generated: '2026-08-26'
method: derived
source: >-
  openapi/pathalys-pharma-*-openapi.yml, live response headers from https://pathalys.com/wp-json/,
  and a search of pathalys.com for compliance and certification claims
standards:
- id: rest
  name: HTTP/REST resource semantics
  conforms: true
  evidence: >-
    Resource-per-collection routing (/wp/v2/posts, /wp/v2/pages, /wp/v2/media), GET-only public
    surface, correct 200/400/401/404 status usage observed live.
- id: rfc8288
  name: RFC 8288 Web Linking
  conforms: true
  evidence: >-
    Collection responses return `Link: <...page=2>; rel="next"`, observed on
    GET https://pathalys.com/wp-json/wp/v2/posts?per_page=1.
- id: hal-style-links
  name: Hypermedia link relations (_links / _embedded)
  conforms: true
  evidence: >-
    Every resource carries a `_links` member with self, collection, about, author, wp:featuredmedia
    and wp:term relations; `_embed` inlines them into `_embedded`.
- id: oembed
  name: oEmbed 1.0
  conforms: true
  evidence: >-
    GET https://pathalys.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpathalys.com%2F returned 200
    with an oEmbed link response; the oembed/1.0 namespace is advertised in the site index.
- id: rfc9457
  name: RFC 9457 Problem Details for HTTP APIs
  conforms: false
  evidence: >-
    Errors are the WordPress WP_Error envelope ({code, message, data.status}) served as
    application/json, not application/problem+json. Observed on
    GET https://pathalys.com/wp-json/wp/v2/posts/99999999 -> 404.
- id: oauth2
  name: OAuth 2.0
  conforms: false
  evidence: /.well-known/oauth-authorization-server returned 404; no securitySchemes of type oauth2 exist.
- id: oidc
  name: OpenID Connect
  conforms: false
  evidence: /.well-known/openid-configuration returned 404.
- id: idempotency
  name: Idempotency keys
  conforms: false
  evidence: Not applicable — the public surface is read-only. See conventions/pathalys-pharma-conventions.yml.
- id: pagination
  name: Documented pagination with count headers
  conforms: true
  evidence: >-
    page/per_page/offset parameters plus X-WP-Total and X-WP-TotalPages, both listed in
    Access-Control-Expose-Headers.
- id: rfc9116
  name: RFC 9116 security.txt
  conforms: false
  evidence: https://pathalys.com/.well-known/security.txt returned 404.
domain_standards:
- id: none-detected
  domain: pharmaceutical / clinical development
  conforms: false
  evidence: >-
    Reward-only check, recorded as a genuine miss rather than an invented conformance. The relevant
    life-sciences interchange standards for this sector — HL7 FHIR, CDISC SDTM/ADaM/ODM, IDMP, SPL,
    E2B — govern clinical, regulatory and safety data exchange. None appears in this contract, and
    none would be expected to: the only machine-readable surface Pathalys exposes is a corporate
    content API, not a clinical, regulatory or manufacturing interface. Pathalys's clinical data
    flows run through its CRO and its Launch Therapeutics development collaboration, and are not
    publicly exposed.
compliance:
  certifications_published: []
  trust_center: false
  note: >-
    No SOC 2, ISO 27001, HIPAA, GxP or FedRAMP claim is published anywhere on pathalys.com, and there
    is no trust center. No `Compliance` pointer is wired in apis.yml, because there is nothing to
    point at. Pathalys is a clinical-stage sponsor and its regulated obligations sit with the FDA and
    its clinical partners, not with a public API program.