{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:f94358e3c57b6e575ca58c8031b9b7552cbfdb411f937b8ecdc3b042c4980a77", "snapshot_id": "sha256:0679a3f0d41c0733e76d10ab3fb1b331811893c7d428749740ec0f21ac731d3e", "artifact_sha256": "sha256:7472396c2449279d33e7a0fb2426f02a89991501262d1db8c04c81d57bdf9021", "data": { "entity_id": "ent_01kyh8fpe4qj5yt6msnarsc8kz", "entity_slug": "openai", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xe2b7nt9w4r6dh1q8c", "entity_id": "ent_01kyh8fpe4qj5yt6msnarsc8kz", "scope": { "product": { "key": "openai-api", "name": "OpenAI API" }, "funnel": { "key": "api-service-lifecycle", "name": "API service lifecycle" } }, "catalog_binding": { "base_release_id": "sha256:cad9f851ab1bb553246eb2fb2b2803a4741814a33ccf28997014247439b9013d", "entity_revision_digest": "sha256:9dbff8fedbd20ce0405507b4e12de62cdc7f7adbd19a8a02640e8ea00362d85e" }, "declaration_revision_digest": "sha256:d018f9b150c5f0276e00bd477a111d2da2f6a80ae9581f7cecdf77af334e9f57", "declaration": { "declaration_id": "declaration_openai_api_service_lifecycle", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "62b512f0c49352e55a399ba53866a5effa431d71", "path": "vendors/op/openai.yaml", "git_blob_oid": "ebaeb28ba1b450c6e5b68c5994ec1f50653dfef5", "blob_digest": "sha256:4932510872ae0324255743a131a48659787fc46fbb91b83fafb9bda8040114d1" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Submit Responses API requests and receive model output", "interface_ids": [ "api-service" ] } ], "participants": [ { "participant_id": "openai", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyh8fpe4qj5yt6msnarsc8kz" } } ], "resources": [ { "resource_id": "api-errors", "uri": "https://developers.openai.com/api/docs/guides/error-codes", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "api-reference", "uri": "https://developers.openai.com/api/reference/overview", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "billing-support", "uri": "https://help.openai.com/en/collections/3675945-understanding-openai-api-billing-usage", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "platform-signup", "uri": "https://platform.openai.com/signup", "roles": [ "access" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "prepaid-billing", "uri": "https://help.openai.com/en/articles/8264644-how-can-i-set-up-prepaid-billing", "roles": [ "checkout", "documentation", "pricing" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://developers.openai.com/api/docs/pricing.md", "roles": [ "pricing" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "quickstart", "uri": "https://developers.openai.com/api/docs/quickstart", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "rate-limits", "uri": "https://developers.openai.com/api/docs/guides/rate-limits", "roles": [ "documentation", "operations", "status" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c", "uri": "https://help.openai.com/en/articles/4936850-best-practices-for-api-key-safety", "roles": [ "authentication", "documentation" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "responses-guide", "uri": "https://developers.openai.com/api/docs/guides/migrate-to-responses.md", "roles": [ "documentation", "provisioning", "status" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://openai.com/policies/services-agreement/", "roles": [ "terms" ], "operated_by_participant_id": "openai", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "registration", "uri": "https://platform.openai.com/signup", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "endpoint_id": "responses-api", "uri": "https://api.openai.com/v1/responses", "transport": "http", "roles": [ "service" ], "operated_by_participant_id": "openai", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "api-reference", "quickstart" ], "operated_by_participant_id": "openai", "standard_bindings": [] }, { "interface_id": "api-service", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "responses-api" ], "resource_ids": [ "api-errors", "api-reference", "quickstart", "rate-limits", "responses-guide" ], "operated_by_participant_id": "openai", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "api-service" } }, { "relation_id": "errors-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-errors" }, "to": { "node_kind": "interface", "node_id": "api-service" } }, { "relation_id": "reference-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-reference" }, "to": { "node_kind": "interface", "node_id": "api-service" } }, { "relation_id": "relation-describes-11bdd29edd85e9d60a95b586c2db646cdf514d60dd5f2c97cbf0b2979b5fa8f6", "kind": "describes", "from": { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } }, { "relation_id": "responses-guide-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "responses-guide" }, "to": { "node_kind": "interface", "node_id": "api-service" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "platform-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-08-20T14:33:24.000Z", "revision_digest": "sha256:198cbb94fffe1d68ae0902656a9832352041089f1afe3da29fed8ec0ff803def", "policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "policy_version": "service-use-2026-08-20-public-evidence-r9", "policy_as_of": "2026-08-20T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "constrained", "public_state": "limited", "state_label": "Limited", "grade": "C+", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect actual Blocked stages by lifecycle severity.", "coverage_rule": "Every core graded metric must have supported, fresh, non-conflicting evidence. Barrier checks constrain the report when verified and cap an otherwise higher grade at B+ while unverified.", "outcome_rule": "Each stage takes its worst core metric or verified barrier, and the overall grade is derived from the five stage states plus the explicit unverified-barrier cap." