generated: '2026-08-13'
method: derived
source: openapi/_original/manychat-page-api-swagger-original.json
note: >-
  Cross-cutting standards conformance derived from the OpenAPI ManyChat publishes plus the probes recorded
  in well-known/, security/ and lifecycle/. ManyChat publishes no compliance/certification programme that
  we could read — trust.manychat.com and manychat.com/security are both behind the same Cloudflare
  challenge as the rest of the marketing site (403), so no `Compliance` pointer is emitted from this file.
  Absence here means "not found on a reachable surface", and the unreachable surfaces are named.
standards:
  - id: openapi-3.0
    conforms: true
    evidence: >-
      ManyChat serves OpenAPI 3.0.0 documents at
      https://api.manychat.com/swagger/compileJson?type=Page_API and ?type=Profile_API, loaded by the
      Swagger UI at https://api.manychat.com/swagger.
  - id: openapi-3.1
    conforms: false
    evidence: 'Published documents declare `openapi: 3.0.0`.'
  - id: http-bearer-auth
    conforms: true
    evidence: >-
      components.securitySchemes.Bearer is {type: http, scheme: bearer}, applied per operation.
  - id: oauth2
    conforms: false
    evidence: >-
      No oauth2 security scheme in the spec and no OAuth authorization/token endpoint documented. The only
      credential is a per-page API key. /.well-known/oauth-authorization-server 404s on api.manychat.com.
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returns 404 on api.manychat.com.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors are returned as a proprietary `{status, message, details|code}` envelope on application/json.
      No application/problem+json media type appears anywhere in the spec.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on api.manychat.com and help.manychat.com; 403 (bot challenge) on manychat.com.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: >-
      No Sunset or Deprecation header support is documented; the one superseded operation (getWidgets) is
      flagged only in prose and is not marked `deprecated: true` in the spec.
  - id: rfc8615-well-known
    conforms: false
    evidence: No /.well-known/ document is served on any ManyChat host — see well-known/manychat-well-known.yml.
  - id: rfc6570-uri-templates
    conforms: false
    evidence: No templated path parameters exist; every operation uses a fixed path with query or body parameters.
  - id: json-api
    conforms: false
    evidence: Responses use a `{status, data}` envelope, not the JSON:API media type or document structure.
  - id: idempotency-key
    conforms: false
    evidence: No idempotency key header or parameter exists on any write operation.
  - id: rate-limit-headers
    conforms: false
    evidence: >-
      Per-operation limits are published as prose in operation descriptions, but no RateLimit-*,
      X-RateLimit-* or Retry-After response header is documented and no 429 response is declared.
  - id: pagination
    conforms: false
    evidence: >-
      No cursor/offset/page parameter on any collection operation; three search operations are hard-capped
      at 100 results server-side with no way to retrieve the remainder.
  - id: semver-api-versioning
    conforms: false
    evidence: '`info.version` is the literal string "beta"; there is no URL, header or date-based version.'
  - id: mcp
    conforms: false
    evidence: No first-party MCP server; /mcp 404s on api.manychat.com.
  - id: a2a
    conforms: false
    evidence: /.well-known/agent-card.json and /.well-known/agent.json 404 on every reachable ManyChat host.
  - id: asyncapi
    conforms: false
    evidence: No AsyncAPI document published; the async surface is the outbound Dynamic Block contract only.
  - id: tls-1.3
    conforms: true
    evidence: security/manychat-domain-security.yml
regulatory:
  note: >-
    ManyChat processes personal contact data (phone, email, Meta channel identities) for marketing
    messaging in the EU and elsewhere, so GDPR/CCPA obligations plainly apply, and Meta's own platform
    policies bind the messaging surface. We could not read any ManyChat-published compliance page to
    confirm what it claims.
  unreachable:
    - {url: 'https://trust.manychat.com', status: 403, note: cloudflare-challenge}
    - {url: 'https://manychat.com/security', status: 403, note: cloudflare-challenge}
  certifications_found: []
  compliance_programme_published: unverified
platform_dependencies:
  note: >-
    The API's real conformance surface is not ManyChat's own — most send-side constraints are Meta's.
  constraints:
  - {platform: Meta Messenger Platform, constraint: '24-hour messaging window; message tags required outside it (error 3011)'}
  - {platform: Meta Messenger Platform, constraint: 'One-Time Notification tokens required per topic (error 3021)'}
  - {platform: Meta Messenger Platform, constraint: 'Notification Reason required outside 24h (error 3031)'}
  - {platform: WhatsApp Business Platform, constraint: 'per-channel send restrictions surface as the 304X error family'}