generated: '2026-08-25'
method: derived
source: openapi/mavenlink-openapi.yml + well-known/ discovery documents + https://developer.kantata.com/
checked: '2026-08-25'
notes: >-
  Standards conformance asserted only where the contract or a machine-readable document proves it. Kantata
  publishes no compliance certifications (see security/mavenlink-trust-center.yml), so no `Compliance` pointer is
  emitted.
standards:
- id: oauth2
  name: OAuth 2.0 (RFC 6749)
  conforms: true
  evidence: >-
    securityDefinitions.OauthSecurity declares an accessCode (authorization_code) flow with
    authorizationUrl https://app.mavenlink.com/oauth/authorize and tokenUrl .../oauth/token; the API reference
    documents the full code-for-token exchange; the provider runs Doorkeeper (visible in the WWW-Authenticate
    realm on a 401 from api.mavenlink.com/mcp).
- id: oauth2-authorization-server-metadata
  name: OAuth 2.0 Authorization Server Metadata (RFC 8414)
  conforms: true
  evidence: >-
    https://api.mavenlink.com/.well-known/oauth-authorization-server and the app.mavenlink.com equivalent both
    return 200 with issuer, authorization_endpoint, token_endpoint, response_types_supported,
    grant_types_supported, code_challenge_methods_supported and scopes_supported.
- id: oauth2-protected-resource-metadata
  name: OAuth 2.0 Protected Resource Metadata (RFC 9728)
  conforms: true
  evidence: >-
    https://api.mavenlink.com/.well-known/oauth-protected-resource returns 200 with resource,
    authorization_servers[] and bearer_methods_supported, and the 401 from the MCP endpoint carries the
    `resource_metadata` parameter in WWW-Authenticate as the RFC prescribes.
- id: oauth2-pkce
  name: PKCE (RFC 7636)
  conforms: true
  evidence: code_challenge_methods_supported includes S256 in both the OIDC and MCP authorization-server metadata.
- id: oidc
  name: OpenID Connect Discovery 1.0
  conforms: true
  evidence: >-
    /.well-known/openid-configuration returns 200 with issuer, jwks_uri, userinfo_endpoint,
    id_token_signing_alg_values_supported [RS256], subject_types_supported and claims_supported.
- id: oauth2-token-introspection
  name: OAuth 2.0 Token Introspection (RFC 7662)
  conforms: true
  evidence: introspection_endpoint https://api.mavenlink.com/oauth/introspect in the OIDC discovery document.
- id: oauth2-token-revocation
  name: OAuth 2.0 Token Revocation (RFC 7009)
  conforms: true
  evidence: revocation_endpoint https://api.mavenlink.com/oauth/revoke in the OIDC discovery document.
- id: swagger2
  name: OpenAPI / Swagger 2.0
  conforms: true
  evidence: >-
    https://app.mavenlink.com/oas/specification returns a 2.5 MB Swagger 2.0 document (swagger 2.0, host
    api.mavenlink.com, basePath /api/v1, 218 paths, 419 operations, 129 definitions). Note it is Swagger 2.0,
    not OpenAPI 3.x - a client generator targeting 3.1 must convert first.
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    Two live MCP endpoints. developer.kantata.com/mcp answers tools/list with 200 text/event-stream and six
    tools carrying inputSchema and annotations. api.mavenlink.com/mcp answers with an RFC 9728-compliant 401.
- id: a2a
  name: A2A Agent Card
  conforms: true
  grade: conformant
  evidence: >-
    https://developer.kantata.com/.well-known/agent-card.json returns 200 with protocolVersion 0.3.0,
    capabilities as an object, skills as an array (empty), preferredTransport, defaultInputModes and
    defaultOutputModes. See a2a/mavenlink-a2a.yml for the graded reading.
- id: llmstxt
  name: llms.txt
  conforms: true
  evidence: https://developer.kantata.com/llms.txt returns 200 text/plain, 18,714 bytes.
- id: grpc
  name: gRPC / proto3
  conforms: true
  evidence: >-
    grpc/mavenlink-connector.proto - `syntax = "proto3"`, service Connector with four RPCs (triggers,
    perform_trigger, actions, perform_action), published for third-party Workflow Platform connectors.
- id: iso8601
  name: ISO 8601 date-time
  conforms: true
  evidence: The API reference states all dates and times are returned as ISO 8601 strings.
- id: rfc9457
  name: RFC 9457 Problem Details
  conforms: false
  evidence: >-
    Errors use a proprietary {"errors":[{type,message,field}]} envelope with Content-Type application/json. No
    application/problem+json anywhere in the contract.
- id: rfc8594
  name: RFC 8594 Sunset header
  conforms: false
  evidence: No Sunset or Deprecation header documented, declared or observed; no deprecation policy published.
- id: json-api
  name: 'JSON:API'
  conforms: false
  evidence: >-
    The side-loaded envelope (results[] plus id-keyed top-level collections) is Brainstem, Kantata's own Rails
    presenter framework, not JSON:API. There is no data/attributes/relationships structure and no
    application/vnd.api+json media type.
- id: odata
  name: OData
  conforms: false
  evidence: No $metadata surface; filters are per-endpoint query parameters.
- id: scim
  name: SCIM 2.0
  conforms: false
  evidence: >-
    Probed for a SCIM schema URN (urn:ietf:params:scim:schemas:*) across the whole 2.5 MB contract - no match.
    User and account-membership provisioning is done through Kantata's own /users, /account_memberships and
    /account_invitations resources, not through a SCIM endpoint. Worth flagging because SCIM is the obvious
    domain standard for a workforce-shaped SaaS with 419 operations over users, roles and memberships.
- id: idempotency-key
  name: Idempotency-Key (draft-ietf-httpapi-idempotency-key-header)
  conforms: false
  evidence: No idempotency key on any of the 86 POST operations and no idempotency section in the reference.
- id: pagination
  name: Documented pagination
  conforms: true
  evidence: >-
    Two documented styles (page/per_page with a 200 maximum, and limit/offset) with a stated precedence rule,
    plus count and meta.{count,page_count,page_number,page_size} in every response.
domain_standard:
  market: Professional Services Automation (PSA) / project + resource management
  standard_declared: false
  evaluated:
  - candidate: SCIM 2.0 (user/group provisioning)
    present: false
  - candidate: OpenID Connect
    present: true
    note: >-
      Present as an identity standard, recorded under standards[] above. It is not a PSA DOMAIN standard, so it
      is not claimed here.
  - candidate: OData
    present: false
  - candidate: 'ISO 20022 / X12 / EDIFACT (billing and invoicing message types)'
    present: false
    note: >-
      Kantata's invoicing surface (Invoices, Billing Milestones, External Payments, Client Invoice Defaults) is
      entirely proprietary JSON. No standard financial message type appears in the contract.
  conclusion: >-
    No domain standard is declared, and PSA has no widely adopted machine-readable interchange standard for a
    vendor to declare. REWARD-ONLY: this is recorded as an honest absence and nothing is invented to fill it.
compliance_certifications: []
compliance_note: >-
  None published. See security/mavenlink-trust-center.yml - the Trust Center names a CISO and links three legal
  documents but no SOC 2, ISO 27001, GDPR, HIPAA or PCI attestation.