generated: '2026-09-03'
method: derived
source: openapi/_original/gzw-data-openapi.json (4.2.0) + https://gzw-data.dev/docs/ + live probes 2026-09-03
note: >-
  Gaming / game-data is a market with no recognised machine-readable domain standard, so the
  domain_standard_conformance slot is legitimately empty — reward-only, nothing invented to fill it.
  No compliance certification, audit or trust program is published, so NO Compliance pointer is emitted.
conformance:
- id: openapi
  conforms: true
  version: 3.0.3
  evidence: >-
    https://gzw-data.dev/api/v1/spec returns a parseable OpenAPI 3.0.3 document, implementation
    version 4.2.0, with 362 paths and 92 component schemas (85 dataset schemas + ApiError,
    ApiErrorResponse, ObjectResponse, PaginatedResponse, RecordResponse, MetadataResponse,
    Capabilities). Re-fetched and saved verbatim to openapi/_original/gzw-data-openapi.json on
    2026-09-03. UPGRADE SINCE 4.0.0: every operation now declares 200/400/404/429 responses that
    $ref the shared schemas, and 176 declare their path parameters — the 4.0.0 document declared
    no responses at all. Still no operationId, no operation description and no tags.
- id: rest
  conforms: true
  evidence: Resource-oriented JSON over HTTPS; collection and single-record routes per dataset; GET only.
- id: json
  conforms: true
  evidence: Every response observed was application/json with a stable {data, count, ..., source, timestamp} envelope.
- id: rfc9457
  conforms: false
  evidence: >-
    Errors are a vendor envelope {"error":{"code","message",...},"source","timestamp"} served as
    application/json. No type/title/status/detail/instance members, no application/problem+json.
    Probed https://gzw-data.dev/api/v1/weapons/no-such-id (404).
- id: pagination
  conforms: true
  evidence: >-
    Page-number pagination with page/per_page/all and count/page/perPage/total/totalPages in the
    envelope, documented at https://gzw-data.dev/docs/#queries. Note the parameters are NOT declared
    in the OpenAPI, only in docs prose.
- id: idempotency
  conforms: na
  evidence: Read-only API — 362 GET operations and no write surface. Nothing to make idempotent.
- id: oauth2
  conforms: false
  evidence: No securitySchemes in the spec; /.well-known/oauth-authorization-server returned 404.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returned 404.
- id: rfc9116
  conforms: true
  evidence: >-
    CHANGED SINCE 2026-08-26 (was 404). https://gzw-data.dev/.well-known/security.txt returned 200
    on 2026-09-03 with a valid RFC 9116 document: Contact mailto:security@gzw-data.dev, Expires
    2027-08-27, Preferred-Languages fi/en, Canonical self-reference. Required fields Contact and
    Expires are both present and the Expires date is in the future. No Policy: field, so the
    SECURITY.md policy is not reachable from the document itself. Saved verbatim to
    well-known/gzw-data-security.txt.
- id: rfc8594
  conforms: false
  evidence: No Deprecation or Sunset header returned on the legacy /api prefix; no deprecation policy published.
- id: json-schema-2020-12
  conforms: partial
  evidence: >-
    The provider does not publish JSON Schema documents. The OpenAPI 3.0.3 components.schemas are
    OAS 3.0 Schema Objects (a JSON Schema draft-04 dialect subset), and GET /api/v1/schema/{dataset}
    returns a generated FIELD-METADATA document, not a schema document. API Evangelist derived
    2020-12 documents from components.schemas into json-schema/ — that is our derivation, not a
    provider conformance claim.
- id: rfc8288
  conforms: false
  evidence: No Link header returned on paginated responses; pagination is body-only.
- id: cors
  conforms: true
  evidence: 'Access-Control-Allow-Origin: * observed on every API response.'
- id: hsts
  conforms: true
  evidence: 'strict-transport-security: max-age=63072000 observed; TLSv1.3. See security/gzw-data-domain-security.yml.'
- id: dnssec
  conforms: true
  evidence: DNSSEC signed for gzw-data.dev (probe-domain-security.py, 2026-08-26).
- id: robots_txt
  conforms: true
  evidence: 'https://gzw-data.dev/robots.txt returns 200 and declares the sitemap. Note: Disallow: /api/.'
- id: llms_txt
  conforms: true
  evidence: https://gzw-data.dev/llms.txt returns 200 with a real llms.txt-format document (2,292 bytes).
- id: api_catalog
  conforms: false
  evidence: /.well-known/api-catalog returned 404.
domain_standard:
  applicable: false
  market: gaming / game reference data
  note: >-
    No domain standard exists for community game-data APIs — no schema URN, message type,
    or interchange format applies. Recorded as not-applicable rather than as a failure.
compliance_certifications: []
compliance_note: >-
  None published, and none expected: this is an unincorporated fan project with no accounts, no
  payment processing and no personal data collection. The Privacy Policy states no accounts, no
  tracking cookies, no analytics, and that the requesting IP is used only for rate limiting.