generated: '2026-07-28' method: derived source: >- openapi/*.yml, wsdl/*.wsdl, json-schema/us-dot-wzdx-4.2-*.json, well-known/us-dot-faa-catalog-data.json, https://dev.socrata.com/docs/, https://www.faa.gov/web_policies/vulnerability_disclosure_policy, live probes 2026-07-28 summary: >- U.S. DOT conforms to the FEDERAL open-data stack completely and to the modern API standards stack barely at all. Project Open Data / DCAT-US 1.1, CKAN Action API v3, Socrata SODA 2.1, GeoJSON and JSON Schema are all genuinely implemented and verifiable on the wire. OAuth 2.0, OpenID Connect, RFC 9457 problem details, RFC 8594 sunset headers, RFC 9116 security.txt, RFC 8615 well-known discovery, AsyncAPI, JSON:API and RFC 9111 cache directives are all absent. The department is an exemplary open-data publisher and an unremarkable API publisher. standards: - id: openapi-3.0 conforms: true evidence: 'openapi/us-dot-faa-airport-status-web-service-openapi.yml (3.0.1), -aeronautic-product-release- (3.0.1), -air-carrier-prd- (3.0.0), -safety-assurance-system- (3.0.0). Four public FAA OpenAPI 3.0 documents, harvested verbatim from the FAA Gravitee portal catalog.' - id: openapi-3.1 conforms: false evidence: No 3.1 document anywhere in the department. - id: swagger-2.0 conforms: true evidence: 'openapi/us-dot-its-jpo-ode-rest-api-openapi.yml — the ITS JPO Operational Data Environment ships a Swagger 2.0 contract. Also x-original-swagger-version "2.0" on the ASWS document.' - id: wsdl-1.1 conforms: true evidence: 'wsdl/us-dot-fra-datadownload-service.wsdl (30 operations) and wsdl/us-dot-fra-lite-api-service.wsdl (5 operations), retrieved live from safetydata.fra.dot.gov with ?WSDL 2026-07-28. SOAP 1.1/1.2 + HTTP GET/POST bindings.' - id: soap-1.2 conforms: true evidence: FRA Master Web Service declares soap12 bindings in both WSDLs. - id: asyncapi conforms: false evidence: >- No AsyncAPI document is published. asyncapi/us-dot-its-jpo-ode-asyncapi.yml is our derivation from the ODE's own Kafka topic configuration, not a DOT artifact. - id: json-schema-draft-07 conforms: true evidence: 'json-schema/us-dot-wzdx-4.2-*.json — the Work Zone Data Exchange 4.2 schemas published by github.com/usdot-jpo-ode/wzdx.' - id: geojson-rfc7946 conforms: true evidence: 'WZDx RoadEventFeature and WorkZoneFeed are GeoJSON FeatureCollections; Socrata SODA serves .geojson on any spatial resource.' - id: dcat-us-1.1 conforms: true evidence: '/data.json on catalog.data.faa.gov (200, 6 datasets), data.transportation.gov (200, 1,542 datasets) and data.bts.gov (200, 420 datasets), each declaring conformsTo https://project-open-data.cio.gov/v1.1/schema.' - id: project-open-data conforms: true evidence: Same three /data.json documents. This is the OPEN Government Data Act / Evidence Act implementation. - id: ckan-action-api-v3 conforms: true evidence: 'https://catalog.data.faa.gov/api/3/action/status_show reports ckan_version 2.11.4; package_list and package_search answer anonymously.' - id: socrata-soda-2.1 conforms: true evidence: 'Live 200 from /resource/{4x4}.json on datahub.transportation.gov and data.bts.gov, with $select/$where/$order/$limit/$offset SoQL parameters honoured.' - id: oauth2 conforms: false evidence: 'No OpenAPI declares an oauth2 securityScheme. /.well-known/oauth-authorization-server returns 404 on every host. FAA PRD uses raw client_id/client_secret request HEADERS — an OAuth-shaped credential pair without the OAuth protocol.' - id: openid-connect conforms: false evidence: /.well-known/openid-configuration returns 404 on every DOT, BTS and FAA host probed. - id: login-gov conforms: true partial: true evidence: 'The FMCSA QCMobile developer portal (mobile.fmcsa.dot.gov/QCDevsite) requires a Login.gov account to obtain an API key. Login.gov is the federal identity provider and is OIDC-based, but FMCSA exposes no OIDC discovery document to API consumers — the identity layer sits in front of key issuance, not in front of the API.' - id: rfc9457-problem-details conforms: false evidence: 'No surface returns application/problem+json. Three unrelated error envelopes coexist — see errors/us-dot-problem-types.yml.' - id: rfc8594-sunset-header conforms: false evidence: 'No Sunset or Deprecation header observed on any live 200 from external-api.faa.gov (2026-07-28). Deprecation is signalled only in a 404 response DESCRIPTION and in an