generated: '2026-07-19'
method: derived
source: openapi/lanzatech-wordpress-openapi.yml + live probes of https://lanzatech.com/wp-json/wp/v2/*
note: Derived from the observed behaviour of the API. LanzaTech makes no compliance or conformance
  claims about this interface anywhere on its site, and the security-programs probe found no trust
  center and no certifications. No Compliance pointer is emitted in apis.yml.

standards:
- id: rest
  conforms: true
  evidence: Resource-oriented paths, standard HTTP verbs, JSON representations, and a hypermedia _links
    block on every item.

- id: json
  conforms: true
  evidence: All responses are application/json; charset=UTF-8.

- id: rfc8288-web-linking
  conforms: true
  evidence: Collection responses carry a Link header with rel="next" and rel="prev". Observed on
    GET /wp/v2/posts?per_page=2.

- id: rfc7617-http-basic
  conforms: true
  evidence: Write operations authenticate with WordPress application passwords sent as HTTP Basic
    credentials, advertised in the /wp-json/ root document.

- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use the WordPress envelope {code, message, data.status} with content type
    application/json, not application/problem+json.

- id: oauth2
  conforms: false
  evidence: No oauth2 security scheme in the route schema and no OAuth documentation.

- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returned 404.

- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returned 404.

- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation headers observed on any response.

- id: pagination
  conforms: true
  evidence: Consistent page/per_page parameters across every collection, with X-WP-Total and
    X-WP-TotalPages response headers.

- id: idempotency
  conforms: false
  evidence: No idempotency key header or parameter in the route schema. See
    conventions/lanzatech-conventions.yml.

- id: openapi
  conforms: false
  evidence: The provider publishes no OpenAPI. It publishes a WordPress route-schema discovery document
    at /wp-json/, from which openapi/lanzatech-wordpress-openapi.yml was derived by API Evangelist.

- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is exposed or documented. The site publishes RSS
    feeds, which are polled documents rather than an event contract.

- id: cors
  conforms: true
  evidence: Access-Control-Expose-Headers and Access-Control-Allow-Headers are set on responses,
    exposing X-WP-Total, X-WP-TotalPages and Link to browser clients.

compliance_program:
  published: false
  certifications: []
  trust_center: null
  evidence: probe-security-programs.py returned vdp=none trust=none. trust.lanzatech.com does not
    resolve and lanzatech.com/security/ returns 404.