generated: '2026-08-27'
method: derived
source: openapi/mealie-openapi.json
docs: https://docs.mealie.io/documentation/getting-started/api-usage/
summary:
  conforming: 4
  not_conforming: 8
  note: >-
    Mealie's cross-cutting standards posture is thin by design — it is a self-hosted
    household application, not an enterprise integration surface. It has no
    compliance certifications, no trust centre and no regulated-sector obligations,
    so no `Compliance` pointer is emitted. The one genuinely interesting result is the
    domain-standard signature below.
standards:
- id: openapi
  conforms: true
  version: 3.1.0
  evidence: >-
    openapi/mealie-openapi.json, harvested from https://demo.mealie.io/openapi.json —
    180 paths, 264 operations, 248 component schemas, generated by FastAPI.
- id: oauth2
  conforms: partial
  evidence: >-
    components.securitySchemes.OAuth2PasswordBearer declares the RFC 6749 resource
    owner password credentials flow with tokenUrl /api/auth/token, applied to 230 of
    264 operations. No client_credentials or authorization_code flow is exposed by
    the API itself, and no scopes are defined.
- id: oidc
  conforms: partial
  role: relying-party
  evidence: >-
    Mealie is an OIDC CLIENT, not a provider — it authenticates users against an
    external IdP using the Authorization Code flow with PKCE and requires the
    email_verified claim from v3.21.0. It serves no /.well-known/openid-configuration
    of its own (probed 404 on mealie.io and docs.mealie.io).
    https://docs.mealie.io/documentation/getting-started/authentication/oidc-v2/
- id: ldap
  conforms: true
  evidence: >-
    Directory-backed user authentication documented at
    https://docs.mealie.io/documentation/getting-started/authentication/ldap/
- id: pagination
  conforms: true
  style: page-number
  evidence: >-
    Uniform page / perPage request params and page / per_page / total / total_pages /
    items / next / previous response envelope across nearly every collection
    endpoint, documented at
    https://docs.mealie.io/documentation/getting-started/api-usage/
- id: rfc9457
  conforms: false
  evidence: >-
    No application/problem+json media type anywhere in the contract. Errors use
    FastAPI's HTTPValidationError under a `detail` key. See
    errors/mealie-problem-types.yml.
- id: idempotency
  conforms: false
  evidence: >-
    No Idempotency-Key header and no idempotency semantics in the contract or docs.
- id: json:api
  conforms: false
  evidence: Plain JSON; no JSON:API document structure, media type, or relationship objects.
- id: odata
  conforms: false
  evidence: >-
    No $metadata endpoint. Mealie has its own SQL-like `queryFilter` grammar instead,
    which is functionally comparable but bespoke and not an implementation of any
    published query standard.
- id: scim
  conforms: false
  evidence: >-
    No SCIM schema URNs and no /Users or /Groups SCIM endpoints. User provisioning is
    via Mealie's own /api/admin/users surface plus OIDC just-in-time account creation.
- id: rfc8594
  conforms: false
  evidence: No Sunset or Deprecation headers; see lifecycle/mealie-lifecycle.yml.
- id: fhir
  conforms: false
  applicable: false
  evidence: >-
    Not applicable. Mealie handles recipe nutrition figures, not clinical or dietetic
    health records, and makes no health-data claims.
domain_standard:
  market: recipes / food and cooking data
  standard: schema.org Recipe
  conforms: true
  role: consumer-and-parser
  evidence:
    spec_location: >-
      openapi/mealie-openapi.json — paths./api/recipes/create/html-or-json.post.description
      and paths./api/recipes/create/html-or-json/stream.post.description
    quoted: >-
      "Takes in raw HTML or a https://schema.org/Recipe object as a JSON string and
      parses it like a URL"
    operations:
    - create_recipe_from_html_or_json_api_recipes_create_html_or_json_post
    - create_recipe_from_html_or_json_stream_api_recipes_create_html_or_json_stream_post
    - parse_recipe_url_api_recipes_create_url_post
    - test_parse_recipe_url_api_recipes_test_scrape_url_post
  note: >-
    This is a real domain-standard signature declared by the CONTRACT itself, not a
    marketing claim: Mealie accepts a schema.org/Recipe JSON-LD object directly as a
    creation payload, and its URL-import path works by extracting schema.org/Recipe
    microdata from third-party cooking sites. For an integrator who already holds
    schema.org Recipe data — which is the near-universal publishing format for recipes
    on the open web — there is no bespoke mapping to write on the way in.
  limitation: >-
    The standard is honoured on INPUT only. Mealie's own read models
    (Recipe-Output, RecipeSummary) are Mealie-shaped, not schema.org-shaped, and the
    only export format the contract offers is ExportTypes: [json] — Mealie's own JSON.
    So an agent can hand Mealie schema.org and get a recipe, but cannot ask Mealie for
    schema.org back. That asymmetry is the gap worth reporting to the project.
certifications: []
compliance_programs: []