true
  evidence: 'page/per_page with X-WP-Total, X-WP-TotalPages and RFC 8288 Link headers; per_page bounds enforced with a 400 rest_invalid_param.'
- id: a2a
  conforms: false
  evidence: No agent card at /.well-known/agent-card.json or /.well-known/agent.json (both 404).
- id: mcp
  conforms: false
  evidence: No MCP server published; mcp.grintherapeutics.com does not resolve. The site registers the WordPress Abilities API (wp-abilities/v1) but every route under it returns 401 anonymously.
- id: json-api
  conforms: false
  evidence: Responses are plain JSON, not the JSON:API media type or document structure.
- id: fhir
  conforms: false
  evidence: No health-data API surface. GRIN Therapeutics exposes no clinical or patient data over an API.
- id: hl7
  conforms: false
  evidence: No health-data interchange surface.
certifications_published: []
compliance_program_published: false