generated: '2026-08-23' method: derived source: graphql/ink-games-cms-schema.graphql + probes of every INK Games host, 2026-08-23 description: >- Cross-cutting and domain-standard conformance assertions for INK Games. Every entry records what was actually checked. Absence is the dominant result and is recorded as such — INK Games publishes no compliance program, no certifications page and no standards claims of any kind. standards: - id: graphql name: GraphQL (June 2018 / October 2021 spec) conforms: true method: probed evidence: >- https://webadm.inkgames.com/graphql answers the spec-defined __schema introspection query with a conformant result (HTTP 200), returns the spec `errors[]` envelope with `message`, `path` and `extensions`, and exposes Query and Mutation root types. 165 types, 29 query fields, 37 mutation fields. - id: graphql-introspection name: GraphQL introspection enabled conforms: true method: probed evidence: 'POST {"query":"{__schema{queryType{name}}}"} -> HTTP 200 with a full schema response.' note: >- Positive for discoverability — the contract is machine-readable without credentials. Many production deployments disable this. - id: relay-connections name: Relay Cursor Connections Specification conforms: false method: derived evidence: >- The `*_connection` fields return { nodes, pageInfo } where pageInfo is { total, page, pageSize, pageCount }. There are no edges, no cursor, no endCursor and no hasNextPage, so this is Strapi offset pagination named after the connection pattern, not the Relay specification. - id: rfc9457 name: RFC 9457 Problem Details for HTTP APIs conforms: false method: probed evidence: >- No surface returns application/problem+json. Three proprietary envelopes were observed instead (GraphQL errors[], Strapi {data,error}, AWS {message}). - id: rfc8594 name: RFC 8594 Sunset HTTP Header conforms: false method: probed evidence: No Sunset or Deprecation header on any observed response; no deprecation policy published. - id: rfc6749-oauth2 name: OAuth 2.0 conforms: false method: probed evidence: >- No /.well-known/oauth-authorization-server on any host, no documented authorization or token endpoint, no scopes. - id: openid-connect name: OpenID Connect Discovery 1.0 conforms: false method: probed evidence: /.well-known/openid-configuration absent on every host (404 or SPA soft-404). - id: rfc9116 name: RFC 9116 security.txt conforms: false method: probed evidence: >- /.well-known/security.txt returns the SPA shell on www.inkgames.com (soft-404), 404 on webadm.inkgames.com and 403 on ip-api.inkgames.com. - id: openapi name: OpenAPI Specification conforms: false method: probed evidence: >- No OpenAPI or Swagger document at any of /openapi.json, /openapi.yaml, /swagger.json, /v1/openapi.json, /api-docs, /docs, /redoc, /swagger, /swagger-ui.html on www.inkgames.com, webadm.inkgames.com, ip-api.inkgames.com or inkpayapp.com. Strapi's documentation plugin (/documentation/v1.0.0/full_documentation.json) is not installed — 404. - id: asyncapi name: AsyncAPI conforms: false method: probed evidence: No event, streaming or webhook surface is published or documented. N/A for this provider. - id: mcp name: Model Context Protocol conforms: false method: probed evidence: No MCP endpoint on any host; tools/list POST returns the SPA shell or an API Gateway 403. - id: a2a name: A2A Agent Card conforms: false method: probed evidence: >- /.well-known/agent-card.json and /.well-known/agent.json probed on every host. www.inkgames.com returns the byte-identical SPA shell (soft-404), webadm.inkgames.com returns a JSON 404, ip-api.inkgames.com returns 403. No AgentCard-shaped JSON object anywhere. No artifact written. - id: llmstxt name: llms.txt conforms: false method: probed evidence: /llms.txt on www.inkgames.com returns the SPA shell (soft-404), not a text document. - id: idempotency name: HTTP idempotency keys conforms: false method: derived evidence: No idempotency key mechanism in the schema or on any observed response. - id: pagination name: Documented pagination conforms: true method: derived evidence: >- Structurally present and typed in the schema (PaginationArg input, Pagination output), though not documented in prose anywhere by the provider. domain_standards: checked: true market: mobile gaming / consumer rewards + payouts result: none-declared note: >- REWARD-ONLY check, and INK Games earns nothing here — which is not a penalty. The published contract is a website content model; it declares no domain standard of any market. Specifically probed for and NOT found: no SCIM schema URN, no OData $metadata surface, no OpenRTB bid endpoint, no ActivityPub actor, no OAI-PMH verb, no ISO-20022/X12/EDIFACT/HL7 message type, no LTI/OneRoster shape. The gaming and payouts domain vocabularies a company of this shape could plausibly declare (IAB/OpenRTB for ad monetization, ISO 20022 for payout rails) appear nowhere in the schema or on any public page. candidates_probed: - { standard: OpenRTB, found: false, where: 'graphql schema, all hosts' } - { standard: 'ISO 20022', found: false, where: 'graphql schema, all hosts' } - { standard: SCIM, found: false, where: 'graphql schema (usersPermissions* types are Strapi-native, not SCIM)' } - { standard: OData, found: false, where: 'all hosts, no $metadata' } compliance_program: published: false method: probed evidence: >- No trust center, no certifications page, no SOC 2 / ISO 27001 / PCI DSS / HIPAA / FedRAMP claim anywhere on www.inkgames.com. The site's only legal documents are /privacy and /terms-and-conditions. No Compliance pointer is emitted. summary: asserted: 17 conforming: 3 domain_standard_declared: false