generated: '2026-09-03'
method: searched
source: >-
  Published OpenAPI (https://api.keploy.io/client/v1/openapi.yaml), the Public
  API reference (https://keploy.io/docs/running-keploy/public-api/), the live
  pricing page, and keploy.io/llms.txt. Supersedes the 2026-06-20 derived pass
  that predated the published OpenAPI.
standards:
- id: openapi-3.0
  conforms: true
  evidence: >-
    First-party OpenAPI 3.0.3 served at
    https://api.keploy.io/client/v1/openapi.yaml (55 paths, 71 operations, all
    with operationIds); saved to openapi/keploy-cloud-api-openapi.yaml.
- id: mcp-streamable-http
  conforms: true
  evidence: >-
    Hosted remote MCP server at https://api.keploy.io/client/v1/mcp answered
    an anonymous JSON-RPC tools/list with 7 tools (probed 2026-09-03).
- id: llmstxt
  conforms: true
  evidence: >-
    https://keploy.io/llms.txt and https://keploy.io/llms-full.txt both return
    200 (llms.txt last-updated 2026-08-14).
- id: bearer-token-auth
  conforms: true
  evidence: >-
    kep_-prefixed scoped PAT accepted as Authorization Bearer or X-API-Key on
    the REST API and as bearer on the MCP server.
- id: oauth2
  conforms: false
  evidence: >-
    Securityschemes declare only apiKey; no OAuth2 flows. The MCP host serves
    no /.well-known/oauth-authorization-server or oauth-protected-resource
    (both 404, probed 2026-09-03).
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on both hosts.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a documented proprietary envelope ({error: {code, message,
    details[]}, meta: {request_id, timestamp}}), not application/problem+json.
    See errors/keploy-problem-types.yml.
- id: pagination
  conforms: true
  evidence: >-
    Documented cursor pagination (page_size/after with
    pagination.has_next_page/next_cursor/total_count) plus offset/limit (max
    100, default 20) per https://keploy.io/docs/running-keploy/public-api/.
- id: rate-limit-headers
  conforms: true
  evidence: >-
    X-RateLimit-Limit/-Remaining/-Reset on every response and Retry-After on
    429 (100 req/min per key, burst 100); every operation declares a 429.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key header or retry-safety semantics documented.
- id: scim
  conforms: false
- id: odata
  conforms: false
- id: fapi
  conforms: false
- id: fhir-r4
  conforms: false
compliance_claims:
- id: soc2
  claimed: true
  evidence: >-
    keploy.io/llms.txt lists "Compliance: SOC 2, GDPR, ISO 27001, HIPAA"; the
    pricing page lists "SOC2 / GDPR / HIPAA compliance" under Enterprise. No
    public trust center or certification portal was found (probed 2026-09-03),
    so these are provider claims without a published evidence portal.
- id: gdpr
  claimed: true
  evidence: keploy.io/llms.txt and https://keploy.io/pricing (Enterprise tier).
- id: iso-27001
  claimed: true
  evidence: keploy.io/llms.txt.
- id: hipaa
  claimed: true
  evidence: keploy.io/llms.txt and https://keploy.io/pricing (Enterprise tier).
domain_standard: >-
  No sector-specific interchange standard applies to the API-testing market;
  none asserted (reward-only check). The contract itself is plain OpenAPI
  3.0.3, and Keploy additionally consumes/produces OpenAPI 3.0.3 documents as
  payloads (generated-schema endpoints).