generated: '2026-09-02'
method: derived
source: graphql/venn-tenant.graphql
note: >-
  Derived from the live GraphQL contract and the OpenID Connect discovery document
  of Venn's identity provider. Venn publishes no compliance page, no trust center
  and no certification claims on any host reachable in this pass, so no
  `Compliance` pointer is emitted in apis.yml. Reward-only checks that do not apply
  are recorded as `conforms: false` with the reason, never as an invented pass.
standards:
  - id: graphql
    conforms: true
    evidence: >-
      GraphQL over HTTPS POST at https://api.venn.city/production/graphql; full
      introspection returns a valid __schema. Apollo Federation gateway.
  - id: graphql-introspection
    conforms: true
    evidence: Anonymous introspection returns 1,991 types.
  - id: relay-cursor-connections
    conforms: true
    evidence: >-
      `<Entity>Connection` types with `edges` and a `pageInfo` carrying
      startCursor/endCursor/hasNextPage/hasPreviousPage; `first`/`last`/`after`/`before`
      arguments on 192-201 query fields.
  - id: opencrud
    conforms: true
    evidence: >-
      Schema is OpenCRUD-shaped (`<Entity>WhereInput`, `<Entity>OrderByInput`,
      `create/update/updateMany/delete/deleteMany<Entity>`), generated by Venn's own
      published `@venncity/opencrud-schema-provider`.
  - id: oauth2
    conforms: true
    evidence: >-
      AWS Cognito user pool eu-central-1_cH7XNjcIx advertises authorization, token
      and revocation endpoints with `code` and `token` response types.
  - id: oidc
    conforms: true
    evidence: >-
      Valid /.well-known/openid-configuration (HTTP 200) with issuer, jwks_uri and
      RS256 id_token signing.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use the GraphQL `errors[]` envelope with `extensions.code`, not
      application/problem+json. Expected for a GraphQL API; recorded for accuracy,
      not as a defect.
  - id: openapi
    conforms: false
    evidence: No OpenAPI or Swagger document is published on any Venn host.
  - id: asyncapi
    conforms: false
    evidence: >-
      No AsyncAPI, no event catalog and no public webhook reference. The schema has
      no subscription type. Venn's release notes mention verifying an inbound payout
      webhook (2026-06-22), i.e. Venn as a webhook consumer, not a publisher.
  - id: json-schema
    conforms: false
    evidence: No JSON Schema documents published.
  - id: scim
    conforms: false
    evidence: No SCIM schema URNs or /scim/v2 surface in the contract.
  - id: odata
    conforms: false
    evidence: No $metadata surface.
  - id: fhir
    conforms: false
    evidence: Not a healthcare API.
  - id: idempotency
    conforms: partial
    evidence: >-
      `idempotencyKey` exists on Notification and SendNotificationToUserParams only —
      one entity out of 468. No API-wide idempotency header. See
      conventions/venn-conventions.yml.
domain_standards:
  sector: multifamily residential real estate / property management software
  probed:
    - id: mits
      name: Multifamily Information and Transactions Standards (RETTC / NMHC)
      conforms: false
      evidence: >-
        No MITS/OSCRE XML message types, namespaces or endpoints appear anywhere in
        the contract or on any Venn host. Venn integrates with the property
        management systems (Yardi, RealPage, Entrata, AppFolio) through each
        vendor's proprietary API rather than through a shared industry message
        format — the release notes name per-vendor sync behaviour and a per-PMS
        "Maintenance Integrations" mapping tab, which is the bilateral-connector
        shape, not the standards shape.
    - id: oscre
      name: OSCRE / Industry Data Model
      conforms: false
      evidence: No OSCRE identifiers or schemas in the contract.
    - id: reso-data-dictionary
      name: RESO Data Dictionary / Web API
      conforms: false
      evidence: >-
        Venn's `RealEstateListing` entity does not use RESO field names or the RESO
        Web API (OData) shape. RESO is residential brokerage/MLS rather than
        multifamily operations, so its absence here is not a gap against Venn's
        market.
  finding: >-
    Venn's market has candidate standards (MITS, OSCRE) but very low adoption, and
    Venn declares none. Recorded as an honest absence — this is a reward-only
    dimension and no conformance is asserted.
compliance:
  published: false
  certifications: []
  trust_center: null
  evidence: >-
    No /security, /trust, /compliance page on venn.city (all 404); no trust center
    host; no certification claims found in the privacy policy or terms reachable at
    venn.city/privacy and venn.city/terms.
x-evidence:
  checked: '2026-09-02'
  evidence:
    - url: https://api.venn.city/production/graphql
      status: 200
    - url: https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_cH7XNjcIx/.well-known/openid-configuration
      status: 200
    - url: https://venn.city/security
      status: 404