generated: '2026-08-26' method: derived source: >- openapi/*.json in this repo, security/pypestream-domain-security.yml, well-known/pypestream-well-known.yml, https://developers.pypestream.com/reference/authentication, https://developers.pypestream.com/reference/engagement-api-websocket, https://www.pypestream.ai/ meta description and JSON-LD (read 2026-08-26) standards: - id: openapi conforms: true version: '3.0.0 / 3.0.3' evidence: >- Six distinct contracts published in Pypestream's own API registry: reporting-api (3.0.0), contact-center-api (3.0.3), middleware-api-1 (3.0.3), engagement-api (3.0.3), schema-refactored/Analytics (3.0.3), pypestream-openapi-spec/JavaScript SDK (3.0.3). No 3.1 document. - id: asyncapi conforms: false evidence: >- Pypestream publishes no AsyncAPI document for either of its two event surfaces (the Engagement WebSocket and the Contact Center webhooks), though both are documented in prose in enough detail to describe. asyncapi/pypestream-engagement-api-asyncapi.yml in this repo is generated by API Evangelist from those docs, not published by Pypestream. - id: oauth2 conforms: false evidence: >- No oauth2 securityScheme in any of the six contracts. No /.well-known/oauth-authorization-server on any host (all 404 or SPA catch-all). Authentication is HTTP Basic, HTTP Bearer with a long-lived personal access token, or an X-Pypestream-Token apiKey header. - id: oidc conforms: false evidence: /.well-known/openid-configuration returns 404 or a 302 on every Pypestream host probed. - id: rfc9457 conforms: false evidence: >- No application/problem+json media type and no `type` URI anywhere. See errors/pypestream-problem-types.yml. - id: rfc8594 conforms: false evidence: No Sunset or Deprecation header documented; no deprecation policy published. - id: rfc9728 conforms: false evidence: >- An MCP server is served at https://developers.pypestream.com/mcp and returns 401 with no WWW-Authenticate header, and /.well-known/oauth-protected-resource 404s, so protected-resource metadata discovery is not implemented. - id: idempotency conforms: false evidence: >- No Idempotency-Key header or equivalent on any of the 100 published operations, including unsafe POSTs such as createIntegration, batch_exports_create and Engagement `message`. - id: pagination conforms: partial evidence: >- The Analytics API implements a consistent limit/offset envelope (count/next/previous/results) across every Paginated*List schema. The Reporting API and Contact Center API implement no pagination at all; Reporting bounds volume with a maximum time window instead. - id: rfc3339 conforms: true evidence: >- The Reporting API requires `from` and `to` in RFC3339 form and states the format explicitly: "Timestamp in RFC3339 (YYYY-MM-DDTHH:MM:SSZ) format", example 2021-12-20T00:00:00Z. - id: rfc6455 conforms: true evidence: >- The Engagement API publishes a WebSocket surface at wss://engagement-api.pypestream.com/socket/websocket with documented close codes 1000 and 1007. - id: phoenix-channels conforms: true evidence: >- Pypestream names the framing protocol explicitly and points integrators at the Phoenix Channels JavaScript client (hexdocs.pm/phoenix/js). Channel topic is chat:{CHAT_ID}; keepalive is a new:ping every 20 seconds. This is an implementation protocol rather than an interoperability standard, but it is a named, documented, third-party-implemented wire format. - id: soc2 conforms: claimed evidence: >- Pypestream states "SOC 2 certified" in the meta description, og:description and twitter:description of every page served by www.pypestream.ai, and operates a Vanta-hosted trust center at https://trust.pypestream.com/ (HTTP 200). The trust center renders client-side, so the certificate inventory could not be read by a non-JS agent and no report is asserted here. See security/pypestream-trust-center.yml. - id: hsts conforms: true evidence: >- HSTS enabled on www.pypestream.ai (max-age 63072000) and developers.pypestream.com (max-age 31536000). Not observed on reporting.pypestream.com. - id: dmarc conforms: partial evidence: >- pypestream.com publishes DMARC with p=reject and DNSSEC and CAA. pypestream.ai -- the domain the company has moved its public site to -- publishes SPF but no DMARC, no DNSSEC and no CAA. - id: security-txt conforms: false evidence: >- RFC 9116 not implemented by Pypestream. The one 200 on a /.well-known/security.txt path, at analytics.pypestream.com, serves PostHog's upstream file (Contact engineering@posthog.com, Expires 2024-03-14). domain_standards: market: conversational AI / contact center / CCaaS note: >- Reward-only check. The contact-center market does have candidate interoperability standards -- among them the Open Voice Interoperability Initiative's specifications for agent-to-agent conversation handoff, and W3C Voice Interaction work -- and Pypestream's Contact Center API escalation surface is precisely where one would appear. None is declared. Pypestream's escalation contract is entirely bespoke: proprietary event names (agents/availability, conversations/{conversationId}/escalate), a proprietary metadata resource, and no reference to any external schema, URN, namespace or profile in any of the six documents. Integrating a Pypestream escalation with a contact center requires a bilateral connector. declared: [] probed_for: - name: SCIM found: false note: No urn:ietf:params:scim:schemas:* URN and no /Users or /Groups resource in any contract. - name: OData found: false note: No $metadata surface. - name: ActivityPub found: false - name: 'HL7 FHIR' found: false note: >- Probed because Pypestream markets to health insurance (www.pypestream.ai/industries/health-insurance) and claims HIPAA coverage. No FHIR resource, profile or endpoint appears in any published contract. - name: Open Voice Interoperability found: false - name: 'W3C Voice Interaction' found: false