generated: '2026-08-25'
method: searched
source: >-
  openapi/medtrainer-public-api-openapi.json; https://medtrainer.com/security/;
  https://auth.medtrainer.com/.well-known/openid-configuration;
  https://medtrainer.com/.well-known/oauth-authorization-server
standards:
- id: fhir
  name: HL7 FHIR (alignment)
  conforms: partial
  evidence:
  - 'openapi/medtrainer-public-api-openapi.json — every 2xx and 4xx response uses media type `application/fhir+json`.'
  - 'components.schemas declares FHIR resource shapes: OperationOutcome, OperationOutcomeIssue, OperationOutcomeDetails, BundleLink, Practitioner, Location, Position.'
  - 'Search operations return FHIR Bundle envelopes (LocationSearchBundle, PractitionerSearchBundle, ...) with `link` relations, and accept the FHIR search parameters `_count`, `_page`, `_elements`.'
  - 'Every error path returns a FHIR OperationOutcome with an `issue[].code` drawn from the FHIR issue-type value set (login, invalid, throttled, exception, not-found).'
  note: >-
    This is the domain-standard signature for the healthcare market and it is declared in the
    CONTRACT, not only in marketing prose. It is recorded as `partial` rather than `true` because
    MedTrainer's own wording is "FHIR-aligned": there is no CapabilityStatement at /metadata
    (probed 2026-08-25, HTTP 401), no declared FHIR release version, and the resources are
    MedTrainer projections of FHIR shapes rather than full FHIR R4/R5 resources.
- id: hl7
  name: HL7 (family)
  conforms: partial
  evidence:
  - 'MedTrainer markets the API as using "standard HL7-compliant RESTful architecture"; the observable evidence in the contract is the FHIR alignment above.'
- id: oauth2
  name: OAuth 2.0
  conforms: true
  evidence:
  - 'https://auth.medtrainer.com/.well-known/oauth-authorization-server — HTTP 200, authorization_code + refresh_token + client_credentials grants, PKCE S256.'
  - 'https://medtrainer.com/.well-known/oauth-authorization-server — HTTP 200, authorization_code + refresh_token, PKCE S256, scope `mcp`.'
  note: >-
    The MedTrainer Public API itself does NOT use OAuth — it is API-key/bearer-token only. OAuth 2.0
    conformance applies to the platform identity provider (auth.medtrainer.com) and to the MCP
    server on medtrainer.com.
- id: oidc
  name: OpenID Connect Discovery 1.0
  conforms: true
  evidence:
  - 'https://auth.medtrainer.com/.well-known/openid-configuration — HTTP 200, issuer https://auth.medtrainer.com/, jwks_uri, userinfo_endpoint, registration_endpoint, RS256/RS384/PS256.'
- id: rfc8414
  name: 'RFC 8414: OAuth 2.0 Authorization Server Metadata'
  conforms: true
  evidence:
  - 'Served at both https://medtrainer.com/.well-known/oauth-authorization-server and https://auth.medtrainer.com/.well-known/oauth-authorization-server (both HTTP 200).'
- id: rfc9728
  name: 'RFC 9728: OAuth 2.0 Protected Resource Metadata'
  conforms: true
  evidence:
  - 'https://medtrainer.com/.well-known/oauth-protected-resource — HTTP 200, resource https://medtrainer.com/wp-json/mcp/mcp-oauth-server, scopes_supported ["mcp"].'
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence:
  - 'Live JSON-RPC endpoint https://medtrainer.com/wp-json/mcp/mcp-oauth-server (POST/GET/DELETE), OAuth-protected, discovered via RFC 9728 metadata. tools/list returns 401 anonymously.'
- id: rfc9457
  name: 'RFC 9457: Problem Details for HTTP APIs'
  conforms: false
  evidence:
  - 'No application/problem+json anywhere in the specification. Errors use the FHIR OperationOutcome envelope instead, which is the correct choice for this domain.'
- id: pagination
  name: Documented pagination
  conforms: true
  evidence:
  - 'FHIR-style `_count` and 1-based `_page` query parameters on every search operation, with absolute next/previous `link.url` values returned inside the Bundle.'
- id: idempotency
  name: Idempotency keys
  conforms: false
  evidence:
  - 'No Idempotency-Key header, no idempotency parameter, and no idempotency discussion in the specification or the published docs page. POST /api/v1/locations, /api/v1/divisions and /api/v1/practitioner are not safe to retry blind.'
- id: scim
  name: 'SCIM (System for Cross-domain Identity Management)'
  conforms: false
  evidence:
  - 'No urn:ietf:params:scim:schemas:* URNs and no /scim/v2 surface, despite the API being a workforce/practitioner directory where SCIM would be the alternative domain standard.'
compliance:
  programs:
  - name: SOC 2 Type 2
    status: claimed
    evidence:
    - 'https://medtrainer.com/security/ — "MedTrainer adheres to and follows SOC/Type 2 guidelines."'
    - 'A SOC 2 badge image is served on the MedTrainer homepage (https://medtrainer.com/wp-content/uploads/2025/08/soc2_logopng.png, HTTP 200).'
    note: 'No audit report, attestation letter, or dated certificate is published to a public URL, and there is no trust center.'
  - name: HIPAA
    status: claimed
    evidence:
    - 'MedTrainer sells HIPAA compliance tooling and states the API meets "the most stringent privacy requirements"; no BAA or attestation is published publicly.'
  - name: ISO 27001
    status: not-claimed
    evidence:
    - 'Not mentioned on https://medtrainer.com/security/.'
  trust_center: none
  note: >-
    Recorded as claims, not verifications. API Evangelist did not see an audit artifact — only the
    provider's own statements on its public security page.