generated: '2026-08-12'
method: derived
source: >-
  openapi/interpublic-*-api-openapi.yml (derived from
  https://interpublic.com/wp-json/) plus live response observation 2026-08-12
note: >-
  Interpublic Group publishes no compliance or certification program on any
  public host - no trust center, no SOC 2 / ISO 27001 / PCI / HIPAA
  attestation page was found (probe-security-programs.py returned
  vdp=none trust=none). No `Compliance` pointer is emitted in apis.yml.
  Entries below assert only cross-cutting technical standards, each judged
  against the live surface.
standards:
  - id: openapi
    conforms: true
    evidence: >-
      Four OpenAPI 3.2.0 documents in openapi/, mechanically derived from the
      provider's own self-describing route-discovery document. The provider
      does not publish OpenAPI itself.
  - id: rest
    conforms: true
    evidence: 'Resource-oriented JSON over HTTP; standard verbs per route.'
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors return application/json with the WordPress {code,message,data}
      envelope, not application/problem+json.
  - id: rfc8288-web-linking
    conforms: true
    evidence: >-
      Link header with rel="next" observed on paginated collections
      2026-08-12.
  - id: pagination
    conforms: true
    evidence: >-
      page / per_page / offset query parameters plus X-WP-Total and
      X-WP-TotalPages response headers, observed live.
  - id: idempotency
    conforms: false
    evidence: 'No idempotency key or idempotent-write scheme exists.'
  - id: oauth2
    conforms: false
    evidence: >-
      No oauth2 securityScheme anywhere; /.well-known/oauth-authorization-server
      is not served (301 away from origin).
  - id: oidc
    conforms: false
    evidence: '/.well-known/openid-configuration is not served (301 away from origin).'
  - id: rfc9116-security-txt
    conforms: false
    evidence: 'https://interpublic.com/.well-known/security.txt returns HTTP 404.'
  - id: rfc8594-sunset-header
    conforms: false
    evidence: 'No Sunset or Deprecation header observed on any response.'
  - id: oembed
    conforms: true
    evidence: >-
      oembed/1.0 namespace present in the route-discovery document; GET
      /wp-json/oembed/1.0/embed observed HTTP 200 anonymously.
  - id: asyncapi
    conforms: false
    evidence: 'No event, streaming or webhook surface is published.'
  - id: mcp
    conforms: false
    evidence: >-
      No `mcp` namespace in the route-discovery document; /wp-json/mcp returns
      HTTP 404.
  - id: a2a
    conforms: false
    evidence: >-
      /.well-known/agent-card.json and /.well-known/agent.json miss on every
      host; the www host 301s to an HTML page on omc.com.