generated: '2026-09-04'
method: searched
source: >-
  https://www.webscale.com/security/, https://www.webscale.com/sla/,
  openapi/webscale-networks-webscale-apis-openapi.json
name: Webscale Networks conformance and compliance
api: Webscale APIs

certifications:
- id: soc2-type2
  name: SOC 2 Type 2
  conforms: true
  evidence: >-
    https://www.webscale.com/security/ — "Webscale has earned SOC 2 Type 2 compliance certification",
    described on the same page as "a rigorous and respected third party audit".
  method: searched
  scope: company/platform
  report_available: via trust center (access-controlled)
  trust_center: https://app.drata.com/trust/9cbdd8e2-0c38-11ee-865f-029d78a187d9/workspace/2

conformance:
- id: rest
  conforms: true
  evidence: >-
    OpenAPI info.description states the API "is designed to be RESTful" and documents collection/item
    addressing with a self-referencing `href` attribute on every addressable resource. Verified in
    openapi/webscale-networks-webscale-apis-openapi.json.
- id: openapi
  conforms: true
  version: 3.0.3
  evidence: >-
    https://control.webscale.com/docs/openapi.json — a 613KB OpenAPI 3.0.3 document, 157 paths, 151
    operations, 530 component schemas, served publicly and unauthenticated from the provider's own
    control-console host.
- id: bearer-token-rfc7235
  conforms: true
  evidence: >-
    components.securitySchemes.access_key is `type: http, scheme: Bearer` and its description cites
    RFC 7235 section 5.1 by URL.
- id: rfc9457
  conforms: false
  evidence: >-
    The error envelope is a bespoke {type, description} object, not application/problem+json. No
    problem-details media type appears anywhere in the contract.
- id: oauth2
  conforms: false
  evidence: No oauth2 or openIdConnect securityScheme is declared; a single HTTP bearer scheme is applied globally.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on webscale.com, api.webscale.com and docs.webscale.com.
- id: idempotency
  conforms: false
  evidence: >-
    Zero occurrences of "idempoten" in the contract; no Idempotency-Key header on any of the 74
    mutating operations. See conventions/webscale-networks-conventions.yml.
- id: pagination
  conforms: true
  style: offset
  evidence: >-
    Reusable components.parameters `start` (default 1) and `limit` (default 100) applied across
    collection operations.
- id: json-api
  conforms: false
  evidence: Responses are plain JSON objects; no application/vnd.api+json media type or JSON:API document structure.
- id: rfc8594-sunset
  conforms: false
  evidence: No Sunset or Deprecation header is declared or documented.

domain_standard:
  market: ecommerce infrastructure / application delivery
  declared_in_contract: false
  finding: >-
    NO domain standard is declared by this contract. Webscale's own vocabulary — applications, web
    controls, clusters, address sets, URL maps, blueprints, stacks, data planes — is entirely
    proprietary. This is expected and NOT a penalty: the application-delivery and managed-hosting
    market has no adopted machine-readable interchange standard the way SCIM, FHIR, OData or ISO 20022
    serve theirs. There is no standard here to conform to, so none is claimed.
  probed_for:
  - name: OpenTelemetry / OpenMetrics
    result: absent
    note: >-
      Checked because the contract carries a substantial metrics surface (metric prototypes,
      /metrics endpoints on applications, address-sets and clusters, with groupby/summarize/resolution
      aggregation). The metric model is proprietary; no OTLP endpoint, OpenMetrics exposition format,
      or Prometheus scrape contract is declared. Note the company DOES ship a Prometheus Varnish
      exporter at github.com/section-io/prometheus_varnish_exporter, but that is a fork of an
      upstream project, not a conformance claim on the Webscale API.
  - name: CloudEvents
    result: absent
    note: >-
      Checked because of the EventStream product line and the `servers_update_webhook` cluster field.
      The webhook posts a cluster representation, not a CloudEvents envelope; no ce-* headers or
      datacontenttype are declared.
  - name: SCIM
    result: absent
    note: >-
      Checked because the contract has a full identity surface (users, groups, roles, invitations,
      service users, access keys). No urn:ietf:params:scim:schemas:* URN appears; the user/group/role
      model is bespoke.

not_claimed:
  note: >-
    Frameworks NOT found published by Webscale and therefore NOT asserted here — ISO 27001, PCI DSS,
    HIPAA, FedRAMP, CSA STAR. Only SOC 2 Type 2 is stated on the company's own security page. Absence
    of a claim is not absence of a control; it is absence of a published claim.