generated: '2026-08-04'
method: derived
source: openapi/hubble-network-platform-openapi.yml + https://hubble.com/docs/api-specification/hubble-platform-api
standards:
- id: openapi-3.0
  conforms: true
  evidence: 'Public OpenAPI document at https://hubble.com/docs/openapi.yaml using OpenAPI 3.0 constructs
    (components, securitySchemes, nullable). Deviation: the root `openapi` version key is omitted from
    the published file.'
- id: rest
  conforms: true
  evidence: 'info.description: "We have designed our API following RESTful principles"; resource-oriented
    paths with standard verbs.'
- id: http-bearer-rfc6750
  conforms: true
  evidence: components.securitySchemes.BearerAuth type http scheme bearer bearerFormat JWT
- id: oauth2
  conforms: false
  evidence: No oauth2 security scheme in the OpenAPI and no OAuth flow documented; authorization is a
    scoped organization API key.
- id: openid-connect
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every host.
- id: rfc9457-problem-details
  conforms: false
  evidence: 'Errors use a custom envelope (components.schemas.errorResponse: code/description/name) served
    as application/json, not application/problem+json.'
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on hubble.com, api.hubble.com, dash.hubble.com and network.hubble.com.
- id: rfc9727-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returns 404 on every host.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header documented; deprecation is handled by minting a new URL version
    and a minimum one-year alias window.
- id: uri-path-versioning
  conforms: true
  evidence: Major versions in the path (/v1/..., /v2/...); legacy /api/... and /api/v2/... retained as
    aliases.
- id: cursor-pagination
  conforms: true
  evidence: Continuation-Token response/request header carries the cursor; up to 1,000 packets per page.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key header or parameter in the OpenAPI or docs. Webhook DELIVERY is at-least-once
    and consumers are told to make handlers idempotent, but the request API itself has no idempotency
    contract.
- id: request-id-tracing
  conforms: true
  evidence: X-Request-ID echoed on every response and accepted on every request for tracing.
- id: rate-limiting
  conforms: true
  evidence: Leaky-bucket rate limiting, 3 req/s per endpoint and 15 req/s per organization, 429 on exceed.
- id: a2a-agent-card
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json return 404 on every host.
- id: llms-txt
  conforms: true
  evidence: https://hubble.com/docs/llms.txt returns 200 with a sectioned index plus per-section plain-text
    full-content files.
- id: bluetooth-le-5.0
  conforms: true
  evidence: Device SDK targets any BLE 5.0+ compliant silicon; Hubble is a registered Bluetooth SIG member
    per chip-compatibility docs.
compliance_program:
  published: false
  note: No SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP or CSA STAR claim is published on hubble.com, in
    the docs, or on any trust/compliance page. https://hubble.com/trust, https://hubble.com/security and
    https://trust.hubble.com do not resolve. Search hits for "Hubble SOC 2" belong to unrelated companies
    (hubble.team, usehubble.io, hubble.build) and were NOT credited here. No `Compliance` pointer is emitted.