How to audit metadata and GetCapabilities without claiming certification

An initial metadata and geoservice audit can automate objective signals: well-formed XML, identification fields, responsible party, spatial and temporal extent, coordinate reference, restrictions, formats, operations and layers declared through GetCapabilities. The result should be an explainable list of present, missing and inconsistent elements. It must not become a conformance badge or replace interpretation of the applicable standard.

The decision this guide supports

Begin by defining the profile against which the document will be reviewed. “ISO” covers different families and profiles; “OGC” groups specifications with different versions and operations. The auditor should record document type and version when they can be determined and return “not identified” instead of guessing. In Colombia, the interoperability framework communicated by ICDE helps frame the institutional analysis.

Define separate review profiles for dataset metadata, service metadata and GetCapabilities documents. Record the standard version, namespace, language and encoding before assessing elements because the same name may have a different meaning across profiles. For a service, check operations, formats, bounds, coordinate reference systems and advertised layers, then compare a sample with the actual response. The report should distinguish unreadable XML, missing elements, inconsistent values and content requiring interpretation. This separation lets teams fix failures that prevent discovery or use first without claiming a certification the auditor does not provide.

Recommended workflow

1. Agree. Process XML locally, cap its size and reject external entities or malformed content.
2. Structure. Identify standard, version, language and hierarchy before checking specific elements.
3. Check. Review title, abstract, owner, dates, extent, CRS, lineage, licence and restrictions.
4. Document. For GetCapabilities, compare declared operations, formats, layers, CRS and URLs.
5. Operate. Generate findings with element path, severity, evidence and suggested action.

Minimum controls before publishing or delivery

A useful review combines automated checks with expert judgement. At minimum, record:

• file and hash tied to the result.
• versioned human-readable rules.
• a distinction between mandatory, conditional and recommended.
• no outbound request while processing the local upload.

Limits that must remain visible

The presence of an element does not make it correct. An extent may be reversed, a licence may not permit redistribution, and a URL may respond only inside a private network. Conversely, a missing field may be conditional under a particular profile. Automated reporting supports review and prioritisation; it does not certify metadata, services or the producing institution.

To apply this method to a concrete project, review the GeoSAT sector service and compare its dependencies with the related service. These links serve different intents: this guide explains the process, while the service pages define scope, evidence and the appropriate commercial next step.