generated: '2026-08-28' method: probed source: >- Live probes of login.specright.com and www.specright.com discovery documents, plus the Specright API v1.1.0 reference at developer.specright.com. All checks performed 2026-08-28. name: Specright standards conformance description: >- Specright's conformance profile is lopsided in an interesting way. Its identity and agent layers sit on well-implemented, current standards — a full Keycloak OIDC realm, RFC 8414 authorization-server metadata, and an RFC 9728 protected-resource document backing an MCP endpoint. Its actual product API conforms to almost nothing: no published contract, no problem+json, no standard pagination or rate-limit signalling, and no domain standard for the packaging and supply-chain market it serves. conformance: - id: oidc name: OpenID Connect Core 1.0 conforms: true evidence: >- https://login.specright.com/realms/Specright/.well-known/openid-configuration returns 200 with a complete discovery document — issuer, authorization/token/userinfo/ introspection/revocation/end_session endpoints, jwks_uri, 19 scopes_supported including openid, and 13 id_token signing algorithms. Keycloak-backed. - id: oauth2 name: OAuth 2.0 conforms: true evidence: >- The realm advertises authorization_code, client_credentials, implicit, password, refresh_token, device_code, jwt-bearer, token-exchange, uma-ticket and CIBA grants. Separately, api.specright.com/v1 answers anonymously with 401 and "WWW-Authenticate: Bearer" (RFC 6750). - id: rfc8414 name: 'RFC 8414 — OAuth 2.0 Authorization Server Metadata' conforms: true evidence: >- Served at two independent issuers: the Keycloak realm (/realms/Specright/.well-known/oauth-authorization-server, 200) and the WordPress MCP authorization server (https://www.specright.com/.well-known/oauth-authorization-server, 200). - id: rfc9728 name: 'RFC 9728 — OAuth 2.0 Protected Resource Metadata' conforms: true evidence: >- https://www.specright.com/.well-known/oauth-protected-resource returns 200 naming resource https://www.specright.com/wp-json/mcp/mcp-oauth-server, its authorization server, bearer_methods_supported and scopes_supported. The MCP endpoint's own 401 carries a matching WWW-Authenticate with resource_metadata — the full RFC 9728 loop closes correctly. - id: rfc7636 name: 'RFC 7636 — PKCE' conforms: true evidence: >- code_challenge_methods_supported ["plain","S256"] on the Keycloak realm, and ["S256"] on the MCP authorization server. - id: mcp name: Model Context Protocol conforms: true evidence: >- Two live JSON-RPC endpoints under https://www.specright.com/wp-json/mcp/, discoverable anonymously via the route index and the RFC 9728 document, both answering a tools/list POST with a well-formed 401 challenge. See ../mcp/specright-mcp.yml. caveat: >- The MCP surface belongs to the WordPress marketing site, not to the product API. - id: rfc9116 name: 'RFC 9116 — security.txt' conforms: false evidence: >- /.well-known/security.txt probed on all five Specright hosts. 404 on www.specright.com, api.specright.com, test.specright.com and login.specright.com; developer.specright.com returns its SPA shell for every path, which is not a document. - id: rfc9457 name: 'RFC 9457 — Problem Details for HTTP APIs' conforms: false evidence: >- No application/problem+json media type on any of the 46 operations. Error responses are documented with Schema "None"; no error envelope is published at all. - id: openapi name: OpenAPI Specification conforms: false evidence: >- No OpenAPI document is served anywhere. Probed /openapi.json, /openapi.yaml, /swagger.json, /v1/openapi.json, /api-docs, /docs, /redoc, /swagger/v1/swagger.json, /api/openapi.json and /spec.json against api.specright.com (404 on all), www.specright.com (404 on all) and developer.specright.com (SPA shell on all). The reference is a widdershins/shins render embedded in the portal's JavaScript bundle — the source document exists internally but is not published. - id: asyncapi name: AsyncAPI conforms: false not_applicable: true evidence: >- Specright publishes no event, streaming or webhook surface, so there is no event contract to conform to. Recorded as N/A rather than as a failure. - id: