generated: '2026-08-25'
method: derived
source: >-
  openapi/*.json (21 published documents, 82 operations), plus the Maven developer hub guides and a
  search of mavenmachines.com for compliance/certification claims
standards:
- id: openapi
  conforms: true
  evidence: >-
    21 published documents — 17 at OpenAPI 3.0.0 and 4 at 3.1.0 — served from
    maven-machines.readme.io and the customer middleware hosts. Every operation carries an
    operationId, a summary and at least one 2xx response.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme in any spec; no OAuth documentation. Auth is a single `apiKey` header.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every Maven host including accounts.mavenmachines.com.
- id: rfc9457
  conforms: false
  evidence: >-
    Errors are `application/json` with a `{type, message}` vendor envelope; no
    application/problem+json media type appears in any spec.
- id: rfc8594
  conforms: false
  evidence: No Sunset or Deprecation headers documented; no operation marked deprecated.
- id: rfc9116
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every Maven host.
- id: pagination
  conforms: true
  evidence: >-
    Two documented strategies — ISO 8601 time-cursor (`startTime`) on event endpoints and an
    `offset` parameter on collection reads. https://maven-machines.readme.io/docs/pagination
- id: idempotency
  conforms: partial
  evidence: >-
    Documented upsert semantics on the transactional write endpoints keyed on caller-supplied
    identifiers, but no Idempotency-Key header and a non-idempotent event-sourced commands API.
    See conventions/maven-machines-conventions.yml.
- id: json:api
  conforms: false
  evidence: Plain JSON payloads; no JSON:API media type or document structure.
- id: odata
  conforms: false
  evidence: No $metadata surface, no OData query options.
- id: scim
  conforms: false
  evidence: >-
    User provisioning is a bespoke POST/PUT/GET /users surface with Maven-specific fields; no SCIM
    schema URNs appear anywhere in the specs.
- id: asyncapi
  conforms: false
  evidence: >-
    Maven has a real event surface (return events, event-sourced commands) but publishes no
    AsyncAPI document and no webhook callbacks — events are consumed by polling GET /return-events.
domain_standards:
- id: eld-fmcsa-395
  conforms: unverified
  claim: >-
    Maven ships an FMCSA-regulated ELD product ("Maven Fleet & ELD ... ELD compliance") and exposes
    hours-of-service through POST /eld/hos/dutystatus, GET /eld/hos/logs/summary and
    GET /eld/hos/timers/snapshot, with duty-status vocabulary (ON_DUTY_NOT_DRIVING, DRIVING,
    SLEEPER_BERTH) that matches 49 CFR Part 395 Appendix A.
  evidence: >-
    openapi/maven-machines-eld-hos-openapi.json and
    openapi/maven-machines-rest-service-manual-openapi.json. The duty-status enumeration is the
    regulated vocabulary, but the contract does not cite Part 395, does not expose the FMCSA ELD
    output-file format (the eRODS data transfer), and Maven's FMCSA registration is not asserted in
    any machine-readable artifact. Recorded as an observed signature, not as certified conformance.
  note: >-
    REWARD-ONLY check: the duty-status vocabulary is real evidence of the domain standard inside
    the contract. Registration on the FMCSA ELD list is a separate fact this pipeline did not
    verify and must not assert.
- id: edi-x12-204-214
  conforms: false
  claim: >-
    Maven's integration model is explicitly a REST alternative to EDI — the docs describe shipments
    originating from "an external EDI/pickup request" upstream in the fleet's TMS.
  evidence: >-
    No X12 transaction-set identifiers (204, 210, 214, 990) appear in any spec. Maven consumes the
    TMS's post-EDI state rather than speaking EDI itself.
compliance:
  certifications_published: false
  trust_center: false
  detail: >-
    No SOC 2, ISO 27001, HIPAA, PCI or FedRAMP claim is published on mavenmachines.com, and no
    trust center exists — https://mavenmachines.com/trust/ and /security/ both return 404. Because
    nothing is published, NO `Compliance` or `TrustCenter` pointer is emitted in apis.yml.