generated: '2026-08-26'
method: derived
source: >-
  openapi/partstech-api-openapi.yml (securitySchemes, paths, tags, info.description) plus live probes of
  https://api.partstech.com and https://partstech.com on 2026-08-26
standards:
- id: openapi-3.0
  conforms: true
  evidence: >-
    openapi: 3.0.0 document published at https://api-docs.partstech.com/openapi.yaml — 93 paths,
    101 operations, 136 component schemas, 33 tags, 2 declared servers.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme. The /oauth/access path name is misleading: it is a credentials-for-JWT
    exchange with a vendor-specific body, not an RFC 6749 token endpoint (no grant_type, no
    client_id/client_secret, no token_type/expires_in contract, no /.well-known/oauth-authorization-server).
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every PartsTech host.
- id: jwt-rfc7519
  conforms: true
  evidence: 'securitySchemes.bearerAuth: type http, scheme bearer, bearerFormat JWT.'
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors are a vendor envelope {"error":{"code","message"}} served as application/json. No
    application/problem+json anywhere in the spec.
- id: rfc8288-web-linking
  conforms: true
  evidence: >-
    Pagination is signalled with a Link header carrying first/previous/next/last rels, and all
    MOTOR-powered endpoints return Link: <https://www.motor.com/oem-compliance-requirements/>;
    rel="compliance". info.description cites RFC 8288 explicitly.
- id: idempotency
  conforms: false
  evidence: No Idempotency-Key header or idempotency semantics anywhere in the spec.
- id: pagination
  conforms: true
  evidence: page / perPage query parameters plus RFC 8288 Link header rels.
- id: rate-limit-headers
  conforms: partial
  evidence: >-
    Publishes x-rate-limit-limit / x-rate-limit-remaining / x-rate-limit-reset. These are the
    pre-standard Twitter-style names, not the IETF draft RateLimit / RateLimit-Policy fields, and no
    Retry-After is returned on 429.
- id: json-api
  conforms: false
- id: odata
  conforms: false
- id: scim
  conforms: false
- id: fhir
  conforms: false
- id: webhooks
  conforms: partial
  evidence: >-
    Three documented partner-hosted callbacks (cart, tire quote, connection) with JSON payload schemas,
    but no signature scheme, no retry policy and no AsyncAPI document. See asyncapi/partstech-webhooks.yml.
- id: security-txt-rfc9116
  conforms: false
  evidence: /.well-known/security.txt returns 404 on all five PartsTech hosts.
domain_standards:
- id: aces-vcdb
  name: Auto Care Association VCdb (Vehicle Configuration Database) — the vehicle half of ACES
  conforms: true
  evidence: >-
    OpenAPI tag `vcdb` described as "Vehicle Configuration Database", with the full VCdb hierarchy
    exposed as first-class resources — GET /taxonomy/vehicles/years, /makes, /models, /submodels,
    /engines, /taxonomy/vehicles/{vehicleID}, /taxonomy/vehicles/vin/{vin} — and the ResponseVehicle
    schema keyed on yearId, makeId, modelId, engineId, vehicleId.
  spec_location: openapi/partstech-api-openapi.yml#/tags (vcdb) and #/paths/~1taxonomy~1vehicles
  matters_because: >-
    A partner already speaking ACES/VCdb vehicle ids can join PartsTech results to its own catalog with
    no bespoke mapping table; one that is not needs a bilateral vehicle crosswalk.
- id: aces-pcdb
  name: Auto Care Association PCdb (Product Classification Database) — the part-type half of ACES
  conforms: true
  evidence: >-
    OpenAPI tag `pcdb` described as "Product Characteristics Database", exposed as GET
    /taxonomy/categories, /taxonomy/subcategories, /taxonomy/part-types,
    /taxonomy/part-types/{partTypeId}/attributes and /taxonomy/tree/{categoryId}, with the
    ResponseTaxonomy schema keyed on categoryId.
  spec_location: openapi/partstech-api-openapi.yml#/tags (pcdb) and #/paths/~1taxonomy~1part-types
  matters_because: >-
    Category/sub-category/part-type ids are the aftermarket's shared product vocabulary; exposing them
    directly is what lets an SMS map a repair job to orderable part types without maintaining its own
    taxonomy.
- id: motor-oem-compliance
  name: MOTOR Information Systems OEM Compliance Requirements
  conforms: true
  evidence: >-
    info.description states that all MOTOR-powered endpoints (Labor, Maintenance Schedules, Fluids,
    Specifications) return an RFC 8288 Link header with rel="compliance" pointing at
    https://www.motor.com/oem-compliance-requirements/ — a machine-readable licensing/compliance signal
    attached to the response itself.
  spec_location: openapi/partstech-api-openapi.yml#/info/description
- id: vin-iso3779
  name: ISO 3779 Vehicle Identification Number
  conforms: true
  evidence: GET /catalog/vin/{vin} and GET /taxonomy/vehicles/vin/{vin} decode 17-character VINs.
compliance_program:
  published: false
  certifications: []
  trust_center: null
  evidence: >-
    probe-security-programs.py found no bug-bounty program, no disclosure page and no trust center;
    partstech.com/security/ and partstech.com/trust/ both 404 and trust.partstech.com does not resolve
    to a TLS endpoint. No SOC 2 / ISO 27001 / PCI DSS claim is published on the public site. No
    Compliance pointer is emitted.