graphql name: GraphQL conforms: false evidence: >- The 2020 API launch post stated "GraphQL support is coming soon". Probed api.specright.com/graphql and www.specright.com/graphql on 2026-08-28: both 404. Six years on, the surface does not exist. - id: json-api name: 'JSON:API' conforms: false evidence: >- Responses use a bespoke {"data": [...], "success": true} envelope with a field/label/value triple structure. No type/id resource objects, no links, no relationships, no application/vnd.api+json. - id: pagination name: Standard pagination conforms: partial evidence: >- Offset pagination via skip and limit on the four collection GETs. No total count, no next/prev links, no cursor, and neither default nor maximum limit is published. - id: idempotency name: Idempotency keys conforms: false evidence: >- No Idempotency-Key header and no request-deduplication semantics anywhere in the reference. Upsert-by-external-ID gives record-level convergence but is not a delivery guarantee. See ../conventions/specright-conventions.yml. - id: rfc8594 name: 'RFC 8594 — Sunset HTTP Header' conforms: false evidence: >- No Sunset or Deprecation header documented, and no deprecation policy published. - id: rate-limit-headers name: 'RateLimit header fields' conforms: false evidence: >- No RateLimit-* or X-RateLimit-* headers, no Retry-After, and no 429 on any operation. - id: hsts name: HTTP Strict Transport Security conforms: partial evidence: >- TLS 1.3 on all hosts. HSTS present on www.specright.com (max-age 31536000) and developer.specright.com (max-age 15552000), absent on api.specright.com — the API host is the one host without it. See ../security/specright-domain-security.yml. domain_standards: market: >- Specification data management for packaging, raw materials, formulas and finished goods across CPG, food and beverage, and retail supply chains. candidates_probed: - {standard: 'GS1 (GTIN, GLN, GDSN, EPCIS)', declared: false} - {standard: 'UN/CEFACT, EDIFACT, X12', declared: false} - {standard: 'ISO 20022', declared: false, note: 'Financial messaging — not applicable to this market.'} - {standard: 'OData $metadata', declared: false} - {standard: 'SCIM (urn:ietf:params:scim:schemas:*)', declared: false} result: none-declared evidence: >- The contract declares no domain standard. Searched the 46 operations, the 14 schemas and the field examples for GS1 identifiers (GTIN, GLN, GDSN), EPCIS event shapes, UNSPSC codes, EDI message types and any standard identifier scheme. The only identifier scheme present is Salesforce's — 18-character record IDs and specright__*__c custom-field API names — which is a platform artefact, not an industry standard. Field values are typed anyvalue, so even units of measure carry no standard vocabulary. note: >- REWARD-ONLY. GS1 is the natural candidate for this market and its absence from the contract is a real, reportable observation — Release 23.0 added FDA supplier recall and inspection integrations, so Specright does exchange externally-identified data, it just does not express it in the API contract. But no conformance is asserted here, and none is invented to fill the slot. certifications: published: false searched: - {url: 'https://www.specright.com/privacy-notice/', status: 200, result: no certification named} - {url: 'https://www.specright.com/customer-support/', status: 200, result: no certification named} - {url: 'https://www.specright.com/integrations/', status: 200, result: no certification named} - {url: 'https://trust.specright.com/', status: 'DNS: no such host'} - {url: 'https://security.specright.com/', status: 'DNS: no such host'} - {url: 'https://www.specright.com/security/', status: 404} - {url: 'https://www.specright.com/trust/', status: 404} note: >- No SOC 2, ISO 27001, PCI, HIPAA or FedRAMP claim was found on any public Specright page, and no trust center exists. Because nothing is published, no Compliance pointer is emitted. This records an absence of published evidence, not an absence of certification — an enterprise SaaS vendor of this size very likely holds SOC 2, but it is not public. summary: conformant: 6 non_conformant: 9 partial: 2 not_applicable: 1 domain_standard: none-declared