generated: '2026-08-22'
method: derived
source: openapi/ + live responses from https://hydrostor.ca/wp-json/ + hydrostor.ca site pages
description: >-
  Cross-cutting and domain standard conformance for the WordPress REST content API behind hydrostor.ca.
  Hydrostor publishes no conformance claim of any kind for this surface, so every entry below is derived
  from what the contract and the live responses actually do. Negative entries are recorded deliberately:
  an unasserted standard is a real finding for a buyer deciding whether they need a bespoke connector.
standards:
- id: rest
  conforms: true
  evidence: Resource-oriented paths, HTTP verbs, JSON representations, HAL-style _links with targetHints.allow on every record.
- id: oembed-1.0
  conforms: true
  evidence: >-
    /oembed/1.0/embed returns a spec-shaped oEmbed 1.0 `rich` response (version, provider_name, provider_url,
    author_name, author_url, title, type, width, height, html). Verified live 2026-08-22 against
    https://hydrostor.ca/technology/.
- id: schema-org-json-ld
  conforms: true
  evidence: >-
    /yoast/v1/get_head returns the rendered head plus a parsed schema.org @graph for any hydrostor.ca URL.
    Served by Yoast SEO Premium 28.2.
- id: rfc8288-web-linking
  conforms: true
  evidence: 'Collection responses return a Link header with rel="next" (observed on /wp/v2/posts?per_page=1).'
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors are application/json in the WordPress envelope {code, message, data.status}, not
    application/problem+json, and carry no type URI. Observed on 400/401/404.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme; the only scheme advertised by the root document is HTTP Basic application passwords.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 (HTML) on hydrostor.ca.
- id: json-schema
  conforms: true
  evidence: >-
    Every route publishes a JSON Schema for its resource via HTTP OPTIONS (`schema` key), and the root
    index publishes argument schemas per endpoint. This is what made a derived OpenAPI possible without a
    single line of documentation.
- id: json-api
  conforms: false
  evidence: No application/vnd.api+json, no data/attributes envelope.
- id: pagination
  conforms: true
  evidence: page/per_page/offset with X-WP-Total and X-WP-TotalPages exposed via Access-Control-Expose-Headers.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key contract. Public surface is GET-only, which is idempotent by method, not by agreement.
- id: cors
  conforms: true
  evidence: access-control-allow-headers and access-control-expose-headers returned; Vary includes Origin.
domain_standards:
  regime: energy_utilities
  regime_basis: >-
    Hydrostor is an energy storage developer and operator, so the Kin Score energy_utilities regulatory
    regime applies. Its standards shortlist was probed against this contract and the company's public site.
  assessed:
  - id: green-button
    conforms: false
    evidence: No Green Button / ESPI usage-data surface. Hydrostor sells stored energy into wholesale markets and does not hold retail customer accounts, so it has no customer usage data to expose under Green Button.
  - id: espi
    conforms: false
    evidence: No ESPI resource shapes anywhere in the contract.
  - id: cds-energy
    conforms: false
    evidence: >-
      Australian Consumer Data Right energy applies to retailers on the AER register. Hydrostor operates
      generation/storage assets in the NEM (Silver City, NSW) rather than a retail book, so CDR energy is
      not a duty it carries. Recorded as not-conforming and not-applicable rather than as a gap.
  - id: smart-energy-code
    conforms: false
    evidence: GB Smart Energy Code / DCC applies to GB suppliers and network operators; Hydrostor has UK pipeline projects but no DCC-facing interface.
  - id: ieee-2030-5
    conforms: false
    evidence: No IEEE 2030.5 (SEP2) DER management endpoints. Any such interface would run on Hydrostor's SCADA/market-facing systems, not on its public website, and none is published.
  - id: openadr
    conforms: false
    evidence: No OpenADR VTN/VEN endpoint published.
  finding: >-
    Hydrostor declares no domain standard in any published contract. The honest read is that its market
    interfaces — IESO, CAISO and AEMO dispatch, and the SCADA layer of an operating A-CAES plant — are not
    internet-facing surfaces at all, so the absence here is a scope fact rather than a failing. The
    reward-only domain_standard_conformance check therefore scores nothing, and nothing was invented to
    fill it.
compliance_program:
  published: true
  detail: >-
    Hydrostor publishes a California AB1305 climate disclosure at https://hydrostor.ca/ab1305-disclosure/,
    a corporate regulatory disclosure required of entities operating in California. It is a corporate
    climate-disclosure statement, not a security or data-protection certification: no SOC 2, ISO 27001,
    PCI DSS, HIPAA or FedRAMP attestation is published anywhere on the site, and there is no trust center.
  evidence:
  - url: https://hydrostor.ca/ab1305-disclosure/
    http_status: 200
  - url: https://hydrostor.ca/privacy-policy/
    http_status: 200