generated: '2026-09-18'
method: searched
source: openapi/statable-stats-api-openapi.yml + well-known OAuth metadata + docs
standards:
  - {id: oauth2.1,        conforms: true,  evidence: "OAuth 2.1 fronts the MCP server; RFC 8414 metadata served"}
  - {id: rfc6749-oauth2,  conforms: true,  evidence: "authorization_code + refresh_token grants"}
  - {id: rfc7636-pkce,    conforms: true,  evidence: "code_challenge_methods_supported: [S256]"}
  - {id: rfc7591-dcr,     conforms: true,  evidence: "registration_endpoint present (Dynamic Client Registration)"}
  - {id: rfc8414-oauth-as-metadata, conforms: true, evidence: "/.well-known/oauth-authorization-server 200"}
  - {id: rfc9728-oauth-protected-resource, conforms: true, evidence: "/.well-known/oauth-protected-resource 200 on api + mcp hosts"}
  - {id: oidc,            conforms: false, evidence: "no /.well-known/openid-configuration (404)"}
  - {id: rfc9457-problem-details, conforms: false, evidence: "errors use application/json custom envelope, not problem+json"}
  - {id: idempotency-key-header, conforms: true, partial: true, evidence: "Idempotency-Key on createSite; 409 idempotency_conflict"}
  - {id: ratelimit-headers, conforms: true, evidence: "X-RateLimit-Limit/Remaining/Reset + Retry-After (legacy X- form, not RFC draft RateLimit-*)"}
  - {id: offset-pagination, conforms: true, evidence: "limit/offset on breakdown queries"}
  - {id: gdpr,            conforms: true,  evidence: "cookieless, EU-hosted (Netherlands), dedicated GDPR page + DPA"}
compliance:
  # published compliance PROGRAM (feeds the Compliance pointer) — Statable's OWN posture is GDPR.
  # Third-party audit certs (SOC 2 / ISO 27001 / PCI DSS) belong to sub-processors only; see trust-center.
  - {id: GDPR, published: true, url: https://statable.com/gdpr}
  - {id: DPA,  published: true, url: https://statable.com/dpa}
domain_standard: null   # web analytics has no formal machine-readable domain standard; reward-only, none applies