generated: '2026-08-05'
method: derived
source: openapi/*.yml, https://docs.qoala.app/reference/*
standards:
- id: openapi-3.1
  conforms: true
  evidence: 'All 15 published Qoala specifications declare openapi: 3.1.0'
- id: api-key-auth
  conforms: true
  evidence: 'components.securitySchemes ApiKeyAuth (apiKey, in: header, name: x-api-key) applied globally via security[]'
- id: oauth2
  conforms: false
  evidence: No oauth2 security scheme in any published spec and no OAuth documented
- id: oidc
  conforms: false
  evidence: No /.well-known/openid-configuration on any host (404/403)
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom {status,data,message,code,error_code} envelope, not application/problem+json
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt on qoala.com, www.qoala.app, api.qoala.app or docs.qoala.app
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy published
- id: idempotency
  conforms: true
  evidence: request_id idempotency key on the partner webhook with documented replay (200) and conflict (409) semantics
- id: webhooks
  conforms: true
  evidence: Bidirectional webhook surface documented for policy and claim status notification
- id: asyncapi
  conforms: false
  evidence: Event surface exists but no AsyncAPI document is published
- id: pagination
  conforms: false
  evidence: No paginated collection endpoints published
- id: mcp
  conforms: true
  evidence: Hosted MCP server at https://docs.qoala.app/mcp, protocol 2025-06-18, 6 tools, anonymous tools/list
- id: llms-txt
  conforms: true
  evidence: https://docs.qoala.app/llms.txt returns 200 and indexes 52 documentation pages
- id: a2a-agent-card
  conforms: false
  evidence: No /.well-known/agent-card.json or /.well-known/agent.json on any Qoala host
compliance_program:
  published: false
  note: No trust center, certification page (SOC 2 / ISO 27001 / PCI DSS), or compliance program was found on any Qoala
    host. Qoala operates as a licensed insurance broker under local regulators (e.g. OJK in Indonesia), but no machine-
    or web-discoverable compliance page was located, so no Compliance pointer is emitted.