generated: '2026-08-13'
method: derived
source: >-
  openapi/smartlead-ai-openapi.yml, https://api.smartlead.ai/guides/error-handling,
  https://api.smartlead.ai/guides/rate-limits, https://www.smartlead.ai/dpa,
  a2a/smartlead-ai-agent-card.json, mcp/smartlead-ai-mcp.yml
description: >-
  Which cross-cutting standards the SmartLead API conforms to, asserted only where there is
  evidence in the published contract, the published docs, or a live probe.
standards:
- id: openapi-3.1
  conforms: true
  evidence: >-
    Provider-published OpenAPI 3.1.1 at https://api.smartlead.ai/api-reference/openapi.yaml —
    85 paths, 98 operations, all with unique operationIds, summaries and tags.
- id: rest
  conforms: true
  evidence: Resource-oriented paths with GET/POST/PATCH/DELETE semantics.
- id: json
  conforms: true
  evidence: application/json on every request and response body.
- id: api-key-auth
  conforms: true
  evidence: components.securitySchemes.ApiKeyAuth — apiKey in query, name api_key, applied globally.
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 security scheme in the spec and no OAuth documentation. OAuth appears only as a way
    to CONNECT a Gmail/Outlook mailbox to SmartLead (addOauthEmailAccount), not as a way to
    authenticate to the SmartLead API.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on www and 401 on the API gateway.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    No operation declares application/problem+json. Errors use a vendor envelope nested under
    "error" — see errors/smartlead-ai-problem-types.yml.
- id: rfc6750-bearer-token
  conforms: false
  evidence: Credentials travel in the query string, not an Authorization header.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on www.smartlead.ai and api.smartlead.ai.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header documented; no deprecation policy published.
- id: rfc8615-well-known
  conforms: true
  evidence: >-
    Serves a real document at https://api.smartlead.ai/.well-known/agent-card.json (200,
    application/json). The agent-skills path under /.well-known/ is a vendor extension, not a
    registered name.
- id: a2a-agent-card
  conforms: partial
  grade: flavored
  evidence: >-
    Agent card present and parses, with capabilities as an object, protocolVersion and a skills
    array — but declares transports under supportedInterfaces rather than A2A 1.0.0
    additionalInterfaces. See a2a/smartlead-ai-a2a.yml.
- id: model-context-protocol
  conforms: true
  evidence: >-
    Remote MCP server at https://api.smartlead.ai/mcp answered tools/list over Streamable HTTP
    with 3 tools and real inputSchemas. Documentation-scope only — it does not expose the REST API.
- id: agent-skills
  conforms: true
  evidence: >-
    Provider-published Agent Skill served at
    https://api.smartlead.ai/.well-known/agent-skills/smartlead/skill.md and advertised by the
    agent card.
- id: llms-txt
  conforms: true
  evidence: >-
    /llms.txt served on both the docs host (api.smartlead.ai, 3.4 KB) and the marketing host
    (www.smartlead.ai, 19.9 KB); an llms-full.txt is also served (968 KB).
- id: asyncapi
  conforms: false
  evidence: >-
    Webhooks are documented (13 event types) but no AsyncAPI document and no event payload schemas
    are published. See asyncapi/smartlead-ai-webhooks.yml.
- id: webhook-signature-hmac
  conforms: true
  evidence: X-Smartlead-Signature — HMAC SHA256 over the raw body, prefixed "sha256=".
- id: idempotency-key
  conforms: false
  evidence: >-
    No Idempotency-Key header or parameter in the docs or the spec. Idempotency guidance exists
    only for consumers deduping inbound webhook deliveries on X-Request-Id.
- id: rate-limit-headers
  conforms: partial
  evidence: >-
    Publishes X-RateLimit-Limit / -Remaining / -Reset and Retry-After — the legacy X- form, not the
    IETF draft RateLimit / RateLimit-Policy fields.
- id: pagination
  conforms: partial
  evidence: >-
    offset/limit query parameters on 4 operations; no documented policy, default, maximum, cursor
    or envelope.
- id: gdpr
  conforms: true
  evidence: >-
    Publishes a Data Processing Addendum at https://www.smartlead.ai/dpa referencing GDPR,
    sub-processors and Standard Contractual Clauses, plus a privacy policy.
- id: soc2
  conforms: unknown
  evidence: >-
    No SOC 2 claim found. No trust centre, security page or compliance page exists —
    /security, /trust, /compliance and trust.smartlead.ai all fail to resolve or return 404.
- id: iso-27001
  conforms: unknown
  evidence: No ISO 27001 claim found on any reachable SmartLead page.
- id: hipaa
  conforms: false
  evidence: Not claimed; out of scope for an outbound-email platform.
- id: pci-dss
  conforms: unknown
  evidence: PCI is mentioned only in passing in the DPA; SmartLead publishes no PCI attestation.
summary:
  conforms: 10
  partial: 3
  does_not_conform: 9
  unknown: 3
notes:
- >-
  SmartLead's standards posture is unusually agent-forward and unusually thin on classic API
  operations hygiene: it ships an agent card, an Agent Skill, an MCP server and two llms.txt files,
  while publishing no security.txt, no deprecation policy, no problem+json, no idempotency
  contract and no working status page.