generated: '2026-08-06'
method: derived
source: >-
  openapi/hey-api-platform-openapi.json, https://heyapi.dev/robots.txt,
  https://heyapi.dev/llms.txt, https://heyapi.dev/docs/openapi/typescript/license
api: Hey API Platform API
note: >-
  Standards assertions derived from the harvested contract and the live
  surface. `conforms: false` is recorded data, not a gap we filled in. No
  Compliance pointer is wired: Hey API publishes no certification program
  (no SOC 2 / ISO 27001 / trust center was found — see
  security/hey-api-domain-security.yml and the probe result below).

standards:
  - id: openapi-3.1
    conforms: true
    evidence: >-
      The platform publishes its own contract as OpenAPI 3.1.1 at
      https://api.heyapi.dev/v1/get/hey-api/backend (38 operations, 12
      component schemas). The codegen additionally accepts OpenAPI 2.0, 3.0.x
      and 3.1.x inputs (see the specs/ fixture tree in hey-api/hey-api).
  - id: json-schema
    conforms: true
    evidence: >-
      Component schemas use JSON Schema 2020-12 idioms carried by OpenAPI 3.1
      — union nullability (["string","null"]), exclusiveMinimum/
      exclusiveMaximum as numbers. @hey-api/json-schema-ref-parser and
      @hey-api/spec-types are first-party JSON Schema tooling.
  - id: http-bearer-rfc6750
    conforms: true
    evidence: 'securitySchemes ApiKey and Clerk are both type: http, scheme: bearer'
  - id: jwt-rfc7519
    conforms: true
    evidence: 'Clerk securityScheme declares bearerFormat: JWT'
  - id: oauth2
    conforms: false
    evidence: >-
      No oauth2 securityScheme anywhere in the spec;
      /.well-known/oauth-authorization-server returns 404 on every host.
  - id: openid-connect
    conforms: false
    evidence: >-
      /.well-known/openid-configuration returns 404 on heyapi.dev and
      api.heyapi.dev. Console identity is delegated to Clerk, but Hey API
      exposes no OIDC discovery document of its own.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use a proprietary { error: { message, request_id, status,
      timestamp } } envelope with content-type application/json, not
      application/problem+json.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on every host.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No Sunset or Deprecation header support and no deprecated operations.
  - id: rfc8615-well-known
    conforms: false
    evidence: No /.well-known/ document is served on any Hey API host.
  - id: cursor-pagination
    conforms: true
    evidence: >-
      Uniform after/before/limit query parameters and a CursorResponse
      envelope (start_cursor, end_cursor, has_next_page, has_previous_page)
      across all 8 collection endpoints.
  - id: idempotency
    conforms: false
    evidence: >-
      No Idempotency-Key parameter, header or body field on any of the 38
      operations. See conventions/hey-api-conventions.yml.
  - id: rate-limit-headers
    conforms: false
    evidence: No RateLimit-* or X-RateLimit-* headers and no 429 in the contract.
  - id: rfc3339-timestamps
    conforms: true
    evidence: 'Every created_at / updated_at is format: date-time.'
  - id: rfc4122-uuid
    conforms: true
    evidence: 'Every record identifier is format: uuid.'
  - id: json-api
    conforms: false
    evidence: Responses are plain JSON objects, not a JSON:API document structure.
  - id: graphql
    conforms: false
    evidence: 'https://api.heyapi.dev/graphql returns 404.'
  - id: mcp
    conforms: false
    evidence: >-
      https://api.heyapi.dev/mcp returns 404 and no hosted MCP server is
      published. `mcp` appears in the WaitlistFeature enum, i.e. it is a
      queued platform feature, not a shipped one.
  - id: a2a-agent-card
    conforms: false
    evidence: >-
      /.well-known/agent-card.json and /.well-known/agent.json return 404 on
      heyapi.dev and api.heyapi.dev. app.heyapi.dev answers 200 for every path
      (SPA catch-all) with an HTML body — rejected, not a card.
  - id: llms-txt
    conforms: true
    evidence: >-
      https://heyapi.dev/llms.txt returns 200 with a conforming document (H1,
      blockquote summary, link sections), plus llms-small.txt and
      llms-full.txt. Generated by Hey API's own @hey-api/starlight-llms-txt.
  - id: content-signals
    conforms: true
    evidence: >-
      robots.txt carries "Content-Signal: ai-train=yes, search=yes,
      ai-input=yes" — an explicit, machine-readable AI-usage consent
      declaration.
  - id: semver
    conforms: true
    evidence: >-
      All packages are semver; the docs state initial-development (0.x) status
      and instruct exact pinning.
  - id: spdx-mit
    conforms: true
    evidence: Every first-party npm package declares license MIT.

compliance_program:
  published: false
  probed:
    - {url: 'https://heyapi.dev/.well-known/security.txt', status: 404}
    - {url: 'https://trust.heyapi.dev/', status: probe-miss}
  note: >-
    probe-security-programs.py returned vdp=none trust=none for this provider
    on 2026-08-06. No Compliance and no Security pointer is wired, because
    there is nothing published to point at.

x-evidence:
  fetched: '2026-08-06'
  spec_url: https://api.heyapi.dev/v1/get/hey-api/backend
  spec_http_status: 200
  robots_url: https://heyapi.dev/robots.txt
  robots_http_status: 200
  llms_url: https://heyapi.dev/llms.txt
  llms_http_status: 200