generated: '2026-08-13' method: searched source: >- https://umami.is/security + https://umami.is/pricing + https://docs.umami.is/docs/api + openapi/ + live probes of api.umami.is provider: Umami providerId: umami description: >- Assertions about industry and cross-cutting standards for the Umami API. Every entry carries evidence. `conforms: false` is a measurement, not a criticism — a cookieless analytics API has no business implementing FHIR or PSD2. standards: - id: oauth2 name: OAuth 2.0 conforms: false evidence: >- No authorization server, no token endpoint, no /.well-known/ oauth-authorization-server (404/405 on every host). Umami Cloud issues long-lived API keys created by hand in the dashboard; self-hosted issues a JWT from a username/password login. Neither is OAuth. see: authentication/umami-authentication.yml - id: oidc name: OpenID Connect conforms: false evidence: >- /.well-known/openid-configuration returns 404 on umami.is and cloud.umami.is and 405 on api.umami.is. Umami does not act as an OP. - id: saml name: SAML 2.0 SSO conforms: partial evidence: >- "Single sign on (SAML SSO)" is published as an Enterprise-plan feature on https://umami.is/pricing, and the application exposes /api/auth/sso. No SAML metadata endpoint, IdP list or configuration reference is published, so the claim cannot be verified beyond the pricing table. - id: rfc9457 name: RFC 9457 Problem Details for HTTP APIs conforms: false evidence: >- PROBED — api.umami.is returns application/json, not application/problem+json, with a custom nested envelope {"error":{"message","code","status"}} carrying no type/title/instance. see: errors/umami-problem-types.yml - id: rfc9116 name: RFC 9116 security.txt conforms: false evidence: >- /.well-known/security.txt returns 404 on umami.is, cloud.umami.is and docs.umami.is, and 405 on api.umami.is. A disclosure policy and a security contact DO exist as HTML at https://umami.is/security — only the machine-readable form is missing. see: well-known/umami-well-known.yml - id: rfc8594 name: RFC 8594 Sunset HTTP header conforms: false evidence: >- No Sunset or Deprecation header is documented or observed. Breaking changes are announced in a dated HTML changelog on the day they ship. see: lifecycle/umami-lifecycle.yml - id: rfc9110-rate-limit-headers name: RateLimit header fields for HTTP conforms: false evidence: >- PROBED 2026-08-13 — no RateLimit-*, X-RateLimit-* or Retry-After header on any observed response, despite a documented 50-calls-per-15-seconds limit. see: rate-limits/umami-rate-limits.yml - id: idempotency name: Idempotency keys conforms: false evidence: >- No idempotency header is documented anywhere, including on the unauthenticated collection endpoints POST /api/send and POST /api/batch, where a retry double-counts billable events. see: conventions/umami-conventions.yml - id: pagination name: Consistent pagination conforms: true evidence: >- Uniform page/pageSize request parameters and a uniform {data, count, page, pageSize} response envelope across list endpoints, documented per endpoint in the API reference. Cursors are not offered. see: conventions/umami-conventions.yml - id: openapi name: OpenAPI Specification conforms: false evidence: >- Umami publishes NO OpenAPI document. /openapi.json, /openapi.yaml, /swagger.json and /api-docs were probed on api.umami.is (405), umami.is (404), cloud.umami.is (404) and docs.umami.is (404). The specs in this repo's openapi/ are documentation-generated by API Evangelist and are marked info.x-generated-from: documentation. - id: asyncapi name: AsyncAPI conforms: false evidence: >- No AsyncAPI document and no documented event-delivery surface. A "Streaming API" is listed as a Business-plan feature on the pricing page but has no entry anywhere in docs.umami.is, so its protocol is unknown. Umami documents no webhooks. - id: json-schema name: JSON Schema conforms: false evidence: >- Umami publishes no schemas. The json-schema/ and json-structure/ artifacts in this repo are API Evangelist derivations from the generated OpenAPI. - id: mcp name: Model Context Protocol conforms: false evidence: >- No first-party MCP server. Several third-party Umami MCP servers exist on npm; none is published by umami-software. see: mcp/umami-mcp.yml - id: a2a name: A2A Agent Card conforms: false evidence: >- /.well-known/agent-card.json and /.well-known/agent.json return 404 on umami.is, cloud.umami.is and docs.umami.is, and 405 on api.umami.is. - id: llmstxt name: llms.txt conforms: partial evidence: >- PROBED — https://docs.umami.is/llms.txt returns 404, but https://docs.umami.is/llms-full.txt returns 200 with the complete documentation corpus (~350KB) rendered as clean markdown. The full variant is served without the index variant that is supposed to point at it, so an agent following the convention finds nothing. - id: gdpr name: GDPR conforms: claimed evidence: >- "Umami is fully GDPR and CCPA compliant" (pricing FAQ). Cookieless, no PII collected by default, no cross-site tracking, EU data region available, and a publicly available Data Processing Agreement at https://umami.is/dpa. Self-asserted; no third-party attestation. - id: ccpa name: CCPA conforms: claimed evidence: Same statement and same basis as GDPR above. - id: soc2 name: SOC 2 conforms: false evidence: >- Umami states explicitly on https://umami.is/security: "SOC 2 — Not currently certified." - id: iso27001 name: ISO/IEC 27001 conforms: false evidence: >- Umami states explicitly on https://umami.is/security: "ISO 27001 — Not currently certified." - id: pci-dss name: PCI DSS conforms: delegated evidence: >- Payments processed by Stripe; Umami states it does not directly store complete card numbers or security codes. - id: pentest name: Independent penetration test conforms: false evidence: >- "Independent penetration test — Not yet completed" (https://umami.is/security). Umami states it is evaluating both formal compliance programs and a third-party pentest as its enterprise base grows. - id: fhir name: HL7 FHIR conforms: false evidence: Not applicable — web analytics, not healthcare. - id: psd2 name: PSD2 / Open Banking conforms: false evidence: Not applicable — no payment initiation or account information surface. - id: scim name: SCIM conforms: false evidence: >- No SCIM endpoint. User and team provisioning is through Umami's own /api/users and /api/teams routes, and on Umami Cloud API keys are barred from /users and /users/* entirely, so programmatic user provisioning is not available on Cloud at all. - id: odata name: OData conforms: false evidence: Not implemented. - id: jsonapi name: 'JSON:API' conforms: false evidence: >- Plain JSON with a custom list envelope; no JSON:API media type, no relationships/included document structure. summary: conforming: [pagination] claimed: [gdpr, ccpa] partial: [saml, llmstxt] delegated: [pci-dss] not_conforming: - oauth2 - oidc - rfc9457 - rfc9116 - rfc8594 - rfc9110-rate-limit-headers - idempotency - openapi - asyncapi - json-schema - mcp - a2a - soc2 - iso27001 - pentest - scim - odata - jsonapi not_applicable: [fhir, psd2] maintainers: - FN: Kin Lane email: kin@apievangelist.com