generated: '2026-07-27'
method: derived
source:
- openapi/
- well-known/useapi-well-known.yml
- conventions/useapi-conventions.yml
- errors/useapi-problem-types.yml
- https://useapi.net/docs/legal
note: >-
  Standards conformance derived from the captured contracts and probed surfaces, plus the vendor's
  own documentation. useapi.net publishes no compliance program, no certifications and no audit
  reports — it is an explicitly experimental service — so no `Compliance` pointer is emitted.

standards:
- id: rest-http
  conforms: true
  evidence: >-
    JSON over HTTPS with conventional method semantics across 298 operations in twelve captured
    OpenAPI definitions.
- id: openapi-3
  conforms: partial
  evidence: >-
    Two first-party OpenAPI 3.0.2 documents are published on SwaggerHub, but only for the retired
    Midjourney API. The ten current APIs ship Postman v2.1 collections referenced from
    /.well-known/api-catalog; the OpenAPI 3.1 documents in openapi/ for those services are
    API Evangelist derivations of those collections, not vendor-published specs.
- id: postman-collection-v2.1
  conforms: true
  evidence: >-
    Ten first-party collections at https://useapi.net/assets/postman/<service>.json, schema
    https://schema.getpostman.com/json/collection/v2.1.0/collection.json, plus a public workspace at
    https://www.postman.com/useapinet/workspace/useapi-net.
- id: rfc9727-api-catalog
  conforms: true
  evidence: >-
    /.well-known/api-catalog returns application/linkset+json listing all ten APIs with service-desc
    and service-doc links. Captured verbatim at well-known/useapi-api-catalog.json.
- id: rfc9264-linkset
  conforms: true
  evidence: The api-catalog document is a valid linkset with anchor / service-desc / service-doc members.
- id: llms-txt
  conforms: true
  evidence: >-
    https://useapi.net/llms.txt (index) and https://useapi.net/llms-full.txt plus per-service verbatim
    documentation dumps under /assets/aibot/. Regenerated with a UTC timestamp in the header.
- id: rfc6750-bearer-token
  conforms: true
  evidence: 'Authorization: Bearer <token> on every operation; bearerAuth http/bearer securityScheme.'
- id: oauth2
  conforms: false
  evidence: >-
    No OAuth. /.well-known/oauth-authorization-server and /.well-known/openid-configuration both 404.
    Authentication is a single long-lived subscription bearer token with no scopes.
- id: oidc
  conforms: false
  evidence: No OpenID Connect discovery document.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a vendor-specific flat {"error": "...", "code": n} envelope or a verbatim passthrough
    of the wrapped provider's envelope. No application/problem+json anywhere in the documentation.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on both useapi.net and api.useapi.net.
- id: rfc8594-sunset-header
  conforms: false
  evidence: >-
    Retirements are announced as dated notices on the documentation pages, not via Sunset or
    Deprecation response headers.
- id: rfc6585-retry-after
  conforms: true
  evidence: >-
    Every 429 — including useapi.net's own no_eligible_account short-circuit — carries a Retry-After
    header plus a retryAfter ISO-8601 timestamp in the body.
- id: idempotency-key
  conforms: false
  evidence: No idempotency key header or parameter on any endpoint in any collection.
- id: asyncapi
  conforms: false
  evidence: >-
    No AsyncAPI document. The event surface is a single replyUrl HTTP callback on job completion or
    failure; captured at asyncapi/useapi-jobs-webhooks.yml.
- id: webhook-signing
  conforms: false
  evidence: No callback signature header, shared secret or verification scheme is documented.
- id: json-api
  conforms: false
- id: odata
  conforms: false
- id: scim
  conforms: false
- id: fhir
  conforms: false
- id: hsts
  conforms: false
  evidence: 'security/useapi-domain-security.yml: no Strict-Transport-Security header on useapi.net.'
- id: dnssec
  conforms: true
  evidence: 'security/useapi-domain-security.yml: DNSSEC enabled on useapi.net.'
- id: dmarc
  conforms: true
  evidence: 'security/useapi-domain-security.yml: DMARC published with policy p=reject.'
- id: caa
  conforms: false
  evidence: 'security/useapi-domain-security.yml: no CAA records on useapi.net.'

compliance_program:
  published: false
  certifications: []
  trust_center: none
  probed:
  - https://useapi.net/docs/legal
  - trust.useapi.net / security.useapi.net / useapi.net/trust / useapi.net/security (probe-security-programs.py — no hit)
  note: >-
    No SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP or GDPR compliance claim appears anywhere on the
    site. The terms of service instead carry an explicit "Experimental Nature & Disclaimer of
    Warranties" section, and the service's model — automating consumer web accounts on third-party
    AI platforms — is acknowledged in the vendor's own Q&A to run against those platforms' terms of
    service. Buyers should treat this as an unaudited experimental service.