generated: '2026-08-05' method: derived source: openapi/recode-therapeutics-content-openapi.yml summary: >- Cross-cutting standards conformance for the ReCode Therapeutics content API, assessed against the live surface on 2026-08-05. ReCode Therapeutics makes no conformance or certification claim anywhere on its public site — there is no trust centre, no compliance page and no SOC 2 / ISO 27001 / HIPAA statement — so every entry below is an observation, not a repeated claim. standards: - id: openapi conforms: true version: '3.1.0' evidence: >- No OpenAPI is published by the provider. The spec in this repository is derived by API Evangelist from the route index the site publishes at /wp-json/ and verified against live anonymous responses. It is valid OpenAPI 3.1.0; it is not a provider artifact. provider_published: false - id: rest conforms: true evidence: >- Resource-oriented paths, correct GET semantics, HTTP status codes used conventionally (200/400/401/404), JSON representations. - id: hateoas conforms: partial evidence: >- Every object carries a HAL-style `_links` block with self/collection/about/author/ wp:featuredmedia/wp:term relations and a `curies` block resolving the `wp:` prefix. Link relations are present and usable, but there is no profile document and clients still need out-of-band knowledge of the collections. - id: rfc8288 name: Web Linking conforms: true evidence: >- Collection responses carry a `Link` header with rel="next" / rel="prev" for pagination. Observed on /wp/v2/posts, /wp/v2/pages and /wp/v2/media. - id: pagination conforms: true style: page-number evidence: >- `page` + `per_page` request parameters (per_page hard-capped at 100, verified by a 400 rest_invalid_param at 101); `X-WP-Total` and `X-WP-TotalPages` response headers. - id: rfc9457 name: Problem Details for HTTP APIs conforms: false evidence: >- Errors are returned as `application/json` with the WordPress `{code, message, data.status}` envelope. No `application/problem+json` media type, no `type`/`title`/`detail`/`instance` members. See errors/recode-therapeutics-problem-types.yml. - id: idempotency conforms: not-applicable evidence: >- No public write path exists, so there is no idempotency mechanism to conform to. All public operations are GET. Recorded as not-applicable rather than false — and deliberately NOT wired as an Idempotency pointer in apis.yml, because the provider supports nothing. - id: oauth2 conforms: false evidence: >- No OAuth. /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource both returned 404. The install advertises WordPress Application Passwords, which is an interactive wp-admin flow, not OAuth. - id: oidc conforms: false evidence: /.well-known/openid-configuration returned 404. - id: rfc9116 name: security.txt conforms: false evidence: /.well-known/security.txt returned 404 (origin-level, not routed into WordPress). - id: rfc9727 name: api-catalog well-known URI conforms: false evidence: /.well-known/api-catalog returned 404. - id: rfc8594 name: Sunset HTTP header conforms: false evidence: No Sunset or Deprecation headers on any response. - id: a2a name: Agent2Agent conforms: false evidence: >- Both /.well-known/agent-card.json and the legacy /.well-known/agent.json returned 404. No agent card exists and none has been authored on the provider's behalf. - id: mcp name: Model Context Protocol conforms: false evidence: >- No hosted or remote MCP server is published or discoverable. Notably the install DOES register the WordPress Abilities API (`wp-abilities/v1`), an agent-facing capability registry, but every endpoint under it returns 401 rest_forbidden anonymously — so no agent surface is claimed. - id: llmstxt conforms: true evidence: >- https://recodetx.com/llms.txt returns 200 text/plain, 71,720 bytes, generated by All in One SEO v4.8.8. Saved verbatim to llms/recode-therapeutics-llms.txt. It follows the llms.txt convention (H1, summary line, H2 sections of linked resources) but is a plugin-generated site index rather than a hand-authored agent guide. - id: oembed name: oEmbed 1.0 conforms: true evidence: >- /oembed/1.0/embed returns a conformant oEmbed rich document for recodetx.com URLs and 404 oembed_invalid_url for foreign hosts. - id: schema-org name: schema.org JSON-LD conforms: true evidence: >- The site emits an @graph with BreadcrumbList, Organization, WebPage and WebSite nodes, including the organization logo, telephone and sameAs links. Captured in json-ld/recode-therapeutics-organization.jsonld. - id: rss2 name: RSS 2.0 conforms: true evidence: /feed/ and /comments/feed/ both return application/rss+xml. - id: sitemaps conforms: true evidence: /sitemap.xml returns a valid XML sitemap index generated by All in One SEO. - id: cors conforms: true evidence: WordPress REST sends a permissive Access-Control-Allow-Origin on REST responses. regulatory: note: >- ReCode Therapeutics is a clinical-stage biopharmaceutical company. Its regulatory surface is FDA/EMA drug development — Orphan Drug and Fast Track designations, clinical trial conduct — not API or data-processing regulation. The content API handles no patient data, no health records and no regulated transaction; it serves marketing and press content. hipaa: not-applicable — no PHI is transmitted by this surface gdpr_note: >- /wp/v2/users returns 5 identifiable author records anonymously. Any consumer retrieving or storing them is processing personal data under UK/EU GDPR. See the x-personal-data annotation in the OpenAPI. cookie_compliance: evidence: >- The site runs Complianz (the `complianz/v1` REST namespace is registered and its index is readable) and publishes a Cookie Policy at https://recodetx.com/cookie-policy/, alongside a Privacy Policy and Terms & Conditions. certifications_published: [] certifications_note: >- None. No trust centre, no compliance page, no named certification anywhere on the public site. No Compliance pointer is emitted in apis.yml, because there is nothing to point at. x-evidence: checked: '2026-08-05' method: live anonymous probes; every conforms/false above corresponds to an observed 404 or an observed response shape