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "sign_up", "stage_label": "Sign up", "public_state": "limited", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "First-party documentation explicitly declares machine credentials (API keys and service accounts) created and managed on the API key page, but full secret keys must be manually copied upon creation." } }, "limitations": [ { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "First-party documentation explicitly declares machine credentials (API keys and service accounts) created and managed on the API key page, but full secret keys must be manually copied upon creation." }, "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "OpenAI documents purchased-credit expiry, non-refundability, configurable recharge controls, and balance behavior, but the retained evidence does not disclose exact rates, currency, or the charge amount before authorization." }, "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "stage": "provision", "stage_label": "Provision", "finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "OpenAI API keys are created in the API key page or dashboard, where the full secret key is shown only upon creation and must be saved or exported manually." }, "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Documentation covers API error codes (such as 401, 429, 500, and 503), rate limits, and recommends exponential backoff retry strategies respecting Retry-After headers. Full idempotency, cancellation, and reconciliation contracts for all failure modes are not completely detailed." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Documentation states users can create and manage API keys on the API key page, and if a full secret key is lost, create a new key and update the application, representing a partially manual key lifecycle without documenting programmatic rotation or compromise recovery." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The service entrypoints and direct HTTP/REST API endpoints, authentication mechanisms, and request options are publicly documented in the API Reference Overview." }, "secondary_context": [ { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "The OpenAI Services Agreement is publicly accessible, readable, and defines terms governing APIs, ChatGPT Enterprise, data use, security, and customer obligations." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "OpenAI explicitly defines material eligibility conditions: the customer must represent that it is lawfully able to enter into the agreement and has authority to bind the entity. Customer and End Users must not be located in U.S. embargoed countries or identified on any Restricted Party List." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Prepaid billing documentation explains how API users pre-purchase usage deducted from prepaid credits, configure auto recharge, set recharge amounts and limits, and notes credit expiration (1 year) and non-refundability." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:21.304Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a8a93206e21223da24fc68dce84142d9610d4462bb666c115e3cd9cc2af7df1f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2ab341b4620c7af83e56589add944a9e19d36915fa6cb8da9b1a94419d623975", "sha256:2d2c908faaa4dd0e20d0991b38b694507d500b8da613f3826650c79e106a3449", "sha256:2e74b5b693c44ae532b11a79a1e5bc619cddae189c3df80a0fbd0cdd0b3d0bcd", "sha256:2fca099f02d410f3bf234540cca1341a6c6d718a37b7c172d2acbb9945073de7" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:2e74b5b693c44ae532b11a79a1e5bc619cddae189c3df80a0fbd0cdd0b3d0bcd", "start_byte": 36731, "end_byte": 37533, "value_digest": "sha256:3531e7044f7f2c1c4c7b487737f03676726647b9b8f91a900a44fbbdc246ee91" }, { "artifact_digest": "sha256:2e74b5b693c44ae532b11a79a1e5bc619cddae189c3df80a0fbd0cdd0b3d0bcd", "start_byte": 6315, "end_byte": 7137, "value_digest": "sha256:3ab9829d5c2226bc1cef78d65ec7ea439bb3dfe2109b253a1e674cf040b3a28f" } ] } ], "note": "OpenAI explicitly defines material eligibility conditions: the customer must represent that it is lawfully able to enter into the agreement and has authority to bind the entity. Customer and End Users must not be located in U.S. embargoed countries or identified on any Restricted Party List." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:12.265Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "prepaid-billing" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5153c22af100337bef385c3a3acbd956c33f78bf750f55c41aa8135afa20f884", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:0f0e0370fc738aa4f461c16326bc3c4f41e3ce992b8a0e1c20f105cbf69cd8be", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:503583177e1d34edec24f30bff440a74cd91700da9e4e10b147192ce6758a885", "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "sha256:9ef1e88111d56c06682aab45b536c74dbd0b61dc18ca535d70ffc4a7174a1115", "sha256:c6a3d6057e4e1b7990d3a2dd21073df6777c7179ba23e3a956f63f73e84b0b70" ], "source_surface": { "node_kind": "resource", "node_id": "prepaid-billing" }, "locators": [ { "artifact_digest": "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "start_byte": 1108, "end_byte": 1907, "value_digest": "sha256:f3c647556c9d8995876d8b7c568b9adfdef6889731616ce2b4b01e788af07291" }, { "artifact_digest": "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "start_byte": 1908, "end_byte": 2710, "value_digest": "sha256:4908645a5c6afa34928b65061891ef425741a38b4788245a914595ad7fd4e7c0" } ] } ], "note": "Prepaid billing documentation explains how API users pre-purchase usage deducted from prepaid credits, configure auto recharge, set recharge amounts and limits, and notes credit expiration (1 year) and non-refundability." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:59.255Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d68b309479d5a9b702dc5e6182c1d3ef4d84d1b1b1f6292df922ca8704f7a7ef", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:71da11c280d8403cb6db8292417a4b56b6774ac9baf00c2dc45583688819f6e2", "sha256:d3ce31afc57f8aeb5387d65a0dd740fd82beef780cb24be06013286a52a2674a", "sha256:f0f02e2b43ed153a6cb948aed4b235727b732c0c4fa50692a329137e54131111" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:f0f02e2b43ed153a6cb948aed4b235727b732c0c4fa50692a329137e54131111", "start_byte": 42464, "end_byte": 43259, "value_digest": "sha256:2620fa9c77e102577175bd427bd098ae36a04984b52388861109c9e9682ed5de" }, { "artifact_digest": "sha256:f0f02e2b43ed153a6cb948aed4b235727b732c0c4fa50692a329137e54131111", "start_byte": 44063, "end_byte": 44860, "value_digest": "sha256:96a8472d67473e8fce107c99f557cb9d61eebea08cf8b1854e7679e7f8b5809d" } ] } ], "note": "The service entrypoints and direct HTTP/REST API endpoints, authentication mechanisms, and request options are publicly documented in the API Reference Overview." