generated: '2026-07-19'
method: derived
source: openapi/langai-api-openapi.yml
docs: https://docs.lang.ai/
standards:
  - id: rest
    conforms: true
    evidence: >-
      "The API is organized around REST. It has predictable, resource-oriented URLs, and
      uses HTTP response codes to indicate API errors. We use built-in HTTP features,
      like HTTP authentication and HTTP verbs."
  - id: http-bearer-auth
    conforms: true
    evidence: >-
      RFC 6750 style bearer token in the Authorization header on every request
      (securityScheme type http, scheme bearer).
  - id: oauth2
    conforms: false
    evidence: >-
      No OAuth 2.0 authorization server, flows or scopes are documented — authentication
      is a single static API token per instance.
  - id: oidc
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors are plain JSON with meaningful HTTP status codes; no
      application/problem+json media type or type URIs are published.
  - id: rfc2387-multipart-related
    conforms: true
    evidence: >-
      Project creation is explicitly specified as a multipart/related upload per RFC
      2387, with an application/json metadata part followed by a text/csv or text/plain
      media part.
  - id: iso8601-dates
    conforms: true
    evidence: >-
      The saveDocument "date" field "supports valid ISO 8601 dates"; project and tag
      createdAt/updatedAt are rendered as ISO 8601 timestamps.
  - id: json-api
    conforms: false
    evidence: Responses are bare JSON objects/arrays, not JSON:API documents.
  - id: pagination
    conforms: false
    evidence: >-
      listProjects returns an unpaginated JSON array; no cursor or offset parameters are
      documented.
  - id: idempotency
    conforms: partial
    evidence: >-
      No Idempotency-Key header, but saveDocument accepts a client-supplied document "id"
      and overwrites an existing document with the same id, giving idempotent (upsert)
      write semantics on that operation. See conventions/langai-conventions.yml.
  - id: rate-limiting
    conforms: partial
    evidence: >-
      Rate limiting is documented as enforced and surfaces as HTTP 429, but no numeric
      limits and no RateLimit/Retry-After response headers are published.
  - id: openapi
    conforms: false
    evidence: >-
      Lang.ai publishes no machine-readable OpenAPI/Swagger description. The spec in
      openapi/ was generated by the API Evangelist pipeline from the published reference.
  - id: asyncapi
    conforms: false
    evidence: >-
      No webhook, streaming or event surface is documented — the API is request/response
      only.
  - id: soc2
    conforms: true
    evidence: >-
      Post-acquisition, Capacity publishes "GDPR, HIPAA, SOC 2 Type II certified" at
      https://capacity.com/security/ and operates a trust center at
      https://trust.capacity.com/. This is the parent platform's compliance program, not
      a Lang.ai-specific attestation.
  - id: hipaa
    conforms: true
    evidence: 'Capacity states HIPAA compliance at https://capacity.com/security/.'
  - id: gdpr
    conforms: true
    evidence: 'Capacity states GDPR compliance at https://capacity.com/security/.'
  - id: pci-dss
    conforms: false
  - id: fedramp
    conforms: false
  - id: iso27001
    conforms: false
    evidence: Not named on the Capacity security page.