generated: '2026-09-13' method: derived source: 'openapi/progress-software-chef-automate-openapi-original.json, openapi/progress-software-moveit-transfer-openapi-original.json, openapi/progress-software-whatsup-gold-openapi-original.json, well-known/progress-software-oauth-authorization-server.json, well-known/progress-software-openid-configuration.json, well-known/progress-software-security.txt, https://trust.progress.com/, https://api.sharefile.com/gettingstarted/odata, https://www.progress.com/documentation/sitefinity-cms/odata-services-configurations' standards: - id: openapi-2.0 conforms: true evidence: 'All three harvested contracts declare swagger: "2.0". None has been migrated to OpenAPI 3.x — the newest, WhatsUp Gold 2026.0 published in 2026, is still Swagger 2.0.' - id: openapi-3 conforms: false evidence: No OpenAPI 3.x document is published for any Progress product. - id: oauth2 conforms: true evidence: 'WhatsUp Gold declares a securityDefinitions oauth2 password-grant scheme; ShareFile API v3 is OAuth 2.0 (https://api.sharefile.com/gettingstarted/oauth2); and the Sitefinity CMS platform serves RFC 8414 authorization-server metadata from six Progress marketing hosts.' - id: rfc8414-oauth-authorization-server-metadata conforms: true evidence: 'well-known/progress-software-oauth-authorization-server.json — a valid RFC 8414 document served at https://www.progress.com/.well-known/oauth-authorization-server (issuer https://www.progress.com, authorization_endpoint /sitefinity/oauth/authorize, S256 PKCE), and at the equivalent path on telerik.com, chef.io, sharefile.com, whatsupgold.com and kemptechnologies.com. This is the Sitefinity CMS website OAuth surface, not a product API authorization server.' - id: oidc conforms: true evidence: 'well-known/progress-software-openid-configuration.json — a full OIDC discovery document at https://community.progress.com/.well-known/openid-configuration (Salesforce Experience Cloud IdP fronting the Progress Community). Scoped to the community/support login, not to any product API.' - id: rfc9116-security-txt conforms: true evidence: 'well-known/progress-software-security.txt — a valid RFC 9116 file at https://www.telerik.com/.well-known/security.txt with Contact, Expires, Canonical, Policy (x2), Preferred-Languages and Hiring. Served on the telerik.com apex and www only; progress.com, chef.io, sharefile.com, whatsupgold.com and kemptechnologies.com all 404 the path.' - id: rfc9457-problem-details conforms: false evidence: 'No application/problem+json media type or type URI appears in any of the three specs. See errors/progress-software-problem-types.yml — MOVEit''s ErrorModel {title, detail, errorCode} is Problem-Details-SHAPED but is not RFC 9457.' - id: idempotency conforms: false evidence: 'Zero occurrences of "idempoten" across 558 published operations. See conventions/progress-software-conventions.yml (idempotency.coverage: none).' - id: pagination conforms: true evidence: 'All four API surfaces paginate, but with four incompatible vocabularies (pagination.page/size and search_query.page/per_page on Chef Automate; page/perPage on MOVEit; pageId/limit on WhatsUp Gold; $skip/$top on ShareFile). Present, not standardized.' - id: asyncapi conforms: false evidence: No AsyncAPI document is published for any product. See asyncapi/progress-software-sharefile-webhooks.yml. - id: grpc conforms: true evidence: 'The Chef Automate API is a grpc-gateway projection of gRPC services — its error type is grpc.gateway.runtime.Error and its schema names are fully-qualified protobuf type names (chef.automate.api.iam.v2.User). The .proto sources are not published as a consumable contract, so no grpc/ artifact is recorded.' - id: soap-wsdl conforms: false evidence: No ?wsdl or ?singleWsdl surface was found on any Progress API host during this pass. - id: a2a conforms: false evidence: No agent card at /.well-known/agent-card.json or /.well-known/agent.json on any of the 23 hosts probed. - id: mcp conforms: true evidence: 'Progress ships five MCP servers (KendoReact, Kendo Angular, Kendo jQuery, Telerik Blazor, OpenEdge). All are customer-installed; none is a hosted endpoint. See mcp/progress-software-mcp.yml.' - id: llmstxt conforms: true evidence: 'A first-party llms.txt is served at https://www.progress.com/llms.txt and separately on telerik.com, sharefile.com, chef.io, whatsupgold.com and kemptechnologies.com — a per-brand rollout, not a single file. See llms/progress-software-llms.txt.' domain_standards: - id: odata name: OData conforms: true evidence: 'TWO independent products serve OData as their primary contract. (1) ShareFile API v3 is OData-based: https://api.sharefile.com/gettingstarted/odata documents $expand, $select and the $metadata document, and the resource model (Items, Accounts, Users, Shares, AccessControls) is an OData entity set. (2) Sitefinity CMS headless serves OData v4 web services under a configurable route, documented at https://www.progress.com/documentation/sitefinity-cms/odata-services-configurations, with a $metadata document per installation. Progress also sells OData as a product in its own right — DataDirect Hybrid Data Pipeline publishes an OData 2/OData 4 access layer over OpenEdge and other databases (https://www.progress.com/odata/openedge).' spec_location: 'ShareFile: $metadata on https://{subdomain}.sf-api.com/sf/v3/$metadata (per tenant). Sitefinity: $metadata on https://{sitefinity-host}/api/default/$metadata (per installation). Both are per-tenant and could not be fetched anonymously during this pass.' compliance: published: true trust_center: https://trust.progress.com/ certifications: - SOC 1 - SOC 2 Type I - SOC 2 Type II - SOC 3 - ISO 27001 - ISO 27017 - ISO 27018 - PCI DSS - HIPAA - FedRAMP - CSA STAR - TISAX - GDPR evidence: https://trust.progress.com/ (see security/progress-software-trust-center.yml). ShareFile maintains a separate trust center at https://trust.sharefile.com/ listing SOC 2 Type II, SOC 3, FedRAMP Moderate, FedRAMP Li-SaaS, HIPAA, CSA STAR and GDPR.