generated: '2026-07-17'
method: derived
source: openapi/alasco-fincon-openapi.json, openapi/alasco-capex-openapi.json, openapi/alasco-esg-openapi.json, https://www.alasco.com/security-trust
standards:
- id: openapi-3.1
  conforms: true
  evidence: All three product specs are OpenAPI 3.1.0.
- id: json-api
  conforms: true
  evidence: >-
    Docs state the API follows JSON:API principles; cursor[position] pagination,
    filter[attribute.operation] filtering, and include compound documents are present.
- id: apikey-auth
  conforms: true
  evidence: securitySchemes X-API-KEY + X-API-TOKEN (apiKey in header).
- id: oauth2
  conforms: false
  evidence: The Public API uses API keys/tokens; OAuth2 applies only to the MCP server.
- id: oidc
  conforms: false
  evidence: No OpenID Connect on the Public API (MCP server exposes OIDC discovery separately).
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a JSON:API-style envelope (detail/source/status/title), not application/problem+json.
- id: fhir
  conforms: false
- id: fapi
  conforms: false
- id: scim
  conforms: false
- id: odata
  conforms: false
- id: psd2
  conforms: false
compliance:
  published: true
  source: https://www.alasco.com/security-trust
  certifications:
  - SOC 2
  - ISO/IEC 27001
  - GDPR
  ref: security/alasco-trust-center.yml