generated: '2026-08-09'
method: derived
source: openapi/webscraping-ai-openapi.yml + https://webscraping.ai/docs
description: >-
  Which cross-cutting standards the WebScraping.AI surface actually conforms to, asserted only
  where there is evidence in the published spec, the live discovery documents, or the docs.
standards:
- id: openapi-3.1
  conforms: true
  evidence: >-
    openapi/webscraping-ai-openapi.yml declares openapi 3.1.0 and is published by the provider
    at https://webscraping.ai/openapi.yml
- id: oauth2
  conforms: true
  evidence: >-
    RFC 6749 authorization-code flow published at
    https://webscraping.ai/.well-known/oauth-authorization-server for the hosted MCP server.
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: 200 at /.well-known/oauth-authorization-server with issuer, authorization_endpoint,
    token_endpoint, revocation_endpoint
- id: rfc9728-oauth-protected-resource-metadata
  conforms: true
  evidence: >-
    200 at /.well-known/oauth-protected-resource naming https://mcp.webscraping.ai/mcp, and the
    401 from the MCP endpoint carries `WWW-Authenticate: Bearer resource_metadata="..."`.
- id: rfc7591-dynamic-client-registration
  conforms: true
  evidence: registration_endpoint https://webscraping.ai/oauth/register advertised in the
    authorization-server metadata
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported [S256]
- id: rfc7009-token-revocation
  conforms: true
  evidence: revocation_endpoint https://webscraping.ai/oauth/revoke
- id: model-context-protocol
  conforms: true
  evidence: >-
    Hosted Streamable HTTP MCP server at https://mcp.webscraping.ai/mcp plus an open-source
    stdio server published to npm and registered as io.github.webscraping-ai/webscraping-ai
    against the MCP server.schema.json (2025-12-11).
- id: rfc9110-safe-idempotent-methods
  conforms: true
  evidence: all seven published operations are GET; no state-changing operation exists
- id: openidconnect
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on every host
- id: rfc9457-problem-details
  conforms: false
  evidence: errors are application/json with a flat {message,status_code,status_message,body}
    envelope, not application/problem+json
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on webscraping.ai and api.webscraping.ai
- id: rfc8594-sunset-header
  conforms: false
  evidence: no deprecation or sunset policy and no Sunset/Deprecation header documented
- id: rfc9457-ratelimit-headers
  conforms: false
  evidence: no RateLimit-*/X-RateLimit-* headers and no Retry-After; concurrency headroom is
    only readable from GET /account
- id: a2a
  conforms: false
  evidence: no agent card at /.well-known/agent-card.json or /.well-known/agent.json on any host
- id: asyncapi
  conforms: false
  evidence: no event, streaming or webhook surface is published; the API is synchronous
    request/response only
- id: json-api
  conforms: false
  evidence: responses are plain HTML, text or bespoke JSON objects
- id: idempotency-key
  conforms: false
  evidence: no Idempotency-Key header; not required, since every operation is a GET
compliance_program:
  published: false
  certifications: []
  trust_center: null
  detail: >-
    No SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim was found, and no trust center exists
    at trust.webscraping.ai, security.webscraping.ai, /trust, /security or /compliance. The
    provider publishes a Privacy Policy and Terms of Service only. No `Compliance` pointer is
    emitted, because none is earned.
x-evidence:
  fetched: '2026-08-09'
  probes:
  - {url: 'https://webscraping.ai/openapi.yml', http_status: 200}
  - {url: 'https://webscraping.ai/.well-known/oauth-authorization-server', http_status: 200}
  - {url: 'https://webscraping.ai/.well-known/oauth-protected-resource', http_status: 200}
  - {url: 'https://webscraping.ai/.well-known/openid-configuration', http_status: 404}
  - {url: 'https://webscraping.ai/.well-known/security.txt', http_status: 404}
  - {url: 'https://webscraping.ai/.well-known/agent-card.json', http_status: 404}
  - {url: 'https://mcp.webscraping.ai/mcp', http_status: 401}