Public and private API contracts are separated
The production public document is built from an explicit operation allowlist. Private documentation is disabled unless configured and then requires separate high-entropy HTTP Basic credentials.
Assurance bounded by available evidence.
Trust statements are useful only when their evidence and limits are clear. This page separates implemented controls from certifications or external assessments Vintraa has not published.
For runtime compatibility, read the machine-readable support registry. For individual API authorization, inspect each operation in the public reference.
Public contract quality is release-gated
Automated tests reject missing summaries, descriptions, useful success schemas, authentication errors, and documented rate-limit responses. They also assert that representative private routes are absent.
No published third-party assurance
Vintraa does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, an external penetration test, or a formal availability SLA on this page.
Integration support has a canonical registry
Support contract 2026-08-06 separates discovery, sandbox, customer execution, and publication. A general SUPPORTED label applies only where the corresponding stage flag is true.