generated: '2026-08-02'
method: probed
source: live probes of over-haul.com hosts; no OpenAPI, AsyncAPI or GraphQL contract is published
notes: >-
  Overhaul publishes no machine-readable API contract, so nothing here is derived from a specification. Every entry is
  either an observed probe result or an explicit "not published" record. `conforms: false` on a standard means it
  could not be evidenced from any public Overhaul surface — it is not an assertion that the private API fails the
  standard.
standards:
- id: openapi
  conforms: false
  evidence: >-
    No OpenAPI/Swagger document at any probed location. api.over-haul.com/{openapi.json,openapi.yaml,swagger.json,
    v1/openapi.json,api-docs,docs,redoc,swagger/v1/swagger.json} all return 403 {"message":"Forbidden"};
    www.over-haul.com/{api,apis,developers,developer,docs,api-docs} all return 404.
- id: asyncapi
  conforms: false
  evidence: no AsyncAPI document or public event catalog published; Risk Event API alerting is described in marketing copy only
- id: graphql
  conforms: false
  evidence: no /graphql surface found on any discovered host
- id: mcp
  conforms: false
  evidence: no hosted MCP server advertised or discoverable
- id: a2a
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json miss on every host (404 on Webflow, 403 on the API gateway, SPA catch-all on app/insights)
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on www.over-haul.com and over-haul.com
- id: rfc8615-well-known
  conforms: false
  evidence: no /.well-known/ document served on any host
- id: oidc
  conforms: unverified
  evidence: >-
    auth.over-haul.com CNAMEs to prod-azureadb2c-ejbgg5fee0g4fadp.a03.azurefd.net (Microsoft Entra External ID /
    Azure AD B2C), an OIDC provider, but its discovery document is served only under a tenant/policy path and could
    not be read anonymously; applicability to the customer APIs is unknown.
- id: statuspage-api
  conforms: true
  evidence: status.over-haul.com is an Atlassian Statuspage exposing the standard /api/v2/summary.json and /api/v2/status.json endpoints (HTTP 200)
compliance_program:
  published: false
  certifications: []
  evidence: >-
    No trust centre, security page or compliance page exists (over-haul.com/{security,trust,compliance} all 404;
    trust.over-haul.com and security.over-haul.com do not resolve). The published Quality Policy references a
    "Quality Management System" but names no certification or certifying body. No SOC 2, ISO 27001, TAPA, GDP or
    similar certification claim was found on any public Overhaul surface.
x-evidence:
- fetched: '2026-08-02'
  url: https://api.over-haul.com/openapi.json
  http_status: 403
- fetched: '2026-08-02'
  url: https://www.over-haul.com/.well-known/security.txt
  http_status: 404
- fetched: '2026-08-02'
  url: https://status.over-haul.com/api/v2/summary.json
  http_status: 200
- fetched: '2026-08-02'
  url: https://www.over-haul.com/legal/quality-policy
  http_status: 200