generated: '2026-08-13'
method: derived
source: >-
  openapi/matomo-*-openapi.json, well-known/matomo-oauth-authorization-server.json,
  mcp/matomo-mcp.yml, https://matomo.org/security/, https://matomo.org/gdpr-analytics/
standards:
  - id: openapi-3.1
    conforms: true
    evidence: >-
      59 documents declaring `openapi: 3.1.0`, generated by Matomo's own first-party
      ApiReference plugin and served from a live instance. 556 operations, every one
      with an operationId, a description, tags, parameter descriptions and 400/401/403/
      404/500/default responses.
  - id: openapi-3.1-strict
    conforms: false
    evidence: >-
      The generated documents deviate from the specification in two ways. (1) Path
      keys carry a query string — `/index.php?module=API&method=VisitsSummary.get` —
      which OpenAPI does not permit; the path template is supposed to exclude the query
      component. (2) Some 200 responses serialize `content` media-type entries as EMPTY
      ARRAYS (`"application/json": []`) where the specification requires a Media Type
      Object. Both are artifacts of PHP's array/object ambiguity in json_encode. The
      documents are still useful and parse as JSON, but a strict OpenAPI validator will
      reject them.
  - id: oauth2
    conforms: true
    evidence: >-
      First-party OAuth2 plugin. Authorization Code, Client Credentials and Refresh
      Token grants; scopes matomo:read / matomo:write / matomo:admin.
  - id: rfc8414-authorization-server-metadata
    conforms: true
    evidence: >-
      /.well-known/oauth-authorization-server returns a valid RFC 8414 document
      (probed 2026-08-13, HTTP 200, application/json).
  - id: rfc7636-pkce
    conforms: true
    evidence: 'code_challenge_methods_supported: ["S256","plain"]'
  - id: rfc9728-protected-resource-metadata
    conforms: false
    evidence: /.well-known/oauth-protected-resource returns 404 (probed 2026-08-13).
  - id: oidc
    conforms: false
    evidence: >-
      /.well-known/openid-configuration returns 404. Matomo offers OAuth 2.0
      authorization, not OpenID Connect identity. (SAML/LDAP SSO is a separate
      enterprise feature for UI login, not for the API.)
  - id: mcp
    conforms: true
    version: 'mcp/sdk 0.7'
    evidence: >-
      First-party McpServer plugin 5.1.0 exposing 19 tools over JSON-RPC 2.0 HTTP.
      Endpoint probed live 2026-08-13 and answered 401 with
      `WWW-Authenticate: Bearer realm="mcp"`.
  - id: a2a
    conforms: false
    evidence: >-
      No agent card at /.well-known/agent-card.json or /.well-known/agent.json on any
      host (all 404, probed 2026-08-13).
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use Matomo's own `{result, message, code}` envelope, not
      application/problem+json. See errors/matomo-problem-types.yml.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No Sunset or Deprecation headers; zero operations marked deprecated.
  - id: rfc9331-ratelimit-headers
    conforms: false
    evidence: >-
      Rate limits are published as prose with a 429 status but no RateLimit-* or
      X-RateLimit-* response headers.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on every Matomo host.
  - id: json-api
    conforms: false
    evidence: RPC-over-query-string dispatch through a single /index.php entrypoint.
  - id: odata
    conforms: false
  - id: scim
    conforms: false
    evidence: >-
      User provisioning exists (UsersManager, 32 operations) but it is Matomo's own
      shape, not SCIM 2.0.
  - id: saml2
    conforms: true
    evidence: >-
      SAML SSO published as an Enterprise / On-Premise Enterprise feature
      (LoginSaml plugin). Applies to UI login, not API authentication.
  - id: gdpr
    conforms: true
    evidence: >-
      A first-party GDPR Manager ships in the product (PrivacyManager plugin, 6
      operations), data is hosted in Frankfurt for Cloud, and GDPR compliance is the
      product's core positioning.
  - id: iso-27001
    conforms: true
    evidence: Published on https://matomo.org/security/ — see security/matomo-trust-center.yml.
  - id: ccpa
    conforms: true
    evidence: Published alongside GDPR in Matomo's privacy/compliance material.
  - id: hipaa
    conforms: false
  - id: soc2
    conforms: false
    evidence: No SOC 2 attestation found on Matomo's security or trust material.
  - id: pci-dss
    conforms: false
  - id: fedramp
    conforms: false
compliance_program:
  published: true
  url: https://matomo.org/security/
  certifications:
    - ISO 27001
    - GDPR
  note: See security/matomo-trust-center.yml for the probe evidence.