generated: '2026-08-05'
method: derived
source: >-
  openapi/skydance-media-content-openapi.yml, live response headers, and
  security/skydance-media-domain-security.yml
api: skydance-media:content
standards:
- id: openapi-3.1
  conforms: true
  evidence: >-
    openapi/skydance-media-content-openapi.yml — DERIVED by API Evangelist from the site's live
    route-discovery document, not published by Skydance Media.
  provider_published: false
- id: json-schema
  conforms: true
  evidence: WordPress REST route args are JSON Schema fragments (type/enum/default/minimum/maximum/items)
- id: rfc7617-http-basic
  conforms: true
  evidence: components.securitySchemes.applicationPassword — http/basic (WordPress Application Passwords)
- id: rfc8288-web-linking
  conforms: true
  evidence: 'Link: <https://skydance.com/wp-json/>; rel="https://api.w.org/" observed; every resource carries a _links block'
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use the WordPress envelope {code, message, data.status} with
    Content-Type application/json, not application/problem+json. See
    errors/skydance-media-problem-types.yml.
- id: rfc6797-hsts
  conforms: true
  evidence: 'Strict-Transport-Security: max-age=31536000; includeSubDomains observed on skydance.com'
- id: rfc9116-security-txt
  conforms: false
  evidence: 'https://skydance.com/.well-known/security.txt returns 404 (probed 2026-08-05)'
- id: dnssec
  conforms: false
  evidence: 'no DNSKEY on skydance.com (security/skydance-media-domain-security.yml)'
- id: rfc8659-caa
  conforms: false
  evidence: 'no CAA records on skydance.com (security/skydance-media-domain-security.yml)'
- id: dmarc
  conforms: partial
  evidence: 'DMARC record present with p=none — published but not enforcing'
- id: spf
  conforms: true
  evidence: SPF record present on skydance.com
- id: oauth2
  conforms: false
  evidence: no oauth2 security scheme in the route index and no OAuth documented
- id: openid-connect
  conforms: false
  evidence: '/.well-known/openid-configuration returns 404'
- id: asyncapi
  conforms: false
  evidence: >-
    No event, streaming or webhook surface exists. Not penalized — there is nothing to
    describe, and no AsyncAPI was fabricated.
- id: model-context-protocol
  conforms: false
  evidence: >-
    No mcp or wp-abilities namespace in the route index (10 namespaces enumerated
    2026-08-05), and no hosted MCP server was found. No MCPServer pointer is wired.
- id: a2a
  conforms: false
  evidence: '/.well-known/agent-card.json and /.well-known/agent.json both return 404'
compliance_program:
  published: false
  certifications: []
  trust_center: null
  note: >-
    No trust center, compliance page or named certification (SOC 2, ISO 27001, PCI DSS, HIPAA,
    FedRAMP) was found on skydance.com — probe-security-programs.py returned vdp=none
    trust=none. No Compliance or TrustCenter pointer is wired. Corporate compliance disclosures
    for the merged entity, if any, would sit on paramount.com rather than here.