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "terms_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:21.304Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a8a93206e21223da24fc68dce84142d9610d4462bb666c115e3cd9cc2af7df1f", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2d2c908faaa4dd0e20d0991b38b694507d500b8da613f3826650c79e106a3449", "sha256:2e74b5b693c44ae532b11a79a1e5bc619cddae189c3df80a0fbd0cdd0b3d0bcd", "sha256:2fca099f02d410f3bf234540cca1341a6c6d718a37b7c172d2acbb9945073de7", "sha256:b57fc273b80b5ac85ad097765a3aa91dd93bd87c5dac5d57c068f635afdba009" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:2e74b5b693c44ae532b11a79a1e5bc619cddae189c3df80a0fbd0cdd0b3d0bcd", "start_byte": 33532, "end_byte": 34325, "value_digest": "sha256:3919891c575c6fa07a6f6c503c99540d1cb0edd66f99aa23123cbef7691aa40f" }, { "artifact_digest": "sha256:2e74b5b693c44ae532b11a79a1e5bc619cddae189c3df80a0fbd0cdd0b3d0bcd", "start_byte": 5513, "end_byte": 6314, "value_digest": "sha256:3154a6a41cdd51f7beb4aba88c7d968536bd0fd532bc7f609c56fdbdb11142ed" } ] } ], "note": "The OpenAI Services Agreement is publicly accessible, readable, and defines terms governing APIs, ChatGPT Enterprise, data use, security, and customer obligations." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "context": "First-party documentation explicitly declares machine credentials (API keys and service accounts) created and managed on the API key page, but full secret keys must be manually copied upon creation." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained capture from platform.openai.com/signup contains only basic page title metadata and an unrendered application header ('OpenAI Platform'), which does not show or describe operable access controls or safe handoffs." }, { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured evidence for platform.openai.com/signup contains minimal unrendered page content ('OpenAI Platform') and does not explicitly declare or observe the presence or absence of a CAPTCHA boundary." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured evidence for platform.openai.com/signup contains minimal unrendered page content and does not explicitly state whether phone verification is required, absent, or resumable." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "The canonical URL https://platform.openai.com/signup serves as the stable direct observation entry point for OpenAI Platform signup." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:13.094Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The retained capture from platform.openai.com/signup contains only basic page title metadata and an unrendered application header ('OpenAI Platform'), which does not show or describe operable access controls or safe handoffs." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:13.094Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "platform-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:3036bf108edd4810233ec7489d2862660a9aa91cb023b69dd58b878b9d00e260", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:3878570f4a62a0d65f57cf1754e0269e56ec797f4e36e26b44c172eb6e800401", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:78cc00db17d4805d92a71310d80eb8155772ae58b66ce66b42cb4eeeb6de44ec", "sha256:854b70617a0d34135baf59a85c78c6250a563a0910b69f5575662c37bdc8d7e4", "sha256:93eec781c7fc78cbbad864fe0c4a356cf8f277d531346d7fa2f70cd0b22a6efe", "sha256:a7463fe1fdb37bc2ea6cd9cd53fc9b4c4041e444cb9d97623eb92265c2a22d8f" ], "locators": [ { "artifact_digest": "sha256:93eec781c7fc78cbbad864fe0c4a356cf8f277d531346d7fa2f70cd0b22a6efe", "start_byte": 0, "end_byte": 437, "value_digest": "sha256:3697a3ae04070f7399a27c1d8a920a8df6ce480949a3ec52273325db63cefa1c" }, { "artifact_digest": "sha256:93eec781c7fc78cbbad864fe0c4a356cf8f277d531346d7fa2f70cd0b22a6efe", "start_byte": 439, "end_byte": 464, "value_digest": "sha256:30aebd478b92c92199ab910559a7b3547ef521a56f0b9b3fafd57e9e2c4df3b6" } ] } ], "note": "The canonical URL https://platform.openai.com/signup serves as the stable direct observation entry point for OpenAI Platform signup." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:13.094Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "platform-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The captured evidence for platform.openai.com/signup contains minimal unrendered page content ('OpenAI Platform') and does not explicitly declare or observe the presence or absence of a CAPTCHA boundary." }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.051Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "quickstart" }, { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b40fe9ec31ac38b02bffdfa1a22b7e9969c0b847fb3b85a3311086e9fad690e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1eb0dd41c63e9cd11be46eea21d8f9cc62ed7955d2fdb3c7df13ca115c5cbb83", "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a58df9d04cf663da1b4c717dcc4be160d7e9c316df74555eb2c5048c22381404" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" }, "locators": [ { "artifact_digest": "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "start_byte": 1054, "end_byte": 1695, "value_digest": "sha256:12e48bcc11539046549be56a08c8a5eb445263c0ccf996e07b37d56897d1c062" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:004500d6302de39df21f63b04d0c568db0ec772343f817ee8221739dac7a0577", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:96d840692bdb98b254777bdb0858e0be3b9f0100a1030566598c165b24933f86", "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "sha256:c88e95ea21bcd58d04b7ac4ea2b54cfe25a1c5bf6672921d7f43ae97d8ae4278" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "start_byte": 31959, "end_byte": 32759, "value_digest": "sha256:78e06a16527efff4d6eb861aad27e9ab0567ad6cd32b93c39587e24b2428b590" } ] } ], "note": "First-party documentation explicitly declares machine credentials (API keys and service accounts) created and managed on the API key page, but full secret keys must be manually copied upon creation.", "remediation": { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:13.094Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "platform-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The captured evidence for platform.openai.com/signup contains minimal unrendered page content and does not explicitly state whether phone verification is required, absent, or resumable." } ], "blockers": [], "remediations": [ { "signal_code": "delegated_identity_access", "code": "improve.sign_up.delegated_identity_access", "instruction": "Provide scoped delegated authorization with consent, revocation, and deterministic resumption." