generated: '2026-07-19'
method: derived
source: openapi/koko-crisis-helplines-openapi.yml
notes: >-
  Derived from the published OpenAPI and the Koko developer documentation. Koko is a
  501(c)(3) nonprofit publishing a public read-only data API; it publishes no security
  or privacy certification program, so no Compliance pointer is emitted.
standards:
  - id: openapi-3.0
    conforms: true
    evidence: Published definitions declare openapi 3.0.3.
  - id: iso-3166-1-alpha-2
    conforms: true
    evidence: 'Country.countryCode is documented as ISO 3166-1 alpha-2 with pattern ^[A-Z]{2}$.'
  - id: bcp47-locale-keys
    conforms: partial
    evidence: >-
      countryI18nKey carries a locale code ("en-US") in the Helpline schema but a full
      country name ("United States") in the Country schema — the same field name is used
      for two different value spaces across the two operations.
  - id: cors
    conforms: true
    evidence: 'Responses declare Access-Control-Allow-Origin and Vary: Origin headers; origin allowlist enforced.'
  - id: rfc9457-problem-details
    conforms: false
    evidence: 'Errors use a flat {"error": string} object and text/plain, not application/problem+json.'
  - id: oauth2
    conforms: false
    evidence: 'No oauth2 securityScheme; OpenAPI declares security: [].'
  - id: oidc
    conforms: false
    evidence: No /.well-known/openid-configuration on any Koko host (probed 404/401).
  - id: rfc9116-security-txt
    conforms: false
    evidence: No /.well-known/security.txt on any Koko host (probed 2026-07-19).
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No deprecation or sunset policy published.
  - id: http-basic-auth
    conforms: true
    evidence: 'Keywords API answers 401 with WWW-Authenticate: Basic realm="Restricted Area".'
  - id: llms-txt
    conforms: true
    evidence: https://developers.kokocares.org/llms.txt returns 200 with a conforming index.
  - id: json-api
    conforms: false
    evidence: Responses are plain JSON arrays/objects, not JSON:API documents.
  - id: pagination
    conforms: false
    evidence: No pagination parameters or metadata in either operation.
  - id: idempotency
    conforms: false
    evidence: No write operations on the public API.
  - id: fhir-r4
    conforms: false
  - id: scim-2.0
    conforms: false
  - id: odata
    conforms: false