generated: '2026-08-29' method: searched source: >- Derived from openapi/synadia-communications-control-plane-openapi.yaml and openapi/synadia-communications-http-gateway-openapi.json, plus live probes of https://www.synadia.com/.well-known/api-catalog, /.well-known/agent-skills/index.json, /llms.txt and /.well-known/security.txt, and the compliance claim on https://www.synadia.com/security. name: Synadia Communications standards conformance description: >- Synadia's conformance profile is lopsided in an interesting way. On the AGENT-DISCOVERY standards it is near the top of the catalog - it serves a real RFC 9727 api-catalog, an llms.txt, an agentskills.io v0.2.0 registry, and Markdown twins of every page under content negotiation. On the HTTP API standards it is thin - no RFC 9457 problem details, no RFC 9116 security.txt, no OAuth 2.0 on either API, no pagination or idempotency convention. It invested in being findable by agents before it invested in being predictable to them. conformance: - id: rfc9727-api-catalog name: RFC 9727 API Catalog (/.well-known/api-catalog) conforms: true evidence: url: https://www.synadia.com/.well-known/api-catalog status: 200 content_type: application/linkset+json detail: >- Valid linkset with two anchors (cloud.synadia.com, www.synadia.com), each carrying service-doc and describedby relations. File saved at well-known/synadia-communications-api-catalog.json. gap: >- The linkset points only at HTML docs and the llms.txt. It does NOT advertise either of the two real OpenAPI definitions, so an RFC 9727 consumer still cannot reach a machine-readable contract. - id: llms-txt name: llms.txt site index for agents conforms: true evidence: url: https://www.synadia.com/llms.txt status: 200 detail: 528-line, 98KB index of every page, blog post, doc and resource, with descriptions. - id: agentskills-v0.2.0 name: agentskills.io Agent Skills registry v0.2.0 conforms: true evidence: url: https://www.synadia.com/.well-known/agent-skills/index.json status: 200 detail: >- Declares $schema https://agentskills.io/schemas/v0.2.0/index.json and lists 5 fetchable provider-authored skill files plus 2 standards entries. All 5 skills fetched at 200. - id: markdown-content-negotiation name: 'Markdown twins for agents (.md suffix and Accept: text/markdown)' conforms: true evidence: url: https://www.synadia.com/cloud.md status: 200 detail: >- Every page is served as Markdown by appending .md or sending Accept: text/markdown. Synadia advertises this to agents in an HTML comment at the top of every page. Verified on /cloud.md, /security.md, /cloud/sla.md, /legal/support.md and /about.md. - id: oidc name: OpenID Connect (as a managed resource) conforms: partial evidence: detail: >- The Control Plane API manages OIDC providers as first-class resources - 6 operations under /core/beta/oidc-providers, with OidcProviderDefaultsResponse carrying `scopes` and `claims` arrays. Synadia Cloud console sign-in supports OAuth with GitHub or Google and org SSO. qualification: >- This is Synadia CONSUMING OIDC for console/SSO identity, not the Synadia API being protected by OIDC. The API itself is bearer Personal Access Token only. - id: rfc7519-jwt name: RFC 7519 JSON Web Token conforms: true evidence: detail: >- JWT is core to the NATS decentralized security model and appears 298 times in the Control Plane spec - account JWTs, user JWTs, signing keys, JWT expiry limits, and .creds files pairing a JWT with an nkey seed. It is the credential format of the data plane, not of the REST API. - id: oauth2 name: OAuth 2.0 on the API conforms: false evidence: detail: >- Neither OpenAPI declares an oauth2 securityScheme. Control Plane uses http bearer with a Personal Access Token plus a session cookie; the HTTP Gateway uses an apiKey Authorization header. derive-oauth-scopes.py found 0 oauth2 schemes and 0 scopes, so no scopes artifact was written. - id: rfc9457-problem-details name: RFC 9457 Problem Details for HTTP APIs conforms: false evidence: detail: >- No application/problem+json anywhere. The Control Plane declares 400/401/403/404 on all 245 operations with no content block at all; the HTTP Gateway uses a bespoke `Error` schema. - id: rfc9116-security-txt name: RFC 9116 security.txt conforms: false evidence: url: https://www.synadia.com/.well-known/security.txt status: 404 detail: >- 404 on all four Synadia hosts, despite a real published disclosure policy and a monitored security@synadia.com contact at https://www.synadia.com/security. - id: rfc8594-sunset name: RFC 8594 Sunset header / deprecation signalling conforms: false evidence: detail: No Sunset or Deprecation header documented; 0 of 275 operations marked deprecated. - id: rfc9331-ratelimit-headers name: RateLimit header fields for HTTP conforms: false evidence: detail: No RateLimit-*, X-RateLimit-* or Retry-After header, and no 429 status, in either spec. - id: pagination name: Consistent collection pagination conforms: false evidence: detail: >- 3 of 245 Control Plane operations accept `limit`; no cursor, offset, page or Link header convention exists. List endpoints return whole collections in an `items` array. - id: idempotency name: Idempotency keys on unsafe methods conforms: false evidence: detail: No idempotency key header declared or documented on either API. - id: asyncapi name: AsyncAPI event contract conforms: false evidence: detail: >- Notable for a messaging vendor. Synadia has a genuine event surface - alert rules publish to a configurable NATS subject, and the HTTP Gateway exposes KV and object watch endpoints - but publishes no AsyncAPI document anywhere. Code search across the synadia-io org for "asyncapi" returned 0 results. See asyncapi/synadia-communications-event-surface.yml. - id: cloudevents name: CloudEvents conforms: false evidence: detail: No CloudEvents envelope declared in either contract or in the docs. - id: prometheus-exposition name: Prometheus metrics exposition conforms: partial evidence: detail: >- Prometheus appears 13 times in the Control Plane spec as a supported metrics/monitoring integration for NATS systems. It is a platform capability, not a format of the REST API itself. domain_standard: applicable: false note: >- REWARD-ONLY and deliberately left unclaimed. Synadia's market - NATS messaging and connectivity infrastructure - has no regulatory domain standard in scoring.yml, and NATS is itself the wire protocol rather than an implementation of somebody else's. The candidate cross-market standards for this space (AsyncAPI, CloudEvents, MQTT) are not declared in either contract: MQTT and WebSocket appear once each in the Control Plane spec as NATS Server transport capabilities, which is far short of a contract-level declaration. Nothing is invented to fill this slot. compliance: certifications: - name: SOC 2 Type 1 status: achieved source: https://www.synadia.com/blog/synadia-soc2-compliant note: >- Announced via the Synadia blog. No trust center portal, no downloadable report gate, and no SOC 2 Type 2, ISO 27001, PCI or FedRAMP claim was found on any Synadia surface. privacy: - name: Data Processing Addendum url: https://www.synadia.com/legal/dpa - name: Subprocessors list url: https://www.synadia.com/legal/subprocessors status: 200 supply_chain: - name: SBOM url: https://docs.synadia.com/platform/sbom note: Synadia Platform publishes an SBOM section in its documentation. - name: FIPS builds note: >- FIPS-validated builds are offered as a Synadia Platform deployment option, per the provider's own synadia-platform-deployment Agent Skill.