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "OpenAI documents purchased-credit expiry, non-refundability, configurable recharge controls, and balance behavior, but the retained evidence does not disclose exact rates, currency, or the charge amount before authorization." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The evidence outlines setting up prepaid billing and configuring auto recharge in account settings, but does not document a programmatic flow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The evidence mentions configuring auto recharge, thresholds, and manual credit purchases, but it does not document a rail for scoped agent delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "OpenAI documentation details a direct self-service path to purchase prepaid API credits by going to billing overview in account settings or using the Add to balance button in the billing portal without vendor approval." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:12.265Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "prepaid-billing" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The evidence outlines setting up prepaid billing and configuring auto recharge in account settings, but does not document a programmatic flow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:12.265Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "prepaid-billing" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5153c22af100337bef385c3a3acbd956c33f78bf750f55c41aa8135afa20f884", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:0f0e0370fc738aa4f461c16326bc3c4f41e3ce992b8a0e1c20f105cbf69cd8be", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:503583177e1d34edec24f30bff440a74cd91700da9e4e10b147192ce6758a885", "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "sha256:9ef1e88111d56c06682aab45b536c74dbd0b61dc18ca535d70ffc4a7174a1115", "sha256:a945cf769e3337f3c34b3bb2a261bb09fd82182240e14d0a687c332c28073724" ], "source_surface": { "node_kind": "resource", "node_id": "prepaid-billing" }, "locators": [ { "artifact_digest": "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "start_byte": 1908, "end_byte": 2710, "value_digest": "sha256:4908645a5c6afa34928b65061891ef425741a38b4788245a914595ad7fd4e7c0" } ] } ], "note": "OpenAI documents purchased-credit expiry, non-refundability, configurable recharge controls, and balance behavior, but the retained evidence does not disclose exact rates, currency, or the charge amount before authorization.", "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:12.265Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "prepaid-billing" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The evidence mentions configuring auto recharge, thresholds, and manual credit purchases, but it does not document a rail for scoped agent delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:12.265Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "prepaid-billing" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5153c22af100337bef385c3a3acbd956c33f78bf750f55c41aa8135afa20f884", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:0f0e0370fc738aa4f461c16326bc3c4f41e3ce992b8a0e1c20f105cbf69cd8be", "sha256:467f87bc4d02f68a97e823f30c870128c9a84c3a75d6f5576aa8f90906d608d3", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:503583177e1d34edec24f30bff440a74cd91700da9e4e10b147192ce6758a885", "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "sha256:9ef1e88111d56c06682aab45b536c74dbd0b61dc18ca535d70ffc4a7174a1115" ], "source_surface": { "node_kind": "resource", "node_id": "prepaid-billing" }, "locators": [ { "artifact_digest": "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "start_byte": 1908, "end_byte": 2710, "value_digest": "sha256:4908645a5c6afa34928b65061891ef425741a38b4788245a914595ad7fd4e7c0" }, { "artifact_digest": "sha256:9cd276183477650f0591e75fb9bcda687b34fcba0ad7b937542f3c3bb67f36be", "start_byte": 2711, "end_byte": 3504, "value_digest": "sha256:f6f650b895a3403e4d648adbce57afd5109663bce5d09e064aecdda6c7c3e6dd" } ] } ], "note": "OpenAI documentation details a direct self-service path to purchase prepaid API credits by going to billing overview in account settings or using the Add to balance button in the billing portal without vendor approval." } ], "blockers": [], "remediations": [ { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } ] }, { "stage": "provision", "stage_label": "Provision", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "context": "OpenAI API keys are created in the API key page or dashboard, where the full secret key is shown only upon creation and must be saved or exported manually." }, "secondary_context": [ { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Provisioning of responses can be initiated programmatically via API calls such as client.responses.create or requests sent to post /v1/responses." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "A synchronous API call to the Responses API returns a response object with a completed status and output content upon successful execution." