generated: '2026-08-12'
method: derived
source: >-
  openapi/vaynermedia-wordpress-content-openapi.json +
  discovery/vaynermedia-wp-json-route-index.json + live probes (2026-08-12)
summary: >-
  Assertions about which cross-cutting standards the VaynerMedia content API does and does
  not conform to. Every "conforms: true" below is backed by an observed response; every
  false is an absence that was actually probed. No compliance certification, audit report or
  trust program was found, so this file carries NO `type: Compliance` pointer.

standards:
- id: rest
  conforms: true
  evidence: >-
    Resource-oriented collections and items under /wp-json/wp/v2/, correct GET semantics,
    JSON representations, HTTP status codes used conventionally (200/400/401/403/404).

- id: rfc8288-web-linking
  conforms: true
  evidence: >-
    Collection responses carry a Link header with rel="next" / rel="prev", e.g.
    '<https://vaynermedia.com/wp-json/wp/v2/posts?per_page=1&page=2>; rel="next"'.

- id: pagination
  conforms: true
  evidence: >-
    page + per_page + offset query parameters on every collection, with X-WP-Total and
    X-WP-TotalPages response headers and a 1-100 per_page bound enforced with HTTP 400.

- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use the WordPress WP_Error envelope ({code, message, data.status}) with
    Content-Type application/json, not application/problem+json. See
    errors/vaynermedia-problem-types.yml.

- id: idempotency
  conforms: false
  evidence: >-
    No idempotency key header is accepted or documented. The anonymous surface is read-only,
    so unsafe methods are not reachable without credentials.

- id: oauth2
  conforms: false
  evidence: >-
    /.well-known/oauth-authorization-server returned 404 on vaynermedia.com. The only
    advertised authentication mechanism is WordPress Application Passwords over HTTP Basic.

- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returned 404 on vaynermedia.com.

- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returned 404 on vaynermedia.com and on vaynerx.com.

- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header observed on any response; no deprecation policy published.

- id: rfc9309-robots
  conforms: true
  evidence: >-
    https://vaynermedia.com/robots.txt returns 200 with "User-agent: * / Disallow:" and
    "Crawl-delay: 10", plus a Sitemap directive pointing at sitemap_index.xml.

- id: llms-txt
  conforms: true
  evidence: >-
    https://vaynermedia.com/llms.txt returns 200 text/plain in llms.txt format (H1 title,
    blockquote summary, sectioned link lists). Generated by Yoast SEO v28.2. Saved verbatim
    at llms/vaynermedia-llms.txt.

- id: openapi
  conforms: false
  evidence: >-
    VaynerMedia publishes no OpenAPI. /openapi.json, /swagger.json, /api-docs and /docs all
    404 on vaynermedia.com. The OpenAPI in this repo is DERIVED by API Evangelist from the
    provider's own /wp-json/ route index, and is labelled as such in info.description.

- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is published. Not applicable to a marketing-site content API.

- id: a2a-agent-card
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json both returned 404 on vaynermedia.com and vaynerx.com.

- id: mcp
  conforms: false
  evidence: >-
    POST tools/list to https://vaynermedia.com/mcp and https://vaynermedia.com/api/mcp
    returned 404; mcp.vaynermedia.com does not resolve.

- id: cors
  conforms: true
  evidence: >-
    Access-Control-Allow-Headers and Access-Control-Expose-Headers are set on API responses,
    exposing X-WP-Total, X-WP-TotalPages and Link to browser clients.

certifications:
  found: []
  probes:
  - url: https://vaynermedia.com/.well-known/security.txt
    status: 404
  - url: https://trust.vaynermedia.com/
    status: 000
    note: DNS does not resolve.
  note: >-
    No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim was found on any VaynerMedia
    property. The site does publish UK Modern Slavery Act and copyright policy statements
    (https://vaynermedia.com/modern-slavery-act/, https://vaynermedia.com/copyright-policy/),
    which are corporate legal disclosures, not security or API compliance programs — they are
    not recorded as certifications and earn no Compliance pointer.