generated: '2026-07-21'
method: derived
source: openapi/worders-api-openapi-original.yml
standards:
  - id: openapi-3.0
    conforms: true
    evidence: Published spec at https://api.worders.net/api-docs/v1/swagger.yaml declares openapi 3.0.1 (served via rswag Swagger UI at /api-docs/index.html).
  - id: oauth2
    conforms: false
    evidence: securitySchemes are apiKey (Devise session cookie) and http bearer service keys; no oauth2 flows declared.
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration is not served on worders.net or api.worders.net.
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors use a custom `{error:{code,message,details}}` JSON envelope, not application/problem+json.
  - id: pagination
    conforms: true
    evidence: List endpoints take page/per_page params and return a PaginationMeta (total/page/per_page) block.
  - id: idempotency
    conforms: false
    evidence: No idempotency-key contract documented on the write operations.
  - id: json:api
    conforms: false
    evidence: Plain JSON resource shapes; no JSON:API media type.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 (www.worders.net) / redirects to the homepage (api.worders.net).
notes: >-
  Derived from the harvested OpenAPI and live well-known probes. No published
  compliance program (SOC 2 / ISO 27001 / GDPR page) was found, so no
  Compliance pointer is emitted.