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Delivery needs additional human transfer or has weak scope or lifecycle semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.051Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "quickstart" }, { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b40fe9ec31ac38b02bffdfa1a22b7e9969c0b847fb3b85a3311086e9fad690e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1eb0dd41c63e9cd11be46eea21d8f9cc62ed7955d2fdb3c7df13ca115c5cbb83", "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a58df9d04cf663da1b4c717dcc4be160d7e9c316df74555eb2c5048c22381404" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" }, "locators": [ { "artifact_digest": "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "start_byte": 1054, "end_byte": 1695, "value_digest": "sha256:12e48bcc11539046549be56a08c8a5eb445263c0ccf996e07b37d56897d1c062" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:004500d6302de39df21f63b04d0c568db0ec772343f817ee8221739dac7a0577", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:92e0c4feac1efa9639de2335a72dc09d65d982f9005e6e591715f7ec416e4e2d", "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "sha256:c88e95ea21bcd58d04b7ac4ea2b54cfe25a1c5bf6672921d7f43ae97d8ae4278" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "start_byte": 35913, "end_byte": 36710, "value_digest": "sha256:b2f1bcd5aa3baf87826affddcf72c19f2e177fe7819c3de76d4c6ad234d2371a" } ] } ], "note": "OpenAI API keys are created in the API key page or dashboard, where the full secret key is shown only upon creation and must be saved or exported manually.", "remediation": { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:36.374Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "responses-guide" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:cbe08f4f644f25fa0cfe2c2440a23e70fd4a1cf44e5e6dd3d8676469b824ccef", "capture_rung": "http" } ], "artifact_digests": [ "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:651bf6cea35d8eb3338db520d794d335f53db6f7a752e8a784f20444fd4bd9f8", "sha256:78bb836f29739a91c8a18dea794ed906822125415589d6758a0da631e93bf8eb" ], "source_surface": { "node_kind": "resource", "node_id": "responses-guide" }, "locators": [ { "artifact_digest": "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "start_byte": 4951, "end_byte": 5751, "value_digest": "sha256:c3ae7a957b7ee92daf65a089b94c7a16235ca43b89fbe83f9a3ec6e50846441c" } ] } ], "note": "A synchronous API call to the Responses API returns a response object with a completed status and output content upon successful execution." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.051Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "quickstart" }, { "node_kind": "resource", "node_id": "responses-guide" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:004500d6302de39df21f63b04d0c568db0ec772343f817ee8221739dac7a0577", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7b13263929af994b65cdf88e3d647193734d4bfd300741fceb0f8749dacaec01", "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "sha256:c88e95ea21bcd58d04b7ac4ea2b54cfe25a1c5bf6672921d7f43ae97d8ae4278" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "start_byte": 36711, "end_byte": 37511, "value_digest": "sha256:7e95dcbc271a1ef07dfb57a9d38f3230770d70ff5a31a1af4d8a25c2f1e92913" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:cbe08f4f644f25fa0cfe2c2440a23e70fd4a1cf44e5e6dd3d8676469b824ccef", "capture_rung": "http" } ], "artifact_digests": [ "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "sha256:41dde7665f0a9c02d4e468afef2dbe135cca354677d6f66e4494ffa0d6785e84", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:651bf6cea35d8eb3338db520d794d335f53db6f7a752e8a784f20444fd4bd9f8" ], "source_surface": { "node_kind": "resource", "node_id": "responses-guide" }, "locators": [ { "artifact_digest": "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "start_byte": 7546, "end_byte": 7647, "value_digest": "sha256:13c9596e1bf43d54735b33dab39b901fab87eb6a22fe9d5b4f23b9a367f858d6" } ] } ], "note": "Provisioning of responses can be initiated programmatically via API calls such as client.responses.create or requests sent to post /v1/responses." } ], "blockers": [], "remediations": [ { "signal_code": "access_material_delivery", "code": "improve.provision.access_material_delivery", "instruction": "Deliver scoped access material through a secure documented machine-usable flow." } ] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Documentation covers API error codes (such as 401, 429, 500, and 503), rate limits, and recommends exponential backoff retry strategies respecting Retry-After headers. Full idempotency, cancellation, and reconciliation contracts for all failure modes are not completely detailed." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Documentation states users can create and manage API keys on the API key page, and if a full secret key is lost, create a new key and update the application, representing a partially manual key lifecycle without documenting programmatic rotation or compromise recovery." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Every essential target has documented machine-operable interfaces available through direct HTTP endpoints and official SDKs across supported environments." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Request-time authentication with scoped authority is documented, accepting HTTP Bearer tokens via API keys or short-lived access tokens via workload identity federation in the Authorization header." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Across all evaluated surfaces, essential operational inputs, outputs, schemas, parameters, rate limits, and effect semantics for the API are documented and stable." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:22.013Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "quickstart" }, { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b40fe9ec31ac38b02bffdfa1a22b7e9969c0b847fb3b85a3311086e9fad690e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1eb0dd41c63e9cd11be46eea21d8f9cc62ed7955d2fdb3c7df13ca115c5cbb83", "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a58df9d04cf663da1b4c717dcc4be160d7e9c316df74555eb2c5048c22381404" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" }, "locators": [ { "artifact_digest": "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "start_byte": 1054, "end_byte": 1695, "value_digest": "sha256:12e48bcc11539046549be56a08c8a5eb445263c0ccf996e07b37d56897d1c062" } ] } ], "note": "Documentation states users can create and manage API keys on the API key page, and if a full secret key is lost, create a new key and update the application, representing a partially manual key lifecycle without documenting programmatic rotation or compromise recovery.