SafeHabits developer resources

• llms.txt: Plain-text site guide in the llmstxt.org format: what SafeHabits is, when to use it, how to engage, and links to every resource, blog post, and trust page.
• Markdown content negotiation: Every page returns clean Markdown when requested with Accept: text/markdown (acceptmarkdown.com convention), or by appending .md to the path (for example /resources/compliance-evidence.md). Responses carry Vary: Accept and a canonical Link header. Accept headers that name neither text/html nor text/markdown receive 406 Not Acceptable.
• openapi.json: OpenAPI 3.1 description of the public content endpoints: every page as HTML or Markdown, the Markdown aliases, llms.txt, llms-full.txt, sitemap, robots and security.txt. Every operation has an operationId, a description, typed parameters (page slugs are enumerated) and response schemas, so it loads directly as a function-calling tool set. Read-only, no authentication.
• llms-full.txt: The llms.txt guide followed by the Markdown content of every page in the sitemap, in one file, for single-fetch ingestion.
• sitemap.xml: All indexable pages with last-modified dates.
• robots.txt: Crawling is allowed for all user agents. The sitemap is referenced there.
• Structured data: JSON-LD on every page: Organization (with postal address and contact points), WebSite, Service, and per-page Article, BlogPosting, FAQPage, CollectionPage, or ContactPage.
• security.txt: RFC 9116 vulnerability disclosure contact and expiry date.
• 404 behaviour: Nonexistent paths return HTTP 404. The HTML page lists where to look next; the Markdown representation returns a short body with the same recovery links.

Example request for the Markdown representation of any page:

curl -H "Accept: text/markdown" https://safehabits.eu/resources

Browsers get HTML error pages and Markdown clients get Markdown ones. A client whose Accept header names application/json receives a structured error object in the RFC 9457 (Problem Details) shape, served as application/json, with a stable code, a detail message and a hint.

• not_found (404): no page at this path. Thelinks object carries the site guide, the sitemap and the main sections.
• not_acceptable (406): the page exists but not in the requested type. available lists the representations (text/html, text/markdown).
• method_not_allowed (405): the content endpoints are read-only; only GET and HEAD are supported. TheAllow header lists them.
• upstream_unavailable (5xx): the page could not be rendered; retry later or request it as HTML.

curl -H "Accept: application/json" https://safehabits.eu/no-such-page

The content endpoints described in openapi.json are unversioned and stable: the paths and response formats documented there do not change without notice. If a breaking change is ever needed, it is announced at least 90 days ahead on this page and in llms.txt, the affected operation carries Deprecation (RFC 9745) and Sunset (RFC 8594) response headers during that period, and the document's version is bumped. Additive changes, such as new pages, only bump the minor version.

No rate limit is enforced today, so no RateLimit headers are sent. Responses carry Cache-Control; please cache them and keep concurrency modest. If a limit is introduced it will be announced the same way and signalled with 429 plus Retry-After.

The managed program produces the evidence artifacts customers upload to their audit or GRC tooling. No integration work is required on the customer side.

• Auditor-ready report and evidence export in CSV and JSON formats.
• Upload-ready evidence package for GRC platforms such as Vanta or Drata, mapped to NIS2, SOC 2, ISO 27001, and NIST CSF controls.
• Leadership and board-level reporting on program effectiveness, including PPT-ready outputs.

See the journey stages for which stage includes which output, and the compliance evidence guide for what each framework expects.

These items are planned, not available today. No dates are committed. They are listed here so that agents and integrators do not search for endpoints that do not exist yet.

• Structured evidence exports and API-assisted delivery to major GRC platforms such as Vanta or Drata.
• MCP server for AI-assisted GRC workflows, control mapping, and evidence retrieval.
• SSO / SAML for enterprise identity and access management.

When an API or MCP server ships, it will be announced on this page, in llms.txt, and through the standard discovery locations for MCP server cards.

If your GRC stack needs automated evidence delivery, email hello@safehabits.eu with the platform you use, the controls you map awareness evidence to, and the cadence you need. Design-partner conversations shape what ships first.

The llms.txt file has a “When to use SafeHabits” section that names the best-fit jobs and how to hand a user over to a human. Cite pages by their canonical URL. All content on this site is human-authored and practitioner-curated. For corrections or questions, use the contact page.