generated: '2026-08-13'
method: derived
source: openapi/*.yml + https://docs.leandata.com + https://trust.leandata.com/ + https://mcp.leandata.com/.well-known/
description: >-
  Which cross-cutting and industry standards the LeanData surface actually conforms to. The
  result is lopsided in an interesting way: the BookIt MCP server is the most standards-compliant
  thing LeanData ships — real MCP, real OAuth 2.1 with PKCE, real RFC 8414 and RFC 9728
  discovery metadata — while the REST APIs beside it declare no security scheme, no error
  standard and no pagination convention. Compliance certifications are separately real and
  independently audited (SOC 2 Type 2).
standards:
  - id: openapi-3.0
    conforms: true
    evidence: >-
      Nine refined OpenAPI 3.0.0 documents in openapi/, plus three harvested originals in
      openapi/_original/, all derived from LeanData's published Postman collection.
    note: >-
      LeanData itself publishes a Postman collection, not an OpenAPI. The OpenAPI in this repo is
      a conversion, not a provider-published contract.
  - id: postman-collection-v2
    conforms: true
    evidence: >-
      LeanData publishes a public Postman collection (schema
      https://schema.getpostman.com/json/collection/v2.0.0/collection.json, publishedId RztfwXJq)
      and hosts its developer documentation on the Postman documenter at docs.leandata.com.
  - id: mcp
    conforms: true
    evidence: >-
      Hosted remote MCP server at https://mcp.leandata.com/mcp, announced in the Q2 2026 release,
      with OAuth-gated tools/list and RFC 9728 protected-resource metadata.
  - id: oauth2
    conforms: true
    evidence: >-
      Two independent OAuth 2.0/2.1 implementations — Salesforce Connected App authorization-code
      + refresh flow for the Matching / Round Robin API, and the BookIt MCP authorization server
      at mcp.leandata.com.
  - id: rfc8414-oauth-authorization-server-metadata
    conforms: true
    evidence: 'https://mcp.leandata.com/.well-known/oauth-authorization-server returns HTTP 200 with issuer, authorization_endpoint, token_endpoint and registration_endpoint.'
  - id: rfc9728-oauth-protected-resource-metadata
    conforms: true
    evidence: 'https://mcp.leandata.com/.well-known/oauth-protected-resource returns HTTP 200 with resource, authorization_servers, scopes_supported and bearer_methods_supported.'
  - id: rfc7636-pkce
    conforms: true
    evidence: 'code_challenge_methods_supported: ["S256"] in the authorization-server metadata.'
  - id: rfc7591-dynamic-client-registration
    conforms: true
    evidence: 'registration_endpoint https://mcp.leandata.com/register advertised in the authorization-server metadata.'
  - id: rfc6750-bearer-token
    conforms: true
    evidence: >-
      HTTP 401 on the MCP endpoint carries
      WWW-Authenticate: Bearer resource_metadata="https://mcp.leandata.com/.well-known/oauth-protected-resource";
      bearer_methods_supported is ["header"].
  - id: oidc
    conforms: false
    evidence: '/.well-known/openid-configuration returns 404 on every LeanData host including mcp.leandata.com.'
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      No application/problem+json anywhere. The BookIt and Graph error envelope is a bare
      {"error": "<string>"}.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on www, api, docs and mcp hosts.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No Sunset or Deprecation header documented or observed; no deprecation policy published.
  - id: rfc9111-http-caching
    conforms: unknown
    evidence: No cache-control semantics documented for any operation.
  - id: llms-txt
    conforms: true
    evidence: 'https://www.leandata.com/llms.txt returns HTTP 200 text/plain in llms.txt format.'
  - id: a2a
    conforms: false
    evidence: >-
      /.well-known/agent-card.json and /.well-known/agent.json return 404 on all five LeanData
      hosts. No agent card published.
  - id: asyncapi
    conforms: false
    evidence: >-
      No AsyncAPI document and no server-to-server webhook surface. BookIt for Forms fires
      browser-side CustomEvents, which is a client-side integration surface, not an event API.
  - id: json-api
    conforms: false
    evidence: Plain JSON resource responses; no JSON:API document structure.
  - id: odata
    conforms: false
  - id: scim2
    conforms: false
  - id: fhir-r4
    conforms: false
  - id: fapi
    conforms: false
  - id: psd2
    conforms: false
  - id: idempotency-key
    conforms: false
    evidence: No idempotency header, key or deduplication window documented. See conventions/leandata-conventions.yml.
  - id: pagination
    conforms: false
    evidence: No limit/offset/cursor parameter on any list operation.
  - id: ratelimit-headers
    conforms: false
    evidence: >-
      One numeric limit published in prose (10,000 req/s per API key on the Routing API); no
      RateLimit-*, X-RateLimit-* or Retry-After response header.
  - id: soc2-type2
    conforms: true
    evidence: 'Published on https://trust.leandata.com/ with the SOC 2 report available under NDA.'
  - id: gdpr
    conforms: true
    evidence: 'GDPR control published on https://trust.leandata.com/ with a DPA, DPIA and TOMs.'
  - id: ccpa
    conforms: true
    evidence: 'CCPA control published on https://trust.leandata.com/.'
  - id: iso-27001
    conforms: false
    evidence: Not listed among the certifications on the trust center.
  - id: hipaa
    conforms: false
    evidence: Not listed among the certifications on the trust center.
  - id: pci-dss
    conforms: false
    evidence: Not applicable; LeanData does not process cardholder data.
  - id: fedramp
    conforms: false
    evidence: Not listed among the certifications on the trust center.
  - id: tls-1.3
    conforms: true
    evidence: 'TLSv1.3 negotiated on www.leandata.com, docs.leandata.com and api.leandata.com. See security/leandata-domain-security.yml.'
  - id: hsts-preload
    conforms: partial
    evidence: >-
      HSTS is absent on www.leandata.com per the domain-security probe, although the trust center
      lists an HSTS Preload List grade. docs.leandata.com (Postman-hosted) does send
      Strict-Transport-Security with preload.