generated: '2026-08-09' method: searched source: >- Derived from openapi/neutrino-api-openapi-3.1.json (securitySchemes, error schema, absence of pagination/idempotency parameters) and from published provider claims at https://www.neutrinoapi.com/privacy-policy/, https://www.neutrinoapi.com/data-processing-agreement/, https://www.neutrinoapi.com/about-us/ and https://www.neutrinoapi.com/api/api-basics/; plus live probes recorded in well-known/neutrino-api-well-known.yml and security/neutrino-api-domain-security.yml. description: >- What Neutrino API does and does not conform to across the cross-cutting standards the catalog tracks. The strong suits are specification coverage (OpenAPI 3.1 + Swagger 2.0 + RAML + WADL + WSDL + API Blueprint + Postman + Insomnia, all published and all generated from one source) and RFC 9727 API discovery. The weak suits are runtime affordances a machine needs: no OAuth, no RFC 9457 problem details, no RFC 8594 sunset signalling, no rate-limit headers, no idempotency. standards: - id: openapi conforms: true evidence: >- OpenAPI 3.1.0 published at https://www.neutrinoapi.com/api/openapi-3.1.json (and .yaml), info.version 3.7.2, 28 operations across 7 tags, every operation with an operationId and 400/403/500/default responses. Saved to openapi/neutrino-api-openapi-3.1.json. - id: swagger2 conforms: true evidence: https://www.neutrinoapi.com/api/swagger.json — Swagger 2.0, same 28 paths. Saved to openapi/neutrino-api-swagger-2.0.json. - id: rfc9727-api-catalog conforms: true evidence: >- https://www.neutrinoapi.com/.well-known/api-catalog returns 200 with content-type application/linkset+json; profile="https://www.rfc-editor.org/info/rfc9727", carrying service-desc (the OpenAPI), service-doc and status links. - id: apikey-auth conforms: true evidence: >- Two apiKey securitySchemes in the OpenAPI (`user-id`, `api-key`, both in: header), documented at /api/api-basics/ with an optional combined `API-Key: user-id:api-key` form. - id: oauth2 conforms: false evidence: >- No OAuth anywhere — no oauth2 securityScheme in either spec, no /.well-known/oauth-authorization-server (404 on the docs host, 400 on the API hosts). Access control is per-key endpoint restriction in the account dashboard. - id: oidc conforms: false evidence: /.well-known/openid-configuration returns 404 on www.neutrinoapi.com and 400 on the API hosts. - id: rfc9457-problem-details conforms: false evidence: >- Errors are returned as {"api-error": int, "api-error-msg": string} with content-type application/json, not application/problem+json. Verified live against https://neutrinoapi.net/ip-info (403) and an unrouted path (400). See errors/neutrino-api-problem-types.yml. - id: idempotency conforms: false evidence: >- No Idempotency-Key header or equivalent is documented or present in either spec. Telephony side effects are bounded with a per-number `limit` option instead. - id: pagination conforms: false evidence: >- No collection endpoint and no pagination parameters. Bulk data is served as whole-file downloads with an optional checksum for change detection. - id: rfc8594-sunset conforms: false evidence: >- Deprecated ("Legacy") endpoints are signalled only by an HTML banner in the docs and by api-error 18 on the wire — no Sunset or Deprecation response headers, no removal dates. See lifecycle/neutrino-api-lifecycle.yml. - id: rate-limit-headers conforms: false evidence: >- Live responses carry no X-RateLimit-* / RateLimit-* headers; quota state is only observable through error codes 2 / 16 / 31 or the account dashboard. - id: rfc9116-security-txt conforms: false evidence: /.well-known/security.txt and /security.txt both return 404 on www.neutrinoapi.com. - id: webhooks conforms: false evidence: >- No webhook, callback or event surface in either spec or in the docs; the API is request/response only. AsyncAPI is therefore not applicable rather than missing. - id: gdpr conforms: true evidence: >- "Neutrino API complies with European Data Protection Laws (EU GDPR 2016/679), UK Data Protection Laws (UK GDPR) and the New Zealand Privacy Act 2020" — https://www.neutrinoapi.com/privacy-policy/ §2.6, with a published EU/UK GDPR-compliant DPA at https://www.neutrinoapi.com/data-processing-agreement/. - id: uk-gdpr conforms: true evidence: Named in the privacy policy §2.6 and throughout the DPA's Data Protection Laws definition. - id: nz-privacy-act-2020 conforms: true evidence: >- Named in the privacy policy §2.6 and the DPA. Neutrino API is based in Auckland, New Zealand (https://www.neutrinoapi.com/about-us/). - id: data-residency conforms: true evidence: >- Geofence endpoints (eu., aus., usa.neutrinoapi.net) guarantee requests are processed only on servers inside the named boundary — launched 2025-02-12 explicitly for local data-processing law compliance. - id: pci-dss conforms: partial evidence: >- Neutrino API does not claim PCI certification for itself; it states that cardholder data for its own billing is passed to "third-party PCI certified payment gateway(s)" (privacy policy §2.5). The BIN Lookup / BIN List Download endpoints operate on BIN ranges, not PANs. - id: soc2 conforms: false evidence: >- No SOC 2 report, ISO 27001 certificate or trust center is published anywhere on neutrinoapi.com. (Search results for "Neutrinos" SOC 2 refer to an unrelated company.) - id: tls13 conforms: true evidence: TLS 1.3 on www.neutrinoapi.com, neutrinoapi.net and aws.neutrinoapi.net; see security/neutrino-api-domain-security.yml. - id: hsts conforms: partial evidence: >- HSTS present with max-age 31536000 on www.neutrinoapi.com but absent on the API hosts neutrinoapi.net / aws.neutrinoapi.net. - id: dnssec conforms: false evidence: Not enabled on neutrinoapi.com or neutrinoapi.net. - id: dmarc conforms: partial evidence: >- neutrinoapi.com publishes SPF and DMARC with p=reject; neutrinoapi.net publishes SPF but no DMARC record. compliance_summary: published_programs: [EU GDPR, UK GDPR, New Zealand Privacy Act 2020] dpa: https://www.neutrinoapi.com/data-processing-agreement/ privacy_policy: https://www.neutrinoapi.com/privacy-policy/ certifications: [] note: >- Compliance here is a set of published legal commitments (a DPA and named data-protection regimes), not third-party audited certifications. There is no SOC 2, ISO 27001 or trust center.