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:47.583Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-errors" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:423178aefdd448b78a072ce4a70b749b05ff23e4ea76109cd2ff84288b6d8036", "capture_rung": "http" } ], "artifact_digests": [ "sha256:14a14c7215a431fc5b4378c05883b2ee2f825c26a350eefc84fa0d4f5927c203", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:51dca8909aa9cb7c9a43eea25d42c1200d834962fada34cdc020110511b5f647", "sha256:a540146e79108617ff7689e23586bb3bcf37ba64cd5e8c23999f8219ec6e8ebe" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:a540146e79108617ff7689e23586bb3bcf37ba64cd5e8c23999f8219ec6e8ebe", "start_byte": 33873, "end_byte": 34668, "value_digest": "sha256:e0afe6278c54227a2a48ec2871937a521201a3229e120a953e31a2b744e0477a" }, { "artifact_digest": "sha256:a540146e79108617ff7689e23586bb3bcf37ba64cd5e8c23999f8219ec6e8ebe", "start_byte": 35453, "end_byte": 36239, "value_digest": "sha256:f691f1825618c3fee917ce7898ac33f1d406050d79b159a22767a6d2ad5e43ea" } ] } ], "note": "Documentation covers API error codes (such as 401, 429, 500, and 503), rate limits, and recommends exponential backoff retry strategies respecting Retry-After headers. Full idempotency, cancellation, and reconciliation contracts for all failure modes are not completely detailed.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.051Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "quickstart" }, { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b40fe9ec31ac38b02bffdfa1a22b7e9969c0b847fb3b85a3311086e9fad690e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:1eb0dd41c63e9cd11be46eea21d8f9cc62ed7955d2fdb3c7df13ca115c5cbb83", "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:a58df9d04cf663da1b4c717dcc4be160d7e9c316df74555eb2c5048c22381404" ], "source_surface": { "node_kind": "resource", "node_id": "readiness-b40f6dd9ecf10bde91b1d804002877ffaa0484272ccd4856be863bfdab5a5b7c" }, "locators": [ { "artifact_digest": "sha256:23165678c64dee6547ce5b5f0508b527ced5ad586bdf64e66b0831e8f1532e59", "start_byte": 1054, "end_byte": 1695, "value_digest": "sha256:12e48bcc11539046549be56a08c8a5eb445263c0ccf996e07b37d56897d1c062" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:004500d6302de39df21f63b04d0c568db0ec772343f817ee8221739dac7a0577", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:575b63af08a4f3fd3d87f286e937ab3fd4eac52b7b2961117ee49a93f01a0e35", "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "sha256:c88e95ea21bcd58d04b7ac4ea2b54cfe25a1c5bf6672921d7f43ae97d8ae4278" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "start_byte": 45128, "end_byte": 45924, "value_digest": "sha256:3315f19f1e479b960ed6a7285669aff500619720a1f40380217153bdbe6990fa" } ] } ], "note": "Request-time authentication with scoped authority is documented, accepting HTTP Bearer tokens via API keys or short-lived access tokens via workload identity federation in the Authorization header." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.051Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "api-service" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:004500d6302de39df21f63b04d0c568db0ec772343f817ee8221739dac7a0577", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:7b13263929af994b65cdf88e3d647193734d4bfd300741fceb0f8749dacaec01", "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "sha256:c88e95ea21bcd58d04b7ac4ea2b54cfe25a1c5bf6672921d7f43ae97d8ae4278" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "start_byte": 36711, "end_byte": 37511, "value_digest": "sha256:7e95dcbc271a1ef07dfb57a9d38f3230770d70ff5a31a1af4d8a25c2f1e92913" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f06346a38381b5c0d0b8d711a5bd17c3af61ff2fa087c0e8e0ee50af08c809e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:757f2806e86a4f4586780f029db1ed6ce0aa0162dd2099d0f4f6c1b98396ed82", "sha256:b31bf509f984aa5f5890489933e3fb38fa93c718a8e817b88957c4e6478165b6", "sha256:f697fb7de2dcdeccc389d3d9e426130bfbb04ba4c6efda00c3ff9bfdc866d83e" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:f697fb7de2dcdeccc389d3d9e426130bfbb04ba4c6efda00c3ff9bfdc866d83e", "start_byte": 34570, "end_byte": 35368, "value_digest": "sha256:f9b831df6a5763c1680aa4f96794f347ea1c7aa674c4c7bcf1260f59e9002da5" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:cbe08f4f644f25fa0cfe2c2440a23e70fd4a1cf44e5e6dd3d8676469b824ccef", "capture_rung": "http" } ], "artifact_digests": [ "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:651bf6cea35d8eb3338db520d794d335f53db6f7a752e8a784f20444fd4bd9f8", "sha256:c3ad54973fab576a3e379a54399d584b8c247ac8527c5921c62d2fc540fc23da" ], "source_surface": { "node_kind": "resource", "node_id": "responses-guide" }, "locators": [ { "artifact_digest": "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "start_byte": 5871, "end_byte": 6668, "value_digest": "sha256:c8a75233bf139a97c6acda48ae86bda400b7ab649b5f2515a0f48c54564717cb" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:423178aefdd448b78a072ce4a70b749b05ff23e4ea76109cd2ff84288b6d8036", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:51dca8909aa9cb7c9a43eea25d42c1200d834962fada34cdc020110511b5f647", "sha256:a540146e79108617ff7689e23586bb3bcf37ba64cd5e8c23999f8219ec6e8ebe", "sha256:d2e431a51bd05d805b5757746bbe371ac06af287692833b2e54d7830ec0f07e1" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:a540146e79108617ff7689e23586bb3bcf37ba64cd5e8c23999f8219ec6e8ebe", "start_byte": 44985, "end_byte": 45770, "value_digest": "sha256:876d29b04b7be1a47c50364afd9da845b21e9d8a9427e345f238e706c6a05bcd" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d68b309479d5a9b702dc5e6182c1d3ef4d84d1b1b1f6292df922ca8704f7a7ef", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:6cbb1a8356bc0db87f9d287078c81c50616b174b6faab47eb3383fe34ae57a37", "sha256:d3ce31afc57f8aeb5387d65a0dd740fd82beef780cb24be06013286a52a2674a", "sha256:f0f02e2b43ed153a6cb948aed4b235727b732c0c4fa50692a329137e54131111" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:f0f02e2b43ed153a6cb948aed4b235727b732c0c4fa50692a329137e54131111", "start_byte": 42464, "end_byte": 43259, "value_digest": "sha256:2620fa9c77e102577175bd427bd098ae36a04984b52388861109c9e9682ed5de" } ] } ], "note": "Across all evaluated surfaces, essential operational inputs, outputs, schemas, parameters, rate limits, and effect semantics for the API are documented and stable." