generated: '2026-08-02'
method: derived
source: openapi/rhino-partner-api-openapi.json
notes: >-
  Cross-cutting standards conformance derived from the published OpenAPI and live
  probes. No compliance certifications (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP) are
  published anywhere on Rhino's public surface — there is no trust center, no security
  page, and no compliance page — so no `Compliance` pointer is emitted.
standards:
- id: openapi-3.0
  conforms: true
  evidence: openapi 3.0.3 served live at https://api.prod.sayrhino.com/openapi.json (HTTP 200)
- id: oauth2-client-credentials
  conforms: true
  evidence: POST /token, grant_type enum [client_credentials], returns access_token /
    token_type Bearer / expires_in / scope
- id: rfc6750-bearer-token
  conforms: true
  evidence: securityScheme bearerAuth (http/bearer, bearerFormat JWT) applied globally
- id: rfc7519-jwt
  conforms: true
  evidence: bearerFormat JWT declared on the security scheme
- id: oidc-discovery
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every host
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: /.well-known/oauth-authorization-server returns 404 on every host
- id: rfc9457-problem-details
  conforms: false
  evidence: errors are proprietary JSON ({error, status_code, <resource>}); no
    application/problem+json anywhere in the spec
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every host
- id: rfc8594-sunset-header
  conforms: false
  evidence: no Sunset or Deprecation header documented
- id: rfc8615-well-known-uris
  conforms: false
  evidence: no /.well-known/ document published on any host
- id: json-api
  conforms: false
  evidence: responses are resource-keyed plain JSON, not JSON:API documents
- id: asyncapi
  conforms: false
  evidence: webhook surface is documented only through the REST management API; no
    AsyncAPI document published
- id: webhooks
  conforms: true
  evidence: API-managed webhook endpoints with 15 documented events, delivery inspection
    and retry (asyncapi/rhino-webhooks.yml)
- id: pagination
  conforms: true
  evidence: page / per_page query parameters on the deliveries collection
- id: idempotency
  conforms: partial
  evidence: natural-key upsert on (source, source_prospect_id) for POST /prospects; no
    Idempotency-Key header (conventions/rhino-conventions.yml)
- id: https-only
  conforms: true
  evidence: TLSv1.3 on www.sayrhino.com and api.prod.sayrhino.com; webhook destination_url
    is rejected with 422 unless HTTPS
- id: hsts
  conforms: partial
  evidence: www.sayrhino.com sets HSTS max-age 63072000; api.prod.sayrhino.com sets no
    HSTS header (security/rhino-domain-security.yml)
- id: dnssec
  conforms: false
  evidence: no DNSSEC on sayrhino.com
- id: caa
  conforms: false
  evidence: no CAA records on sayrhino.com
- id: dmarc
  conforms: true
  evidence: DMARC present, policy quarantine
regulatory_context:
  note: >-
    Rhino is a licensed insurance producer, not a self-declared standards implementer.
    Its regulatory surface is state insurance licensing — https://www.sayrhino.com/licenses
    lists the entities (Rhino New York LLC; Rhino Insurance Agency in California) and
    https://www.sayrhino.com/partners carries the carrier, admitted/surplus-lines and
    producer-compensation disclosures. These are legal disclosures, not API compliance
    certifications.
certifications_published: []