generated: '2026-08-02'
method: derived
source: >-
  Derived from the uShip developer-portal documentation captured in authentication/, conventions/,
  errors/, and asyncapi/ in this repo. No OpenAPI is published, so nothing here is derived from a spec.
standards:
- id: oauth2
  conforms: true
  evidence: >-
    "uShip APIs use the OAuth 2.0 protocol for authentication and authorization" — all four RFC 6749 grant
    types documented (authorization code, implicit, resource owner password credentials, client
    credentials), bearer token type, token endpoint https://api.uship.com/oauth/token.
- id: rfc6749-oauth2-framework
  conforms: true
  evidence: uShip cites RFC 6749 directly in its authentication documentation.
- id: bearer-token-rfc6750
  conforms: true
  evidence: 'Authorization: Bearer {access_token} header documented as required on every authenticated call.'
- id: oidc
  conforms: false
  evidence: >-
    No OpenID Connect discovery document, no id_token, no /.well-known/openid-configuration on any uShip
    host (see well-known/uship-well-known.yml).
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: /.well-known/oauth-authorization-server returns 403 on api.uship.com and is not published.
- id: rest
  conforms: true
  evidence: Resource-oriented URIs under /v2, standard GET/POST/PUT/DELETE verb semantics documented.
- id: hateoas
  conforms: true
  evidence: >-
    Every response carries a `links[]` array of rel/verb/href/title; uShip instructs clients to follow
    links rather than hard-code URIs, and links are permission-gated. Custom link shape, not HAL/Siren.
- id: odata-query-options
  conforms: partial
  evidence: >-
    "We currently support the following oData query string parameters" — $skip and $top for pagination.
    No $filter, $select, $expand, $orderby, no OData metadata document, no OData service root.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a proprietary application/json envelope with an `errors[]` array of
    errorCode/field/developerMessage/documentation/userMessage. No application/problem+json, no `type`
    URI. See errors/uship-problem-types.yml.
- id: iso8601-timestamps
  conforms: true
  evidence: Documented payloads use ISO 8601 UTC timestamps, e.g. "2014-10-15T21:34:50Z".
- id: openapi
  conforms: false
  evidence: >-
    No OpenAPI/Swagger definition is published. Probed /openapi.json, /openapi.yaml, /swagger.json,
    /v1/openapi.json, /api-docs, /docs, /redoc on api.uship.com (all 403) and developer.uship.com (SPA
    HTML shell for every path). The developer portal is invitation-only.
- id: asyncapi
  conforms: false
  evidence: >-
    No AsyncAPI document. A real HTTP-callback webhook surface exists for Published Rates service
    providers — see asyncapi/uship-notifications-webhooks.yml.
- id: graphql
  conforms: false
  evidence: No /graphql surface documented or discoverable.
- id: mcp
  conforms: false
  evidence: No hosted or published Model Context Protocol server found.
- id: a2a
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json probed on www.uship.com (404),
    developer.uship.com (SPA HTML shell — rejected), api.uship.com (403). No agent card.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt is not published on any uShip host.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation policy or Sunset/Deprecation header support documented.
- id: idempotency-key
  conforms: false
  evidence: No idempotency-key header or request-replay contract documented.
- id: llms-txt
  conforms: true
  evidence: >-
    https://www.uship.com/llms.txt is published (HTTP 200, text/plain, 7,216 bytes) with subdomain routing
    guidance for AI assistants. Saved verbatim to llms/uship-llms.txt.
compliance_program:
  published: false
  note: >-
    No trust center, no named certifications (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP), and no
    compliance page were found on trust.uship.com, security.uship.com, or uship.com/security|/compliance.
    No Compliance pointer is emitted.