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.051Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "api-service" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:004500d6302de39df21f63b04d0c568db0ec772343f817ee8221739dac7a0577", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:8dd9d99d88645ccb0be4053f6168eda90794babbdae710e0b72e43745b238554", "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "sha256:c88e95ea21bcd58d04b7ac4ea2b54cfe25a1c5bf6672921d7f43ae97d8ae4278" ], "source_surface": { "node_kind": "resource", "node_id": "quickstart" }, "locators": [ { "artifact_digest": "sha256:b3176fcad57f010f09ade980d088281c74e07679ea40408c1b09d27e84099f9d", "start_byte": 35113, "end_byte": 35912, "value_digest": "sha256:024d0525b4b780a7cfb2b90c3bed4b5225500bc8dc6b3205480ca7568afd3875" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:423178aefdd448b78a072ce4a70b749b05ff23e4ea76109cd2ff84288b6d8036", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:51dca8909aa9cb7c9a43eea25d42c1200d834962fada34cdc020110511b5f647", "sha256:5d9c33a1134c625c3d3e7ffd87b9cf5edc4a15f44eb51f4321cd68520deefbba", "sha256:a540146e79108617ff7689e23586bb3bcf37ba64cd5e8c23999f8219ec6e8ebe" ], "source_surface": { "node_kind": "resource", "node_id": "api-errors" }, "locators": [ { "artifact_digest": "sha256:a540146e79108617ff7689e23586bb3bcf37ba64cd5e8c23999f8219ec6e8ebe", "start_byte": 33873, "end_byte": 34668, "value_digest": "sha256:e0afe6278c54227a2a48ec2871937a521201a3229e120a953e31a2b744e0477a" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d68b309479d5a9b702dc5e6182c1d3ef4d84d1b1b1f6292df922ca8704f7a7ef", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:9e2f40a1a190400822cda278d2691c35c5cc44a347d734fdff93aaf4c81088ad", "sha256:d3ce31afc57f8aeb5387d65a0dd740fd82beef780cb24be06013286a52a2674a", "sha256:f0f02e2b43ed153a6cb948aed4b235727b732c0c4fa50692a329137e54131111" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:f0f02e2b43ed153a6cb948aed4b235727b732c0c4fa50692a329137e54131111", "start_byte": 36164, "end_byte": 36960, "value_digest": "sha256:1c26f235b09c6630e87a33e72156853419b001903da00d236959904a5e48184a" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:cbe08f4f644f25fa0cfe2c2440a23e70fd4a1cf44e5e6dd3d8676469b824ccef", "capture_rung": "http" } ], "artifact_digests": [ "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "sha256:4e1c18e65b8ee0c4f87caa21ce3cddc92016d3003139b8c7cc2278f50759860e", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:651bf6cea35d8eb3338db520d794d335f53db6f7a752e8a784f20444fd4bd9f8" ], "source_surface": { "node_kind": "resource", "node_id": "responses-guide" }, "locators": [ { "artifact_digest": "sha256:28941e34472f7e87f26b9afc325db6211b8a79616d86950fb2e16e0c1431c6a7", "start_byte": 604, "end_byte": 705, "value_digest": "sha256:cda08162d86cf4e501ad1265718f9fb8c1d0f5ed87645f46f81ed68cc41e7af3" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f06346a38381b5c0d0b8d711a5bd17c3af61ff2fa087c0e8e0ee50af08c809e7", "capture_rung": "http" } ], "artifact_digests": [ "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:757f2806e86a4f4586780f029db1ed6ce0aa0162dd2099d0f4f6c1b98396ed82", "sha256:a36a227375619ab9ec7f1a148d32963263657c21dcde3a3804949e100cbf8578", "sha256:f697fb7de2dcdeccc389d3d9e426130bfbb04ba4c6efda00c3ff9bfdc866d83e" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:f697fb7de2dcdeccc389d3d9e426130bfbb04ba4c6efda00c3ff9bfdc866d83e", "start_byte": 32971, "end_byte": 33770, "value_digest": "sha256:45177db9e30455f2d06538c137928151487a06dc482190af4952a5b08a8d989b" } ] } ], "note": "Every essential target has documented machine-operable interfaces available through direct HTTP endpoints and official SDKs across supported environments." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 16, "covered_signals": 16, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 0, "barrier_ratio": 0 }, "last_tested_at": "2026-08-20T15:57:13.094Z", "freshness": "fresh", "provenance": { "tier": "observed", "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "freshness_policy_digest": "sha256:00f7f2a35f37b184e57ce2cc116f6a5e3feb4813991aacd7e29e322f2d3607a8", "basis_event_ids": [ "sha256:0a113b8e41b78203e662e3dd7070af17eb1297b671f797ba4b4f8a1e8e159821", "sha256:0da4e3545fa52e21450057f91d95107b022b8da098ebb9abfd85cfeb2cde5af1", "sha256:1b711925f137185ceee564a42e8a4782b1073e53efc65c29829b767548681bb8", "sha256:1f66d7b697a08d84ae2b4dc4aeed62015f292eca8004ae07b70e979aae0b7d8f", "sha256:29cafe5401ff6a33f4b0f18d75923c60986f102cdd1c902b82c3004fbe36ada9", "sha256:331ef492c0db2410e07243e8796883affd68aa2b487d5f8600a4f1efd3ef0ae6", "sha256:3f8e7d06a1a5ccc25b4571fb5474dd8972c81c62800efed3fe88e62364a0e044", "sha256:432bfced570eb334613efc080dfb6cd873ca302ca8b7d8f30233f650b629020f", "sha256:4b4fec24add78552903d74a91e829502f468e43112800e0633b14d7196b745c9", "sha256:5bc3611f05c0eed6805faa0afafc182e029facd5783478231d5a09ba4a341ea1", "sha256:5bcc610ab56e61ab182a40a19737de355abffb6178dab628797f89dbf3d50f1d", "sha256:5d18be22473835ec1743915a470dbd759be228ba77f19217a6b724f8cccdc284", "sha256:626ce603df361a94fce8816d227df24824a68bd5fa2157c4aaeecaabcd46e4c7", "sha256:63426732c24d333305559770afbc6a5204e060aa6536c36588d9fdf713a94523", "sha256:654edf9d55252e145eaec355fb39e4e36d1c2bbec69a2f57a65e205b844cd672", "sha256:67f16b908e93dccdf1c3d1e10e4078193eff82e4c9a15a7c79d675428d49cabe", "sha256:6c95fed00c6f92a4f76abf4eaed7f78fb24e4ae3c0be0e11404a4ad8b8c24ef0", "sha256:6eb08fd064792d4d1d1cea68affde10e3e38f6f8ce9c89c5