generated: '2026-08-23' method: searched source: >- https://vle.kortext.com/assets/config.json (Kortext's own published front-end runtime configuration), https://lti.dev.kortext.com/jwks, live HTTP probes of vle.kortext.com and app.kortext.com, openapi/kortext-labs-api-openapi.json, and Kortext's own support articles index (uk.support.kortext.com / kortext.my.site.com), 2026-08-23. note: >- Kortext publishes no compliance or certifications page and no trust center; trust.kortext.com and status.kortext.com do not resolve. Every entry below is evidenced from a contract, a live endpoint, or a Kortext-authored page — nothing is asserted from marketing prose. No `Compliance` pointer is emitted, because Kortext publishes no named certification (no SOC 2, ISO 27001, Cyber Essentials or FedRAMP claim was found on any Kortext-controlled page). standards: - id: lti name: 1EdTech Learning Tools Interoperability conforms: true versions: - '1.1' - '1.3' evidence: contract: https://vle.kortext.com/assets/config.json declared_endpoints: lti_1_1_launch: https://vle.kortext.com/api/v1/lti/v1.1/launch lti_1_1_keylinks_launch: https://vle.kortext.com/api/v1/lti/v1.1/launch/keylinks lti_1_3_deep_link_request: https://vle.kortext.com/api/v1/lti/v1.3/deep-link-request probe: - url: https://vle.kortext.com/api/v1/lti/v1.1/launch status: 405 meaning: Endpoint exists and rejects GET — an LTI launch is a POST. - url: https://vle.kortext.com/api/v1/lti/v1.3/deep-link-request status: 405 meaning: Endpoint exists and rejects GET. - url: https://lti.dev.kortext.com/jwks status: 200 content_type: application/json body: '{"keys":[]}' meaning: >- A JWKS keyset endpoint — the RFC 7517 surface LTI 1.3 tools must serve for message signing — is deployed on Kortext''s LTI host. The dev-environment keyset is empty; the production keyset is not served on a discoverable path. docs: - https://uk.support.kortext.com/s/article/How-to-link-Moodle-to-Kortext-using-LTI-1-3 - https://kortext.my.site.com/support/s/article/How-to-link-Blackboard-to-Kortext-using-LTI-1-3 - https://kortext.my.site.com/support/s/article/How-to-link-Blackboard-to-Kortext-using-LTI-1-1 domain_standard: true regime: education note: >- This is the domain-standard signature for Kortext's market. An institution that already speaks LTI can place Kortext content inside Blackboard, Moodle or Canvas with no bespoke connector. The LTI 1.3 surface present is Deep Linking; no Names and Role Provisioning Services (NRPS) or Assignment and Grade Services (AGS) endpoint is declared in the published configuration, so full LTI Advantage cannot be claimed from the evidence available. certification_status: unconfirmed certification_note: >- The 1EdTech certified-product directory at site.imsglobal.org/certifications is a JavaScript/InstantSearch application that returns no server-rendered results, so Kortext's certification status could not be confirmed or denied by probe. - id: oauth2 name: OAuth 2.0 conforms: false evidence: >- The only securityScheme in the published contract is HTTPBearer (http/bearer, JWT). No oauth2 flows are declared, no authorization or token metadata document is served, and /.well-known/oauth-authorization-server 404s on the API host and soft-404s on the marketing host. Kortext issues bearer tokens from https://app.kortext.com/account/token (401 unauthenticated) but publishes no grant description. - id: oidc name: OpenID Connect conforms: partial evidence: >- LTI 1.3 is built on an OIDC third-party-initiated login, so an OIDC login flow is necessarily implemented behind the LTI 1.1/1.3 endpoints above. However no /.well-known/openid-configuration discovery document is served on any Kortext host (kortext.com 301s to the marketing homepage; vle/read.kortext.com return the Angular shell; api-demo.labs.kortext.com returns 404), so the OIDC surface is not independently discoverable. - id: rfc9457 name: RFC 9457 Problem Details for HTTP APIs conforms: false evidence: >- Zero operations in openapi/kortext-labs-api-openapi.json declare application/problem+json. The error shape is the FastAPI default {"detail": ...}. - id: pagination name: Documented pagination conforms: partial evidence: >- 1 of 67 operations (GET /podcast/v1/podcasts) declares page/pageSize and returns PaginatedPodcastResponse with total and totalPages. Every other collection read is unbounded. - id: idempotency name: Idempotent write requests conforms: false evidence: >- No header parameters of any kind are declared across the contract's 67 operations, and no Idempotency-Key equivalent is documented; 27 unsafe operations offer no request key. - id: openapi name: OpenAPI conforms: true version: 3.1.0 evidence: >- openapi/kortext-labs-api-openapi.json, served unauthenticated at https://api-demo.labs.kortext.com/openapi.json (HTTP 200, 84,874 bytes) with a Swagger UI at /docs and ReDoc at /redoc. Auto-generated by FastAPI, so operationIds are framework-mangled and no servers[] block, info.contact, info.license or info.termsOfService is present. - id: scim name: SCIM 2.0 conforms: false evidence: >- No urn:ietf:params:scim:schemas:* URN appears in any Kortext contract and no /scim/v2 path responds. Kortext provisions institutional users through LTI launch and institutional SSO rather than SCIM. - id: caliper name: 1EdTech Caliper Analytics conforms: unknown evidence: >- Kortext markets an analytics product (Kortext insights) and its runtime configuration exposes an /api/events/v1 path, which is the shape a Caliper sensor would use — but the events surface is authenticated (400/401 unauthenticated) and no Caliper profile, IMS Caliper context URI or event schema is published. Recorded as unknown rather than claimed. - id: oneroster name: 1EdTech OneRoster conforms: false evidence: >- No /ims/oneroster/ path responds on any Kortext host. Kortext is a higher-education content platform; OneRoster is predominantly a K-12 rostering standard. - id: oai-pmh name: OAI-PMH conforms: false evidence: >- No ?verb=Identify surface responds. Kortext is a licensed-content delivery platform, not an institutional repository. - id: wcag name: WCAG / accessibility conformance conforms: claimed evidence: >- Kortext publishes an accessibility commitment statement at https://kortext.com/us/accessibility-commitment-statement/ (HTTP 200) and its April 2026 platform update is titled "Greater visibility of accessibility features". This is a published commitment, not a VPAT or a conformance report, and it is an application-level claim rather than an API one. gaps: - No trust center, certifications page, or named security certification published anywhere. - No status page (status.kortext.com does not resolve). - No OIDC or OAuth discovery document on any host. - LTI Advantage NRPS and AGS services are not declared in the published configuration. - No Caliper or xAPI event profile published for the analytics products.