OpenAPI servers[] label.' - id: rfc9116-security-txt conforms: false evidence: '/.well-known/security.txt returns 404 on every reachable host, despite two live coordinated VDPs. See security/us-dot-vulnerability-disclosure.yml.' - id: rfc8615-well-known conforms: false evidence: 'No RFC 8615 document on any host. What DOT publishes instead is /data.json at the site root — a federal convention, not an IETF one.' - id: json-api conforms: false evidence: No surface uses application/vnd.api+json. - id: odata conforms: false - id: fhir conforms: false applicable: false - id: scim2 conforms: false applicable: false - id: idempotency-key conforms: false evidence: 'No Idempotency-Key parameter in any OpenAPI and none documented. See conventions/us-dot-conventions.yml — the ODE TIM/PDM deposit surface is the real hazard.' - id: http-conditional-requests-rfc9110 conforms: true partial: true evidence: 'Socrata supports ETag / If-None-Match on SODA resources. FAA ASWS explicitly opts out (Cache-Control "max-age=0, no-cache, no-store").' - id: cc0-1.0 conforms: true evidence: 'info.license declares Creative Commons 0 (CC0 1.0) in both public FAA OpenAPI documents (ASWS 1.2.1, APRA 1.4.0).' - id: usgov-public-domain conforms: true evidence: Socrata datasets are licensed USGOV_WORKS (Public Domain U.S. Government). https://www.usa.gov/government-works - id: apache-2.0 conforms: true evidence: github.com/usdot-jpo-ode/jpo-ode and the ITS JPO code estate ship under Apache 2.0. - id: sae-j2735 conforms: true evidence: 'The ITS JPO ODE decodes and re-emits SAE J2735 connected-vehicle messages (BSM, MAP, SPaT, SRM, SSM, TIM, PSM, SDSM, RSM, RTCM) — see asyncapi/us-dot-its-jpo-ode-asyncapi.yml.' - id: wzdx-4.2 conforms: true evidence: 'USDOT authors the Work Zone Data Exchange specification itself; v4.2 released 2023-02-14. json-schema/us-dot-wzdx-4.2-*.json.' - id: asn.1-uper conforms: true evidence: 'ODE asn1_codec encodes/decodes J2735 in ASN.1 UPER; github.com/usdot-jpo-ode/scms-asn1 publishes the SCMS ASN.1 containers.' - id: protobuf3 conforms: true evidence: 'grpc/us-dot-ode-geoRoutedMsg.proto and grpc/us-dot-ode-geoHashRoutedMsg.proto, saved verbatim from github.com/usdot-jpo-ode/jpo-mec-deposit. Message types only — no gRPC service is defined.' - id: mqtt conforms: true evidence: jpo-mec-deposit publishes the protobuf envelopes above to an MQTT broker for multi-access edge computing deposit. - id: tls-1.2-minimum conforms: true evidence: 'security/us-dot-domain-security.yml — TLS 1.2 or 1.3 on every probed host; www.transportation.gov negotiates TLS 1.3.' - id: hsts conforms: true partial: true evidence: 'HSTS max-age 31536000 on data.transportation.gov and data.bts.gov; not observed on www.transportation.gov.' - id: dnssec conforms: true evidence: 'DNSSEC signed on transportation.gov and bts.gov (probed 2026-07-28) — a .gov registry requirement.' - id: dmarc conforms: true evidence: 'DMARC policy p=reject on transportation.gov and bts.gov, per BOD 18-01.' - id: caa conforms: false evidence: No CAA records on transportation.gov or bts.gov. - id: cisa-bod-20-01 conforms: true evidence: >- BOD 20-01 requires every federal civilian agency to publish a vulnerability disclosure policy. DOT publishes one (Bugcrowd-hosted) and FAA publishes a separate one. The directive also calls for a security.txt; that part is not met. - id: cisa-bod-18-01 conforms: true evidence: HTTPS everywhere, HSTS on the data platforms, DMARC p=reject. - id: open-government-data-act conforms: true evidence: 'Machine-readable public data inventory at /data.json on all three platforms; 1,542 + 420 + 6 datasets enumerated, all open-licensed and bulk-exportable.' compliance_program: published: false detail: >- U.S. DOT publishes no API-facing compliance program page, no trust centre, and no third-party certification (no SOC 2, no ISO 27001, no PCI DSS, no FedRAMP authorisation held by DOT itself for these public surfaces). As a federal agency its obligations are statutory (FISMA, the Privacy Act, Section 508, the Evidence Act) rather than certified, and it discloses them through Privacy Impact Assessments and System of Records Notices rather than an audit report. No `Compliance` pointer is emitted for this provider — the standards above are conformance findings, not a published compliance posture, and claiming otherwise would misrepresent it.