bcba9160b713b0b3", "sha256:736725c99da9b9e9b0e7917171692552ac8573547320274b95465bae2bcaad4c", "sha256:7d2a58436acbb790d5a5b55d750d1c39e072f28f330e1d320b5f32818adc78aa", "sha256:7f7d7ed6c6447e7df87e770b795304fba308f05bb1a0e453d4abd3e5df11e5a7", "sha256:88b29b1c7e13de56f140ef5c9a1e73c0186c4ed601b0ea441dc94ba60cc34c67", "sha256:9679ca8a5894597109a78aee8f93a71b0876da50086e77c2acc61da848b0e991", "sha256:9c1991b2dda5ea69e214108943a19a4fad6c362aeb41371a06d7f6cc429b3858", "sha256:a2bb2f90d971364ade0a9394e3ae60b282a97b5fc250f9e15a76343a63cd73c7", "sha256:a781a50f0663a85d1978e6895df378ae18fde5cbab1bd595ed131f41ce58a790", "sha256:a9fe4ff752b8fb314141fab2e64f658907b5461d8f202732c4e2c4c36d0e4b08", "sha256:b60a954d4d3a4351969ea5cda6cec0d804ddda9db83ef0ac4659ed3ea2fda112", "sha256:b6e88c7b7a3945bff9e0d0bc2cc33a5f6f5088143ac43aea551dbd98c0dbe8f2", "sha256:cf8a76e0184f3904a95965eecc2faa415d0996b5714a92da8616a31094c9c731", "sha256:dd7c94c4454719c6eddff5304d366ad7d1d9b13e884c449bed1b3c99db040ed1", "sha256:ddf6be46b714a22226a32f66e4ae0e0563184b325bfbdf1fe7098a599659896e", "sha256:e5790623005986f2164eaaf9e7c058e2565c09579ae611165228f558fece3a7d", "sha256:fff68a3b751186478515672cc557455852e9e1ea593d4a9ee1a5461c14f092e9" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:6c95fed00c6f92a4f76abf4eaed7f78fb24e4ae3c0be0e11404a4ad8b8c24ef0" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:21.304Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:ddf6be46b714a22226a32f66e4ae0e0563184b325bfbdf1fe7098a599659896e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:12.265Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:4b4fec24add78552903d74a91e829502f468e43112800e0633b14d7196b745c9" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:59.255Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:736725c99da9b9e9b0e7917171692552ac8573547320274b95465bae2bcaad4c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:21.304Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:b60a954d4d3a4351969ea5cda6cec0d804ddda9db83ef0ac4659ed3ea2fda112" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:13.094Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:654edf9d55252e145eaec355fb39e4e36d1c2bbec69a2f57a65e205b844cd672" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:13.094Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:5bcc610ab56e61ab182a40a19737de355abffb6178dab628797f89dbf3d50f1d", "sha256:a781a50f0663a85d1978e6895df378ae18fde5cbab1bd595ed131f41ce58a790" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:13.094Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:63426732c24d333305559770afbc6a5204e060aa6536c36588d9fdf713a94523", "sha256:a9fe4ff752b8fb314141fab2e64f658907b5461d8f202732c4e2c4c36d0e4b08" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.051Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:88b29b1c7e13de56f140ef5c9a1e73c0186c4ed601b0ea441dc94ba60cc34c67" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:13.094Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:3f8e7d06a1a5ccc25b4571fb5474dd8972c81c62800efed3fe88e62364a0e044" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:12.265Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:331ef492c0db2410e07243e8796883affd68aa2b487d5f8600a4f1efd3ef0ae6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:12.265Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:9679ca8a5894597109a78aee8f93a71b0876da50086e77c2acc61da848b0e991" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:12.265Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:432bfced570eb334613efc080dfb6cd873ca302ca8b7d8f30233f650b629020f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:12.265Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:1f66d7b697a08d84ae2b4dc4aeed62015f292eca8004ae07b70e979aae0b7d8f", "sha256:626ce603df361a94fce8816d227df24824a68bd5fa2157c4aaeecaabcd46e4c7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.051Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:dd7c94c4454719c6eddff5304d366ad7d1d9b13e884c449bed1b3c99db040ed1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:36.374Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:1b711925f137185ceee564a42e8a4782b1073e53efc65c29829b767548681bb8", "sha256:cf8a76e0184f3904a95965eecc2faa415d0996b5714a92da8616a31094c9c731" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.051Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:0da4e3545fa52e21450057f91d95107b022b8da098ebb9abfd85cfeb2cde5af1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:22.013Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:a2bb2f90d971364ade0a9394e3ae60b282a97b5fc250f9e15a76343a63cd73c7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:47.583Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:5d18be22473835ec1743915a470dbd759be228ba77f19217a6b724f8cccdc284", "sha256:7f7d7ed6c6447e7df87e770b795304fba308f05bb1a0e453d4abd3e5df11e5a7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.051Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:0a113b8e41b78203e662e3dd7070af17eb1297b671f797ba4b4f8a1e8e159821", "sha256:29cafe5401ff6a33f4b0f18d75923c60986f102cdd1c902b82c3004fbe36ada9", "sha256:5bc3611f05c0eed6805faa0afafc182e029facd5783478231d5a09ba4a341ea1", "sha256:7d2a58436acbb790d5a5b55d750d1c39e072f28f330e1d320b5f32818adc78aa", "sha256:b6e88c7b7a3945bff9e0d0bc2cc33a5f6f5088143ac43aea551dbd98c0dbe8f2" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.051Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:67f16b908e93dccdf1c3d1e10e4078193eff82e4c9a15a7c79d675428d49cabe", "sha256:6eb08fd064792d4d1d1cea68affde10e3e38f6f8ce9c89c5bcba9160b713b0b3", "sha256:9c1991b2dda5ea69e214108943a19a4fad6c362aeb41371a06d7f6cc429b3858", "sha256:e5790623005986f2164eaaf9e7c058e2565c09579ae611165228f558fece3a7d", "sha256:fff68a3b751186478515672cc557455852e9e1ea593d4a9ee1a5461c14f092e9" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.051Z", "freshness": "fresh" } ] }, "canonical_url": "https://sourcey.com/catalog/openai/agent-readiness/openai-api/api-service-lifecycle", "projection_digest": "sha256:e4799b49cd56c286f3d88319b63046d1d5004e9dabc58b206774bd9bde4c1846" } } }