generated: '2026-07-25'
method: derived
source: >-
  openapi/ripe-insurance-umbraco-content-delivery-openapi.json,
  openapi/ripe-insurance-cycleplan-content-delivery-openapi.json,
  well-known/ripe-insurance-openid-configuration.json,
  live probes of the Ripe brand estate 2026-07-25
note: >-
  Standards conformance derived from the harvested specifications and discovery
  documents. Ripe Insurance publishes no compliance programme, no trust centre and no
  certification claims (SOC 2, ISO 27001, PCI DSS) on any brand host, so no `Compliance`
  or `TrustCenter` pointer is emitted. It IS authorised and regulated by the UK
  Financial Conduct Authority (FRN 313411) — that is financial-services regulation, not
  a published API/security compliance posture, and is recorded here as regulatory
  context rather than as a conformance claim.
standards:
- id: openapi-3
  conforms: true
  version: ['3.0.4', '3.0.1']
  evidence: >-
    Two documents parse as OpenAPI. ripeinsurance.co.uk serves 3.0.4 (8 operations);
    cycleplan.co.uk serves 3.0.1 (16 operations).
- id: oauth2
  conforms: true
  evidence: >-
    OpenID Connect discovery advertises authorization_code, refresh_token and
    client_credentials grants with a token endpoint. Website member auth only.
- id: oidc-discovery
  conforms: true
  evidence: >-
    /.well-known/openid-configuration returns 200 with issuer, authorization_endpoint,
    token_endpoint, userinfo_endpoint, jwks_uri, id_token_signing_alg_values_supported
    RS256, on ripeinsurance.co.uk, cycleplan.co.uk, golfcare.co.uk and insure4sport.co.uk.
- id: rfc7636-pkce
  conforms: true
  evidence: 'code_challenge_methods_supported: [plain, S256]'
  gap: >-
    `plain` is still advertised alongside S256; a hardened profile would offer S256 only.
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: /.well-known/oauth-authorization-server returns 404 (OIDC metadata only).
- id: rfc9728-oauth-protected-resource
  conforms: false
  evidence: /.well-known/oauth-protected-resource returns 404.
- id: rfc7591-dynamic-client-registration
  conforms: false
  evidence: No registration_endpoint advertised in the discovery document.
- id: rfc7807-problem-details
  conforms: partial
  evidence: >-
    A ProblemDetails schema (type/title/status/detail/instance + additionalProperties)
    backs the 400 responses.
  gap: Served as application/json, not application/problem+json.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    No application/problem+json media type and no registered problem-type URIs; the
    `type` field is nullable and unused.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every Ripe brand host.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header support; v1 was withdrawn from the primary host unannounced.
- id: llms-txt
  conforms: partial
  evidence: >-
    Real llms.txt documents published at www.cycleplan.co.uk/llms.txt (10,470 bytes),
    www.golfcare.co.uk/llms.txt (9,955 bytes) and www.insure4sport.co.uk/llms.txt
    (21,524 bytes), each with an H1, section headings and annotated link lists.
  gap: >-
    www.ripeinsurance.co.uk/llms.txt returns 200 with ZERO bytes — the flagship domain
    publishes an empty file. insure4boats.co.uk and ripethinking.co.uk return 404.
- id: acord
  conforms: false
  evidence: >-
    Zero hits for ACORD, AL3, ACORD XML, NGDS, IVANS, Vertafore or Applied Epic across
    ripeinsurance.co.uk and ripethinking.co.uk (review.yml, 2026-07-25). Expected for a
    direct-to-consumer digital MGA that owns its own distribution.
- id: fhir-r4
  conforms: false
  evidence: Not a healthcare API.
- id: psd2
  conforms: false
  evidence: Not a payment services provider.
- id: open-insurance
  conforms: false
  evidence: >-
    No open-insurance obligation exists in the United Kingdom; the FCA's Open Finance
    work remains consultation rather than rule. Ripe publishes no open-data endpoints.
- id: scim2
  conforms: false
- id: odata
  conforms: false
- id: json-api
  conforms: false
- id: graphql
  conforms: false
  evidence: /graphql returns 404 on both the consumer and corporate domains.
- id: asyncapi
  conforms: false
  evidence: No event, webhook or streaming surface exists.
regulatory_context:
  regulator: Financial Conduct Authority (United Kingdom)
  authorisation: Ripe Insurance Services Limited, FRN 313411
  register: https://register.fca.org.uk/
  note: >-
    Recorded as context only. FCA authorisation governs the conduct of insurance
    distribution; it makes no statement about API security posture, certification or
    machine-readable compliance, and confers no API conformance.
certifications_published: []