generated: '2026-07-20'
method: derived
source: >-
  https://www.qiniu.com/llms.txt, https://github.com/qiniu/api-specs,
  https://developer.qiniu.com/kodo/1201/access-token
standards:
  - id: s3-compatible
    conforms: true
    evidence: >-
      Kodo publishes an S3-compatible API surface (per product docs / llms.txt),
      and Qiniu maintains kodo-s3-adapter-sdk. Bucket/object semantics map to S3.
  - id: oauth2
    conforms: false
    evidence: Authentication is AK/SK HMAC signature, not OAuth2.
  - id: oidc
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use a Qiniu-specific JSON envelope { code, error }, not
      application/problem+json.
  - id: rfc8594-sunset-header
    conforms: false
  - id: pagination
    conforms: true
    evidence: Marker-based cursor pagination on list operations.
  - id: hmac-request-signing
    conforms: true
    evidence: HMAC-SHA1 request signing (Qiniu / QBox authorization).
  - id: rbac-iam
    conforms: true
    evidence: >-
      IAM users/groups/policies with policy-based action/resource permissions
      (api-specs iam/*).
notes: >-
  Derived from published docs and the api-specs DSL. No third-party compliance
  certifications (SOC 2 / ISO 27001 / PCI) were discoverable via public probes,
  so no Compliance pointer is asserted.