generated: '2026-08-17'
method: searched
source: >-
  https://www.koyeb.com/pricing (compliance claims) + https://trust.koyeb.com/ +
  https://www.koyeb.com/docs/legal/data-processing-agreement + live header probes of
  https://app.koyeb.com/v1/* on 2026-08-17 + derived from openapi/_original/koyeb-openapi.json
provider: Koyeb
providerId: koyeb
description: >-
  Which cross-cutting API and security standards the Koyeb platform conforms to, each with the evidence it
  was judged on. Koyeb's contract is a grpc-gateway projection of protobuf services, which is what shapes
  most of the results below: it is genuinely standards-based on the protobuf/gRPC side (FieldMask,
  google.rpc.Status) and deliberately plain on the HTTP-semantics side (no RFC 9457, no OAuth, no
  conditional requests, no idempotency).
standards:
  - id: openapi-3
    conforms: false
    evidence: >-
      The published contract is Swagger 2.0, not OpenAPI 3.x — https://api.prod.koyeb.com/public.swagger.json
      declares "swagger": "2.0". Generated by grpc-gateway, which still emits Swagger 2.0.
  - id: swagger-2.0
    conforms: true
    evidence: 'swagger: "2.0" with 126 paths, 177 operations and 422 definitions; every operation is tagged and has a unique operationId.'
  - id: grpc-gateway-rest-transcoding
    conforms: true
    evidence: >-
      google.rpc.Status as the catch-all "default" response on all 177 operations, google.protobuf.Any in
      details[], update_mask query parameters, and the generator toolchain named in the Makefile of
      koyeb-api-client-go (koyeb/swagger-build).
  - id: protobuf-fieldmask
    conforms: true
    evidence: >-
      update_mask query parameter on 17 PATCH operations, implementing google.protobuf.FieldMask partial
      updates. Shipped 2026-01-23 per the changelog.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors are application/json with the vendor envelope {status, code, message} (+ fields[] on 400), not
      application/problem+json. No type URIs. See errors/koyeb-problem-types.yml.
  - id: rfc6750-bearer-token
    conforms: partial
    evidence: >-
      Live requests authenticate with "Authorization: Bearer <token>" and unauthenticated calls return 401,
      but no WWW-Authenticate challenge header is returned, which RFC 6750 requires on a 401. Probed
      2026-08-17 against GET /v1/apps.
  - id: oauth2
    conforms: false
    evidence: >-
      No oauth2 securityScheme in the spec; /.well-known/oauth-authorization-server and
      /.well-known/oauth-protected-resource 404 on every host. Koyeb consumes GitHub/Google OAuth for human
      login to the control panel but exposes no OAuth authorization server to third-party apps and issues no
      scoped tokens.
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returns 404 on www.koyeb.com and api.prod.koyeb.com (and the SPA shell on app.koyeb.com).
  - id: saml-sso
    conforms: true
    scope: platform, not API
    evidence: >-
      "SSO, RBAC, and Audit trail" listed on the Enterprise tier (https://www.koyeb.com/pricing); the spec
      carries an sso tag with CannyAuth and DiscourseAuth operations for downstream SSO handoff.
  - id: ietf-ratelimit-headers
    conforms: partial
    evidence: >-
      Probed 2026-08-17: every response carries x-ratelimit-limit "400, 400;w=60", x-ratelimit-remaining and
      x-ratelimit-reset. The "400;w=60" quota-policy syntax comes from
      draft-ietf-httpapi-ratelimit-headers, but it is folded into the legacy x-ratelimit-limit name instead
      of the standard RateLimit / RateLimit-Policy fields, and no Retry-After is sent.
  - id: http-idempotency-key
    conforms: false
    evidence: >-
      Zero occurrences of "idempot" in the published 600 KB Swagger document and no idempotency
      documentation anywhere in the developer docs.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: >-
      No Sunset or Deprecation header support and no deprecation policy page; no operation in the spec is
      marked deprecated.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on www.koyeb.com, koyeb.com and api.prod.koyeb.com (SPA shell on app.koyeb.com).
  - id: rfc9727-api-catalog
    conforms: false
    evidence: /.well-known/api-catalog returns 404 on every host.
  - id: json-api
    conforms: false
    evidence: >-
      Collections are returned under resource-named keys (apps[], services[]) with limit/offset/count/has_next
      siblings, not a JSON:API data/links/meta envelope.
  - id: asyncapi
    conforms: false
    evidence: >-
      No AsyncAPI document published. The event model is poll-only (seven *_events collections) plus
      WebSocket upgrades for exec/log-tail/metrics, and there are no outbound webhooks.
  - id: hsts
    conforms: true
    evidence: 'Probed 2026-08-17 on app.koyeb.com: strict-transport-security: max-age=31536000; includeSubDomains. See security/koyeb-domain-security.yml.'
  - id: mcp
    conforms: true
    version: 2026-x (via @modelcontextprotocol/sdk ^1.27.1)
    evidence: 'First-party MCP server @koyeb/mcp-server 1.0.9, stdio transport, 15 tools. See mcp/koyeb-mcp.yml.'
  - id: agent-skills
    conforms: true
    evidence: >-
      Sixteen first-party skills in the Agent Skills open format, MIT licensed, at
      github.com/koyeb/koyeb-skills, referencing https://agentskills.io/specification. Saved verbatim in
      skills/.
  - id: a2a
    conforms: false
    evidence: >-
      No agent card at /.well-known/agent-card.json or /.well-known/agent.json on any Koyeb host (probed
      2026-08-17; app.koyeb.com returns an HTML SPA shell, which is not a card).
  - id: llms-txt
    conforms: false
    evidence: >-
      /llms.txt returns 404 on www.koyeb.com and the docs host, and the 200 at app.koyeb.com/llms.txt is the
      Control Panel HTML shell, not a document. The llms.txt in llms/ is API-Evangelist-generated, not
      provider-published.
  - id: opentelemetry
    conforms: partial
    evidence: >-
      Koyeb ships a log exporter (https://www.koyeb.com/docs/run-and-scale/log-exporter) and a metrics API
      (GetMetrics, /v1/streams/metrics), but publishes no OTLP endpoint contract for the platform API itself.
compliance_program:
  published: true
  trust_center: https://trust.koyeb.com/
  trust_center_platform: Vanta
  certifications_named:
    - {name: SOC 2, source: 'https://www.koyeb.com/pricing', quote: 'ISO27001 and SOC2 Certifications', tier: Enterprise}
    - {name: ISO 27001, source: 'https://www.koyeb.com/pricing', quote: 'ISO27001 and SOC2 Certifications', tier: Enterprise}
  gdpr:
    dpa_published: true
    dpa_url: https://www.koyeb.com/docs/legal/data-processing-agreement
  detail: security/koyeb-trust-center.yml
  caveat: >-
    The certifications are named on the pricing page as an Enterprise-tier entitlement and Koyeb operates a
    Vanta Trust Center, but the Trust Center itself is a client-rendered single-page app whose report list
    could not be read without a browser session, so the audit reports were not independently verified on
    this pass. Recorded as claimed-and-corroborated, not as inspected.
not_applicable:
  - {id: fhir, reason: Not healthcare}
  - {id: fapi, reason: Not open banking}
  - {id: psd2, reason: Not a payment service provider}
  - {id: scim, reason: No SCIM user-provisioning endpoint published; RBAC/SSO is Enterprise-tier and configured out of band}
  - {id: odata, reason: Not an OData service}
  - {id: pci-dss, reason: Card data is handled by the payment processor behind the PaymentMethods operations, not by Koyeb's own API contract}
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com