generated: '2026-08-09'
method: derived
source: >-
  openapi/stayingapi-openapi-original.json, well-known/*, https://stayingapi.com/docs/*
description: >-
  What StayingAPI actually conforms to, checked against live artifacts rather than marketing
  claims. The agent-facing discovery stack is genuinely standards-based — RFC 8414, RFC 9728,
  RFC 9727, OAuth 2.1 + PKCE, MCP 2025-06-18, llms.txt, agentskills.io — while the REST error
  model is a proprietary envelope rather than RFC 9457, and there is no security.txt, no
  OpenID Connect, and no A2A agent card. No compliance certifications (SOC 2, ISO 27001,
  GDPR posture, PCI) are published anywhere on the site, so no Compliance pointer is emitted.
standards:
  - id: openapi-3.1
    conforms: true
    evidence: >-
      https://api.stayingapi.com/openapi.json returns openapi 3.1.0 with 8 paths / 9
      operations, all tagged, all with unique operationIds and 2xx+4xx responses.
  - id: oauth2
    conforms: true
    evidence: >-
      MCP server authenticates with OAuth 2.1 authorization code + PKCE (S256) and dynamic
      client registration; metadata at
      https://mcp.stayingapi.com/.well-known/oauth-authorization-server.
  - id: rfc8414-oauth-authorization-server-metadata
    conforms: true
    evidence: 200 JSON with issuer, authorization_endpoint, token_endpoint, registration_endpoint, S256.
  - id: rfc9728-oauth-protected-resource-metadata
    conforms: true
    evidence: >-
      200 JSON with resource + authorization_servers + scopes_supported; also advertised via
      the WWW-Authenticate resource_metadata parameter on a 401 from the MCP endpoint.
  - id: rfc7636-pkce
    conforms: true
    evidence: code_challenge_methods_supported = ["S256"]
  - id: rfc7591-dynamic-client-registration
    conforms: true
    evidence: registration_endpoint published at https://mcp.stayingapi.com/mcp/oauth/register
  - id: rfc9727-api-catalog
    conforms: true
    evidence: >-
      https://stayingapi.com/.well-known/api-catalog returns application/linkset+json with
      service-desc / service-doc / service-meta links.
  - id: rfc8615-well-known-uris
    conforms: true
    evidence: api-catalog, mcp.json, agent-skills index, oauth metadata all served under /.well-known/.
  - id: mcp-2025-06-18
    conforms: true
    evidence: >-
      Server card declares schemaVersion 2025-06-18 over streamable-http; live endpoint
      answers JSON-RPC with a 401 OAuth challenge.
  - id: llms-txt
    conforms: true
    evidence: https://stayingapi.com/llms.txt returns text/markdown in llms.txt format (200).
  - id: agentskills-index
    conforms: true
    evidence: >-
      https://stayingapi.com/.well-known/agent-skills/index.json lists 14 installable
      SKILL.md skills, each of which resolves 200.
  - id: semver
    conforms: true
    evidence: Changelog uses 1.0 / 1.0.1 / 1.0.2; stability page commits to semantic versioning.
  - id: rfc8594-sunset-header
    conforms: partial
    evidence: >-
      Stability page commits to a Sunset response header with six months' notice; no
      Deprecation header is stated and none observed (nothing is deprecated yet).
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use a proprietary { error: { type, code, message, param, requestId,
      creditsCharged, retryable, docUrl } } envelope as application/json; no
      application/problem+json media type appears in the spec.
  - id: rfc6750-bearer-token
    conforms: true
    evidence: >-
      Authorization: Bearer on REST; WWW-Authenticate: Bearer with resource_metadata on the
      MCP 401.
  - id: rfc9116-security-txt
    conforms: false
    evidence: >-
      /.well-known/security.txt returns 404 on stayingapi.com and mcp.stayingapi.com and 401
      on api.stayingapi.com; /security.txt also 404.
  - id: openid-connect
    conforms: false
    evidence: /.well-known/openid-configuration returns 404.
  - id: a2a-agent-card
    conforms: false
    evidence: >-
      /.well-known/agent-card.json and the legacy /.well-known/agent.json return 404 on the
      web and MCP hosts and 401 on the API host.
  - id: asyncapi
    conforms: false
    evidence: >-
      No event, streaming or webhook surface is published — the API is poll-based (202 +
      GET /v1/jobs/{jobId}). Not a gap to penalize; there is nothing to describe.
  - id: idempotency-key
    conforms: false
    evidence: >-
      No idempotency key header or parameter documented or present in the spec; the public
      surface is read-only, so retries are naturally safe.
  - id: cursor-pagination
    conforms: true
    evidence: >-
      Opaque base64 cursors on /search and /reviews; meta.pagination carries limit, cursor,
      nextCursor, hasMore. Explicitly never offset or page numbers.
  - id: rate-limit-headers
    conforms: true
    evidence: X-RateLimit-Limit / -Remaining / -Reset, plus Retry-After on 429.
compliance_program:
  published: false
  certifications: []
  note: >-
    No trust center, no SOC 2 / ISO 27001 / PCI / GDPR statement, and no security or
    responsible-disclosure page were found on any host. Probed with
    0-working/probe-security-programs.py — vdp=none, trust=none.
x-evidence:
  - url: https://api.stayingapi.com/openapi.json
    http_status: 200
  - url: https://mcp.stayingapi.com/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://stayingapi.com/.well-known/api-catalog
    http_status: 200
  - url: https://stayingapi.com/llms.txt
    http_status: 200
  - url: https://stayingapi.com/.well-known/security.txt
    http_status: 404
  - url: https://stayingapi.com/.well-known/agent-card.json
    http_status: 404